XT:Commerce Cross Site Scripting

---------------------------------------------------------------------------------- Cross-Site-Scripting XT:Commerce alertdocument.cookie and place an order. When the administrator opens the order in the backend of the shop, the javascript will be executed. By getting the cookie of the admin, the...

XT:Commerce 3.04 SP2.1 - Cross-Site Scripting

XT:Commerce 3.04 SP2.1 - Cross-Site Scripting ---------------------------------------------------------------------------------- Cross-Site-Scripting XT:Commerce alertdocument.cookie and place an order. When the administrator opens the order in the backend of the shop, the javascript will be...

FireSheep Fallout: Microsoft Adds HTTPS Option for Hotmail

Three weeks after researchers unveiled a plugin that allows Firefox Web browser users to snoop on the Webmail and social networking sessions of those around them, Microsoft has announced an option that will allow users of its Hotmail Web e-mail program to browse securely. The company said on...

ToorCon: New Apps, Old Infrastructure Make Toxic Brew

In a variety of ways, experts at this weekend’s ToorCon Conference warned that the tidal wave of new devices and Web based services is straining an already aging Internet infrastructure, with privacy and security as the first victims. Call it the ‘schizophrenia of now’: a tidal wave of new...

Plugin, FireSheep, Lays Open Web 2.0 Insecurity

HED: New Tool, FireSheep, Lays Open Web 2.0 Insecurity DEK: The Browser Plug In Offers One Click Session Hijacking for Popular Social Networking Apps. Creators call for better session security. It’s no secret that Web sessions that use the bare HTTP protocol to transmit and receive data are...

NetWin Surgemail XSS vulnerability

Application NetWin Surgemail 4.3e Vendor NetWin - http://netwinsite.com Discovered by Kerem Kocaer [email protected] Problem ------- Cross-site scripting XSS vulnerability in the Surgemail webmail login page /surgemail allows remote attackers to inject arbitrary web script or HTML. Input...

NetWin Surgemail 4.3e Cross Site Scripting

Application NetWin Surgemail 4.3e Vendor NetWin - http://netwinsite.com Discovered by Kerem Kocaer Problem ------- Cross-site scripting XSS vulnerability in the Surgemail webmail login page /surgemail allows remote attackers to inject arbitrary web script or HTML. Input passed to the "usernameex"...

Details Emerge on IE 8 Data-Stealing Bug

Security researcher Chris Evans has released details of the data-stealing bug in Internet Explorer 8 that he publicized earlier this month, saying that the CSS flaw can be used to force victims to post messages on Twitter and that the bug appears to be no closer to being fixed. The bug, which has...

Splunk Multiple vulnerabilities

This host is running Splunk and is prone to multiple vulnerabilities. OpenVAS Vulnerability Test $Id: secpodsplunkmultvuln.nasl 5401 2017-02-23 09:46:07Z teissa $ Splunk Multiple vulnerabilities Authors: Sooraj KS Copyright: Copyright c 2010 SecPod, http://www.secpod.com This program is free...

Splunk 4.0.0 - 4.1.4 Multiple Vulnerabilities

Splunk is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2010 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:splunk:splunk"; ifdescription...

CVE-2010-3471

CVE-2010-3471 impacts IBM FileNet P8 Application Engine (P8AE) 4.0.2.x, with a vulnerability in the Workplace component that allows session fixation and potential web-session hijacking. The issue is described as affecting all 4.0.2.x prior to 4.0.2.7-P8AE-FP007 and is triggered through unspecifie...

CVE-2010-3323

Splunk 4.0.0 through 4.1.4 allows remote attackers to conduct session hijacking attacks and obtain the splunkd session key via vectors related to the SPLUNKDSESSIONKEY parameter...

Session fixation

Splunk 4.0.0 through 4.1.4 allows remote attackers to conduct session hijacking attacks and obtain the splunkd session key via vectors related to the SPLUNKDSESSIONKEY parameter...

CVE-2010-3323

Splunk 4.0.0 through 4.1.4 allows remote attackers to conduct session hijacking attacks and obtain the splunkd session key via vectors related to the SPLUNKDSESSIONKEY parameter...

CVE-2010-3323

Splunk 4.0.0–4.1.4 is vulnerable to remote session hijacking; the root cause is exposure of the splunkd session key via vectors related to the SPLUNKD_SESSION_KEY parameter. Impact is disclosure of the session key and potential unauthorized access. No patch/version remediation details are provide...

Mandriva Update for tomcat5 MDVSA-2010:176 (tomcat5)

Check for the Version of tomcat5 OpenVAS Vulnerability Test Mandriva Update for tomcat5 MDVSA-2010:176 tomcat5 Authors: System Generated Check Copyright: Copyright c 2010 Greenbone Networks GmbH, http://www.greenbone.net This program is free software; you can redistribute it and/or modify it unde...

Mandriva Update for tomcat5 MDVSA-2010:176 (tomcat5)

Check for the Version of tomcat5 OpenVAS Vulnerability Test Mandriva Update for tomcat5 MDVSA-2010:176 tomcat5 Authors: System Generated Check Copyright: Copyright c 2010 Greenbone Networks GmbH, http://www.greenbone.net This program is free software; you can redistribute it and/or modify it unde...

'Padding Oracle' Crypto Attack Affects Millions of ASP.NET Apps

A pair of security researchers have implemented an attack that exploits the way that ASP.NET Web applications handle encrypted session cookies, a weakness that could enable an attacker to hijack users’ online banking sessions and cause other severe problems in vulnerable applications. Experts say...

Mandriva Linux Security Advisory : tomcat5 (MDVSA-2010:176)

Multiple vulnerabilities has been found and corrected in tomcat5 : Apache Tomcat 6.0.0 through 6.0.14, 5.5.0 through 5.5.25, and 4.1.0 through 4.1.36 does not properly handle 1 double quote ' characters or 2 %5C encoded backslash sequences in a cookie value, which might cause sensitive informatio...

Nasty Data-Stealing Bug Haunts Internet Explorer 8

There’s an unpatched vulnerability in Internet Explorer 8 that enables simple data-stealing attacks by Web-based attackers and could lead to an attacker hijacking a user’s authenticated session on a third-party site. The flaw, which a researcher said may have been known since 2008, lies in the wa...