phpbb2023-hijack.txt

+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ phpBB 2.0.23 Session Hijacking Vulnerability + found by NBBN 13 Mar 2008 + +++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ ::Information about this vulnerabilty If a moderator or an admin close a thread in phpBB 2.0.X, th...

Microsoft IE FTP跨站命令注入漏洞

BUGTRAQ ID: 28208 Internet Explorer是微软发布的非常流行的WEB浏览器。 如果用户访问了包含有恶意FTP URL的网页的话，Internet Explorer 5和6解码可能无法正确地过滤URL，强制Internet Explorer通过在HTML元素所提供的URL中每条命令后注入URL编码的CRLF对连接起FTP命令。 iframe src="ftp://user@site:port/%0D%0ADELE%20foo.txt%0D%0A//"/ 此外，如果恶意URL的末尾添加了两个斜线的话，Internet...

WebCT 4.x Javascript Session Stealer

WebCT 4.x Javascript Session Stealer Exploits Software: WebCT Campus Edition 4.x http://secunia.com/product/3280/ Affected Version: 4.1.5.8 Discoverer: Benjamin "balupton" Lupton Date Discovered: November 2005 Date Reported: 25/06/2007 Software Author Contacted again on: 20/07/2007 Date Published...

BEA Weblogic multiple security vulnerabilities

Session hijacking and HTML injection in web administration console...

ProCheckUp Security Advisory 2006.12

PR06-12: XSS on BEA Plumtree Foundation and AquaLogic Interaction portals Description: BEA Plumtree Foundation portal 6.0 and BEA AquaLogic Interaction 6.1 are vulnerable to a XSS vulnerability affecting the 'name' parameter which is submitted to the '/portal/server.pt' server-side script. Date...

PR06-12: XSS on BEA Plumtree Foundation and AquaLogic Interaction portals

PR06-12: XSS on BEA Plumtree Foundation and AquaLogic Interaction portals Description: BEA Plumtree Foundation portal 6.0 and BEA AquaLogic Interaction 6.1 are vulnerable to a XSS vulnerability affecting the 'name' parameter which is submitted to the '/portal/server.pt' server-side script. Date...

Code injection

Apache Tomcat 6.0.0 through 6.0.14, 5.5.0 through 5.5.25, and 4.1.0 through 4.1.36 does not properly handle 1 double quote " characters or 2 %5C encoded backslash sequences in a cookie value, which might cause sensitive information such as session IDs to be leaked to remote attackers and enable...

CVE-2007-5333

Apache Tomcat 6.0.0 through 6.0.14, 5.5.0 through 5.5.25, and 4.1.0 through 4.1.36 does not properly handle 1 double quote " characters or 2 %5C encoded backslash sequences in a cookie value, which might cause sensitive information such as session IDs to be leaked to remote attackers and enable...

CVE-2007-5333

Apache Tomcat 6.0.0 through 6.0.14, 5.5.0 through 5.5.25, and 4.1.0 through 4.1.36 does not properly handle 1 double quote " characters or 2 %5C encoded backslash sequences in a cookie value, which might cause sensitive information such as session IDs to be leaked to remote attackers and enable...

CVE-2007-5333

Affected software: Apache Tomcat 4.1.0–4.1.36, 5.5.0–5.5.25, 6.0.0–6.0.14. The vulnerability (CVE-2007-5333) arises from improper handling of (1) double quote (" ) characters and (2) %5C-encoded backslash sequences in cookie values, which can leak session IDs and enable session hijacking. It exis...

CVE-2007-5333

Apache Tomcat 6.0.0 through 6.0.14, 5.5.0 through 5.5.25, and 4.1.0 through 4.1.36 does not properly handle 1 double quote " characters or 2 %5C encoded backslash sequences in a cookie value, which might cause sensitive information such as session IDs to be leaked to remote attackers and enable...

JVN#09470767 Apache Tomcat fails to properly handle cookie value

Apache Tomcat from the Apache Software Foundation is a web container that implements both Java Servlets and JavaServer Pages. Apache Tomcat from the Apache Software Foundation contains a vulnerability that could allow a remote attacker to coerce a crafted cookie to a user's web browser. The...

CVE-2007-5333: Exposure of Sensitive Information to an Unauthorized Actor

Apache Tomcat 6.0.0 through 6.0.14, 5.5.0 through 5.5.25, and 4.1.0 through 4.1.36 does not properly handle 1 double quote " characters or 2 %5C encoded backslash sequences in a cookie value, which might cause sensitive information such as session IDs to be leaked to remote attackers and enable...

Fixed in Apache Tomcat 6.0.16

Low: Session hi-jacking CVE-2007-5333 The previous fix for CVE-2007-3385 was incomplete. It did not consider the use of quotes or %5C within a cookie value. Affects: 6.0.0-6.0.14 Low: Elevated privileges CVE-2007-5342 The JULI logging component allows web applications to provide their own logging...

Fixed in Apache Tomcat 5.5.26

Low: Session hi-jacking CVE-2007-5333 The previous fix for CVE-2007-3385 was incomplete. It did not consider the use of quotes or %5C within a cookie value. Affects: 5.5.0-5.5.25 Low: Elevated privileges CVE-2007-5342 The JULI logging component allows web applications to provide their own logging...

Fixed in Apache Tomcat 4.1.39

Moderate: Session hi-jacking CVE-2008-0128 When using the SingleSignOn Valve via https the Cookie JSESSIONIDSSO is transmitted without the "secure" attribute, resulting in it being transmitted to any content that is - by purpose or error - requested via http from the same server. This was fixed i...

Fixed in Apache Tomcat 5.5.21

Moderate: Session hi-jacking CVE-2008-0128 When using the SingleSignOn Valve via https the Cookie JSESSIONIDSSO is transmitted without the "secure" attribute, resulting in it being transmitted to any content that is - by purpose or error - requested via http from the same server. Affects:...

Debian Security Advisory DSA 1239-1 (sql-ledger)

The remote host is missing an update to sql-ledger announced via advisory DSA 1239-1. Several remote vulnerabilities have been discovered in SQL Ledger, a web based double-entry accounting program, which may lead to the execution of arbitrary code. The Common Vulnerabilities and Exposures project...

CVE-2007-6546

CVE-2007-6546 affects RunCMS prior to 1.6.1. The issue is a predictable session ID that enables remote attackers to hijack a user session by modifying the session identifier. The available data states the vulnerability could allow such session hijacking, with a base severity of medium (CVSSv2 6.4...

CVE-2007-6546: Undefined Security Weakness

RunCMS before 1.6.1 uses a predictable session id, which makes it easier for remote attackers to hijack sessions via a modified id...