CVE-2003-1249

WebIntelligence 2.7.1 uses guessable user session cookies, which allows remote attackers to hijack sessions...

CVE-2002-2139: Undefined Security Weakness

Cisco PIX Firewall 6.0.3 and earlier, and 6.1.x to 6.1.3, do not delete the duplicate ISAKMP SAs for a user's VPN session, which allows local users to hijack a session via a man-in-the-middle attack...

CVE-2003-1249: Undefined Security Weakness

WebIntelligence 2.7.1 uses guessable user session cookies, which allows remote attackers to hijack sessions...

WS FTP Server Session Hijacking Vulnerability (Nov 2005)

WSFTP server is prone to session hijacking during passive connections and to a FTP bounce attack when a user submits a specially crafted FTP command. SPDX-FileCopyrightText: 2005 David Maciejak Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the...

JVN#77105349 XOOPS cross-site scripting vulnerability

Impact A remote attacker may upload a script to be executed by a user reading a private message or a forum article. This may allow a remote attacker to perform a session-hijacking and manipulate the screens after the user logs in. Solution Products Affected XOOPS 2.0.12 JP and earlier XOOPS...

phorum5x.txt

======================================================================================= XOR Crew :: Security Advisory 9/1/2005 ======================================================================================= Phorum 5.x Multiple XSS and Session Hijacking Vulnerabilities...

SqWebMail 5.0.4 - HTML Email IMG Tag Script Injection

SqWebMail 5.0.4 - HTML Email IMG Tag Script Injection source: https://www.securityfocus.com/bid/14676/info SqWebMail is affected by a vulnerability that may allow remote attackers to inject and execute arbitrary script code in a user's browser. This may allow for various attacks including session...

SqWebMail 5.0.4 - HTML Email IMG Tag Script Injection

source: https://www.securityfocus.com/bid/14676/info SqWebMail is affected by a vulnerability that may allow remote attackers to inject and execute arbitrary script code in a user's browser. This may allow for various attacks including session hijacking due to the theft of user credentials...

FreeBSD : apache -- http request smuggling (651996e0-fe07-11d9-8329-000e0c2e438a)

A Watchfire whitepaper reports an vulnerability in the Apache webserver. The vulnerability can be exploited by malicious people causing cross site scripting, web cache poisoining, session hijacking and most importantly the ability to bypass web application firewall protection. Exploiting this...

apache -- http request smuggling

A Watchfire whitepaper reports an vulnerability in the Apache webserver. The vulnerability can be exploited by malicious people causing cross site scripting, web cache poisoining, session hijacking and most importantly the ability to bypass web application firewall protection. Exploiting this...

CVE-2004-2243

Phorum allows remote attackers to hijack sessions of other users by stealing and replaying the session hash in the phorumuriauth parameter, as demonstrated using profile.php. NOTE: the affected version was reported to be 4.3.7, but this may be erroneous...

CVE-2004-2243: Undefined Security Weakness

Phorum allows remote attackers to hijack sessions of other users by stealing and replaying the session hash in the phorumuriauth parameter, as demonstrated using profile.php. NOTE: the affected version was reported to be 4.3.7, but this may be erroneous...

CVE-2001-1532

CVE-2001-1532 affects WebX where authentication data is stored in the HTTP_REFERER variable and is then included in URL links in user bulletin board messages. This design allows remote attackers to hijack sessions by luring users to click crafted links containing the referer-stored credentials. R...

CVE-2001-1545

Macromedia JRun 3.0 and 3.1 appends the jsessionid to URL requests a.k.a. rewriting when client browsers have cookies enabled, which allows remote attackers to obtain session IDs and hijack sessions via HTTP referrer fields or sniffing...

CVE-2001-1513

CVE-2001-1513 affects Macromedia JRun 3.0 and 3.1. The issue allows remote attackers to obtain duplicate active user session IDs and perform actions as other users by crafting a URL request for the web application directory without the trailing '/'. This implies potential session impersonation wi...

CVE-2001-1545: Undefined Security Weakness

Macromedia JRun 3.0 and 3.1 appends the jsessionid to URL requests a.k.a. rewriting when client browsers have cookies enabled, which allows remote attackers to obtain session IDs and hijack sessions via HTTP referrer fields or sniffing...

CVE-2001-1532: Undefined Security Weakness

WebX stores authentication information in the HTTPREFERER variable, which is included in URL links within bulletin board messages posted by users, which could allow remote attackers to hijack user sessions...

CVE-2004-2182: Improper Authentication

Session fixation vulnerability in Macromedia JRun 4.0 allows remote attackers to hijack user sessions by pre-setting the user session ID information used by the session server...

CVE-2002-1947: Undefined Security Weakness

Webmin 0.21 through 1.0 uses the same built-in SSL key for all installations, which allows remote attackers to eavesdrop or highjack the SSL session...

CVE-2002-1763

CVE-2002-1763 targets the Sun Solaris 8 CDE screensaver (dtscreen). The vulnerability arises when the Shift and Return keys are pressed repeatedly and quickly, causing a crash that enables local users to access the current session. The description does not specify a patch or workaround within the...