6609 matches found
[oCERT-2009-004] AjaxTerm session id collision
2009-004 AjaxTerm session id collision Description: AjaxTerm, an open source web based terminal, uses a form of random session id generation which can lead to remote session hijacking. The ajaxterm.js script allocates session ids on the client side using the following method: var...
Tiger Dms - Authentication Bypass
============================================================================== DDDDD OOOO SSSS DDDD ZZZZZZ TTTTTTTTT EEEEE A MM MM D D o O S D D Z T E A A M M M M D D o o SSSS D D Z T EEEEE AAAAA M M M D D o o S D D Z T E A A M M DDDD oooO SSSS DDDD ZZZZZZ T EEEEE A A M M...
Design/Logic Flaw
Multiple unspecified vulnerabilities in the Control Center in Symantec Brightmail Gateway Appliance before 8.0.1 allow remote authenticated users to gain privileges, and possibly obtain sensitive information or hijack sessions of arbitrary users, via vectors involving 1 administrative scripts or ...
Mandrake Linux Security Advisory : tomcat5 (MDKSA-2007:241)
A number of vulnerabilities were found in Tomcat : A directory traversal vulnerability, when using certain proxy modules, allows a remote attacker to read arbitrary files via a .. dot dot sequence with various slash, backslash, or url-encoded backslash characters CVE-2007-0450; affects Mandriva...
Banner Student System Cross Site Scripting
| | ||| ||| | | | | | || || By: gamr | | | | | | ||| ||| Header Product - Banner Student System by SunGard Specific Page - http://www.EXAMPLE.com/PATH/twbkwbis.PSecurityQuestion Change Security Question Version - 7.4 / earlier versions could be effected also Product URL -...
IBM WebSphere Application Server < 6.1.0.23 Multiple Vulnerabilities
Binary data 4996.prm...
CVE-2008-6722
CVE-2008-6722 affects Novell Access Manager 3 SP4. The vulnerability arises because SSL/X.509 sessions are not expired, allowing physically proximate attackers to reuse a victim’s valid SSL sessionID via the victim’s browser process. This is linked to Apache Tomcat’s failure to clear entries from...
Mandriva Update for tomcat5 MDKSA-2007:241 (tomcat5)
Check for the Version of tomcat5 OpenVAS Vulnerability Test Mandriva Update for tomcat5 MDKSA-2007:241 tomcat5 Authors: System Generated Check Copyright: Copyright c 2009 Greenbone Networks GmbH, http://www.greenbone.net This program is free software; you can redistribute it and/or modify it unde...
Mandriva Update for tomcat5 MDKSA-2007:241 (tomcat5)
Check for the Version of tomcat5 OpenVAS Vulnerability Test Mandriva Update for tomcat5 MDKSA-2007:241 tomcat5 Authors: System Generated Check Copyright: Copyright c 2009 Greenbone Networks GmbH, http://www.greenbone.net This program is free software; you can redistribute it and/or modify it unde...
CVE-2008-6564
Nortel UNIStim protocol, as used in Communication Server 1000 and other products, uses predictable sequence numbers, which allows remote attackers to hijack sessions via sniffing or brute force attacks...
Design/Logic Flaw
Nortel UNIStim protocol, as used in Communication Server 1000 and other products, uses predictable sequence numbers, which allows remote attackers to hijack sessions via sniffing or brute force attacks...
CVE-2009-0892
The administrative console in IBM WebSphere Application Server WAS 6.1 before 6.1.0.23 and 7.0 before 7.0.0.3 allows attackers to hijack user sessions in "specific scenarios" related to a forced logout...
CVE-2009-0892
The CVE concerns IBM WebSphere Application Server admin console: WAS 6.1 before 6.1.0.23 and WAS 7.0 before 7.0.0.3 allow attackers to hijack user sessions in specific scenarios related to a forced logout. Affected components are the administrative console on those releases; the root cause is des...
Java WebStart allows hidden code privilege escalation
Java Web Start JWS and Java Plug-in with Sun JDK and JRE 6 Update 10 and earlier; JDK and JRE 5.0 Update 16 and earlier; and SDK and JRE 1.4.218 and earlier allows remote attackers to make unauthorized network connections and hijack HTTP sessions via a crafted file that validates as both a GIF an...
CVE-2009-0891
The Web Services Security component in IBM WebSphere Application Server 7.0 before Fix Pack 1 7.0.0.1, 6.1 before Fix Pack 23 6.1.0.23,and 6.0.2 before Fix Pack 33 6.0.2.33 does not properly enforce 1 nonce and 2 timestamp expiration values in WS-Security bindings as stored in the...
Design/Logic Flaw
The Web Services Security component in IBM WebSphere Application Server 7.0 before Fix Pack 1 7.0.0.1, 6.1 before Fix Pack 23 6.1.0.23,and 6.0.2 before Fix Pack 33 6.0.2.33 does not properly enforce 1 nonce and 2 timestamp expiration values in WS-Security bindings as stored in the...
CVE-2009-0891
The Web Services Security component in IBM WebSphere Application Server 7.0 before Fix Pack 1 7.0.0.1, 6.1 before Fix Pack 23 6.1.0.23,and 6.0.2 before Fix Pack 33 6.0.2.33 does not properly enforce 1 nonce and 2 timestamp expiration values in WS-Security bindings as stored in the...
CVE-2009-0891
CVE-2009-0891 affects IBM WebSphere Application Server’s Web Services Security (WS-Security) bindings. The vulnerability arises because the WS-Security component in WAS versions 7.0 before Fix Pack 1 (7.0.0.1), 6.1 before Fix Pack 23 (6.1.0.23), and 6.0.2 before Fix Pack 33 (6.0.2.33) does not pr...
Rittal CMC-TC Processing Unit II Multiple Vulnerabilities
No description provided by source. Louhi Networks Oy -= Security Advisory =- Advisory: Rittal CMC-TC Processing Unit II multiple vulnerabilities Release Date: 2009-03-23 Last Modified: 2009-03-22 Authors: Henri Lindberg, CISA henri d0t lindberg at louhi d0t fi Application: Rittal CMC-TC PU II Web...