CVE-2009-2165

SerendipityNZ aka SimpleBoxes Serene Bach 2.20R and earlier, and 3.00 beta023 and earlier 3.x versions, uses a predictable session id, which makes it easier for remote attackers to hijack sessions via a modified id...

CVE-2009-2165

The CVE-2009-2165 entry affects SerendipityNZ’s Serene Bach (2.20R and earlier; 3.00 beta023 and earlier 3.x). The root issue is predictable session IDs, enabling remote attackers to hijack sessions and impersonate administrators to access or alter information. Documents from JVN/JVNDB indicate t...

CVE-2009-2150

Multiple cross-site request forgery CSRF vulnerabilities in Campus Virtual-LMS allow 1 remote attackers to hijack the authentication of arbitrary users for requests that terminate a session via login/logout.php, and might allow remote attackers to hijack the authentication of certain users via a ...

CVE-2008-6830

The disconnection feature in Citrix Web Interface 5.0 and 5.0.1 for Java Application Servers does not properly terminate a user's web interface session, which allows attackers with access to the same browser instance to gain access to the user's Web Interface session. NOTE: the attacker must also...

Hardcoded credentials

The Java client program for the ATEN KH1516i IP KVM switch with firmware 1.0.063 and the KN9116 IP KVM switch with firmware 1.1.104 has a hardcoded AES encryption key, which makes it easier for man-in-the-middle attackers to 1 execute arbitrary Java code, or 2 gain access to machines connected to...

Fedora 9 : squirrelmail-1.4.19-1.fc9 (2009-5471)

Fri May 22 2009 Michal Hlavinka - 1.4.19-1 - updated to 1.4.19 - fixes CVE-2009-1579, CVE-2009-1580, CVE-2009-1581 - Tue May 19 2009 Michal Hlavinka - 1.4.18-2 - fix undefined variable aSpamIds 501260 - Tue May 12 2009 Michal Hlavinka - 1.4.18-1 - update to 1.4.18 fixes CVE-2009-1581 - Thu Dec 4...

Debian Security Advisory DSA 1802-1 (squirrelmail)

The remote host is missing an update to squirrelmail announced via advisory DSA 1802-1. This VT has been deprecated and merged into the VT SPDX-FileCopyrightText: 2009 E-Soft Inc. Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right...

A real sense of Session hijacking-vulnerability warning-the black bar safety net

Author: jianxin 80sec EMail: jianxin80sec.com Site: http://www.80sec.com Date: 2008-12-24 From: http://www.80sec.com/release/session-hijacking.txt Directory 0×0 0 application certification design background 0×0 1 a conventional attack ideas and defects 0×0 2 The use of application programming...

DSA-1802-2 squirrelmail - incomplete fix

Bulletin has no description...

Mandrake Security Advisory MDVSA-2009:110 (squirrelmail)

The remote host is missing an update to squirrelmail announced via advisory MDVSA-2009:110. SPDX-FileCopyrightText: 2009 E-Soft Inc. Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only OR...

[SECURITY] [DSA 1802-1] New squirrelmail packages fix several vulnerabilities

------------------------------------------------------------------------ Debian Security Advisory DSA-1802-1 [email protected] http://www.debian.org/security/ Thijs Kinkhorst May 19, 2009 http://www.debian.org/security/faq -...

DSA-1802-1 squirrelmail - several vulnerabilities

Bulletin has no description...

AjaxTerm ajaxterm.js会话劫持漏洞

BUGTRAQ ID: 34903 Ajaxterm是用python编写的基于web的开源终端。 AjaxTerm的ajaxterm.js脚本使用以下方式在客户端上分配会话id： var sid=""+Math.roundMath.random1000000000; 结合round使用的javascript随机函数没有为特定的会话id提供充足的熵，因此攻击者可以暴力猜测可能的id值并附加上已有的连接。此外由于在执行暴力猜测时还可能耗尽所有可用的会话id，利用这个漏洞还可能导致拒绝服务。 Antony Lesuisse AjaxTerm 0.10 Antony Lesuisse...

Code injection

ajaxterm.js in AjaxTerm 0.10 and earlier generates session IDs with predictable random numbers based on certain JavaScript functions, which makes it easier for remote attackers to 1 hijack a session or 2 cause a denial of service session ID exhaustion via a brute-force attack...

CVE-2009-1629

ajaxterm.js in AjaxTerm 0.10 and earlier generates session IDs with predictable random numbers based on certain JavaScript functions, which makes it easier for remote attackers to 1 hijack a session or 2 cause a denial of service session ID exhaustion via a brute-force attack...

CVE-2009-1580

Session fixation vulnerability in SquirrelMail before 1.4.18 allows remote attackers to hijack web sessions via a crafted cookie...

CVE-2009-1629

CVE-2009-1629 affects Ajaxterm up to version 0.10 and earlier, where session IDs are generated with predictable random numbers via certain JavaScript functions. This can enable remote attackers to hijack sessions or trigger a denial of service through session ID exhaustion. Public advisories (Deb...

CVE-2009-1580

CVE-2009-1580 refers to a session fixation vulnerability in SquirrelMail prior to version 1.4.18 . The issue allows remote attackers to hijack web sessions by supplying a crafted cookie, enabling session takeover with the privileges of the affected user. The provided documents explicitly identify...

CVE-2009-1629

Removed by vendor...

openSUSE 10 Security Update : squirrelmail (squirrelmail-6242)

Multiple vulnerabilities have been fixed in SquirrelMail: an XSS and input sanitization bug both CVE-2009-1578, a server-side code execution CVE-2009-1579, a login session hijacking bug CVE-2009-1580 and another bug that allowed phishing and XSS attacks CVE-2009-1581. %NASLMINLEVEL 70300 C Tenabl...