7931 matches found
Basilix Webmail Attachment Crafted POST Arbitrary File Access
The remote host appears to be running a BasiliX version 1.1.0 or lower. Such versions allow retrieval of arbitrary files that are accessible to the web server user when sending a message since they accept a list of attachment names from the client yet do not verify that the attachments were in fa...
[Full-Disclosure] Ph0rum phorum_uriauth replay attack
Arhont Ltd.- Information Security Arhont Advisory by: Konstantin Gavrilenko http://www.arhont.com Advisory: Ph0rum phorumuriauth replay attack Class: design bug ? Version: 4.3.7 Model Specific: Other version might have the same bug Contact Date: 11/05/2004 email sent to [email protected] PD releas...
NetBSD Security Advisory 2004-006: TCP protocol and implementation vulnerability
-----BEGIN PGP SIGNED MESSAGE----- NetBSD Security Advisory 2004-006 ================================= Topic: TCP protocol and implementation vulnerability Version: NetBSD-current: source prior to April 22, 2004 NetBSD 2.0: branch affected, release will include the fix NetBSD 1.6.2: affected NetB...
phpx324.txt
PHPX 3.2.4 http://www.phpx.org Versions Affected: PHPX 2.x - 3.2.4 Type of bug: Session Hi-jacking/Admin Access via Cookies Impact: Ability to steal another users account Found-by: HelloWorld Ryan Wray Vendor: Notified Table Of Contents ===================== 1 The Program 2 The Problem 3 The Proo...
CVE-2004-0192
Cross-site scripting XSS vulnerability in the Management Service for Symantec Gateway Security 2.0 allows remote attackers to steal cookies and hijack a management session via a /sgmi URL that contains malicious script, which is not quoted in the resulting error page...
CVE-2004-0192
Cross-site scripting XSS vulnerability in the Management Service for Symantec Gateway Security 2.0 allows remote attackers to steal cookies and hijack a management session via a /sgmi URL that contains malicious script, which is not quoted in the resulting error page...
CVE-2004-0944
The web management interface for Mitel 3300 Integrated Communications Platform ICP before 4.2.2.11 generates easily predictable web session IDs, which allows remote attackers to hijack other sessions via the parentsessionid cookie...
[Full-Disclosure] Symantec Gateway Security Management Service Cross Site Scripting
Symantec Gateway Security Management Service Cross Site Scripting Product: Symantec Gateway Security 2.0 Date: 02/25/2004 Author: Brian Soby, Raytheon 1. Overview ---------------------------------------- A cross site scripting vulnerability exists in Symantec Gateway Security's management service...
CVE-2003-1249
WebIntelligence 2.7.1 uses guessable user session cookies, which allows remote attackers to hijack sessions...
CVE-2003-1481
CommuniGate Pro 3.1 through 4.0.6 sends the session ID in the referer field for an HTTP request for an image, which allows remote attackers to hijack mail sessions via an e-mail with an IMG tag that references a malicious URL that captures the referer...
Cyclonic Webmail 4 multiple vulnerabilities
Software: Cyclonic Webmail Version : 4 vendor : Stallion Networking 1. Software description ---------------------- Cyclonic is a webbased interface allowing users to handle emails stored on a POP Server. This software is Freeware 2. Vulnerability description ------------------------- - bypassing...
calacode @mail webmail system 3.52 - Multiple Vulnerabilities
calacode @mail webmail system 3.52 - Multiple Vulnerabilities source: https://www.securityfocus.com/bid/9180/info It has been reported that @mail Webmail System may be prone to multiple vulnerabilities that include directory traversal, SQL injection, session hijacking, and cross-site scripting...
[Full-Disclosure] @Mail web interface multiple security vulnerabilities
S-Quadra Advisory 2003-12-09 Topic: @Mail web interface multiple security vulnerabilities Severity: Average Vendor URL: http://www.atmail.com Advisory URL: http://www.s-quadra.com/advisories/Adv-20031209.txt Release date: 09 Dec 2003 1. DESCRIPTION "@Mail is a feature rich Email solution that...
calacode @mail webmail system 3.52 - Multiple Vulnerabilities
source: https://www.securityfocus.com/bid/9180/info It has been reported that @mail Webmail System may be prone to multiple vulnerabilities that include directory traversal, SQL injection, session hijacking, and cross-site scripting. These issues may allow an attacker to gain access to sensitive...
sqwebmail unauthorized access
Session hijacking via Referer is possible...
PCL-0002: Session Hijacking in "Sqwebmail"
--------------------------- PUCCIOLAB.ORG - ADVISORIES http://www.pucciolab.org --------------------------- PCL-0002: Session Hijacking in "Sqwebmail" --------------------------------------------------------------------------- PuCCiOLAB.ORG Security Advisories [email protected]...
CVE-2003-0727
Multiple buffer overflows in the XML Database XDB functionality for Oracle 9i Database Release 2 allow local users to cause a denial of service or hijack user sessions...
Multiple Security Issues in Netup UTM
Name : Multiple Security Issues in Netup UTM Software Package : Netup UserTraffManager Vendor Homepage : http://www.netup.biz, http://www.netup.ru Vulnerable Versions: 3.0, 4.0 Platforms : Linux, FreeBSD Vulnerability Type : SQL injections, remote shell command execution Introduction ------- As i...
CVE-2003-0692: Undefined Security Weakness
KDM in KDE 3.1.3 and earlier uses a weak session cookie generation algorithm that does not provide 128 bits of entropy, which allows attackers to guess session cookies via brute force methods and gain access to the user session...