CVE-2000-0111

The CVE-2000-0111 entry concerns the RightFax web client, where predictable session numbers can enable an attacker to hijack user sessions. Affected product: RightFax web client. Root cause: session identifiers are predictable, allowing session hijacking without additional authentication. Impact:...

CVE-2000-0970

IIS 4.0 and 5.0 .ASP pages send the same Session ID cookie for secure and insecure web sessions, which could allow remote attackers to hijack the secure web session of the user if that user moves to an insecure session, aka the "Session ID Cookie Marking" vulnerability...

Security Bulletin (MS00-080)

Microsoft Security Bulletin MS00-080 - -------------------------------------- Patch Available for "Session ID Cookie Marking" Vulnerability Originally posted: October 23, 2000 Summary ======= Microsoft has released a patch that eliminates a security vulnerability in Microsoftr Internet Informatio...

Microsoft Windows NT 4.0/2000 Predictable LPC Message Identifier - Multiple Vulnerabilities

source: https://www.securityfocus.com/bid/1748/info LPC Local Procedure Call is a message-passing service that allows threads and processes to communicate with each other on a local machine as opposed to RPC Remote Procedure Call that takes place between different hosts. The structure of a messag...

Microsoft Windows NT 4.02000 Predictable LPC Message Identifier - Multiple Vulnerabilities

Microsoft Windows NT 4.02000 Predictable LPC Message Identifier - Multiple Vulnerabilities source: https://www.securityfocus.com/bid/1748/info LPC Local Procedure Call is a message-passing service that allows threads and processes to communicate with each other on a local machine as opposed to RP...

Session hijacking in Alt-N's MDaemon 2.8

Hi, Here's a bugreport and a fix for MDaemon 2.8. Problem: It is possible to hijack an HTTP session from MDaemon / WorldClient Standard version 2.8 Description: MDaemon 2.8 comes with WorldClient Standard which allows you to read your mail using a browser. When you receive an HTML formatted page...

Лазейка в службе Terminal Services, открывающая доступ к ресурсам подключенных к ней клиентов Windows 95/98

Здравствуйте , Лазейка в службе Terminal Services, открывающая доступ к ресурсам подключенных к ней клиентов Windows 95/98 Network World http://www.nwfusion.com Если Вы работаете на сервере Windows 2000 с установленным терминальным сервисом Terminal Services, то должны знать о его потенциальной...

CVE-2000-0328

Windows NT 4.0 generates predictable random TCP initial sequence numbers ISN, which allows remote attackers to perform spoofing and session hijacking...

CVE-2000-0328

CVE-2000-0328 refers to Windows NT 4.0 where TCP initial sequence numbers (ISNs) are generated predictably, enabling spoofing or hijacking of TCP sessions. Connected sources expand the scope to note that several TCP/IP stacks have been observed with weak ISN generation and that attacks can disrup...

CVE-1999-0699

The Bluestone Sapphire web server allows session hijacking via easily guessable session IDs...

CVE-2000-0178

ServerIron switches by Foundry Networks have predictable TCP/IP sequence numbers, which allows remote attackers to spoof or hijack sessions...

CVE-2000-0178

CVE-2000-0178 affects Foundry Networks ServerIron switches, where predictable TCP/IP sequence numbers can enable remote attackers to spoof or hijack sessions. The available documents confirm the vulnerability and resulting impact (session spoofing/hijacking) but do not provide concrete remediatio...

CVE-2000-0178

ServerIron switches by Foundry Networks have predictable TCP/IP sequence numbers, which allows remote attackers to spoof or hijack sessions...

rightfax.txt

LoWNOISE Colombia 2000 +---RightFax Web Client v5.2: Hijack user's sessions +---Description Using your web browser When you click to log on to the rightfax server, it opens a new window. In that window you are asked for a username and password. The Toolbar on the browser is hidden, but if you ope...

CVE-2000-0111

The RightFax web client uses predictable session numbers, which allows remote attackers to hijack user sessions...

CVE-1999-0699

The CVE-1999-0699 instance concerns the Bluestone Sapphire web server, where session hijacking is possible through easily guessable session IDs. The connected Red Hat advisory reiterates the same description without adding new technical specifics (e.g., affected version ranges, exact session-id g...

CVE-1999-0699

The Bluestone Sapphire web server allows session hijacking via easily guessable session IDs...

CVE-2000-0328

Windows NT 4.0 generates predictable random TCP initial sequence numbers ISN, which allows remote attackers to perform spoofing and session hijacking...

CVE-1999-1150

Livingston Portmaster routers running ComOS use the same initial sequence number ISN for TCP connections, which allows remote attackers to conduct spoofing and hijack TCP sessions...

PT-2014-9091

Name of the Vulnerable Software and Affected Versions OpenSSL versions prior to 0.9.8za OpenSSL versions prior to 1.0.0m OpenSSL versions prior to 1.0.1h Description The issue exists due to incorrect restriction of ChangeCipherSpec message processing in OpenSSL, allowing a man-in-the-middle...