CVE-2005-3005

Helpdesk Software Hesk allows remote attackers to bypass authentication for 1 admin.php and 2 adminmain.php by modifying the PHPSESSID session ID parameter or cookie...

CVE-2005-3005

The CVE-2005-3005 issue affects Helpdesk Software Hesk: an authentication bypass via manipulation of the PHPSESSID value (session ID) in admin.php and admin_main.php. Attackers can bypass login remotely by altering the session ID cookie/parameter to gain access without valid credentials; affected...

CVE-2005-3005

Helpdesk Software Hesk allows remote attackers to bypass authentication for 1 admin.php and 2 adminmain.php by modifying the PHPSESSID session ID parameter or cookie...

JVN#38138980 Hiki cross-site scripting vulnerability

Impact A remote attacker could create a content containing attacking code and take over a session by stealing the session ID of the user who logged into the system. If the user logged into the system as the administrator, the remote attacker could manipulate configurations. Solution Products...

CVE-2001-1534

CVE-2001-1534 affects Apache with the mod_usertrack module (versions 1.3.11–1.3.20). The vulnerability arises from generating session IDs with predictable information (host IP, system time, server PID), enabling local users to obtain session IDs and bypass authentication when those IDs are used f...

CVE-2001-1535

Slashcode 2.0 creates new accounts with an 8-character random password, which could allow local users to obtain session ID's from cookies and gain unauthorized access via a brute force attack...

CVE-2001-1534

modusertrack in Apache 1.3.11 through 1.3.20 generates session ID's using predictable information including host IP address, system time and server process ID, which allows local users to obtain session ID's and bypass authentication when these session ID's are used for authentication...

CVE-2001-1534

modusertrack in Apache 1.3.11 through 1.3.20 generates session ID's using predictable information including host IP address, system time and server process ID, which allows local users to obtain session ID's and bypass authentication when these session ID's are used for authentication...

whoiscartInsert.txt

Subject: Saeven.net's WhoisCart all versions released prior to this disclosure is vulnerable in that it allows an attacker to insert Javascript into user viewed pages, and also to view any world readable file on the server hosting the WhoisCart software. Severity: Severe; These vulnerabilities ca...

Mambo Open Source < 4.5.2.3 Multiple Vulnerabilities

The installed version of Mambo Open Source on the remote host suffers from the following flaws : - Session ID Spoofing Vulnerability An unspecified flaw in the script 'administrator/index3.php' can be exploited to spoof session IDs. - Local File Disclosure Vulnerability The...

CVE-2004-2109

CVE-2004-2109 describes multiple cross-site scripting (XSS) vulnerabilities in the Q-Shop application, specifically in the components (1) imagezoom.asp and (2) recommend.asp. The attacker can leverage these flaws to execute arbitrary JavaScript in a victim’s browser and potentially steal the user...

CVE-2004-2109

Multiple cross-site scripting XSS vulnerabilities in 1 imagezoom.asp or 2 recommend.asp in Q-Shop allow remote attackers to execute arbitrary script and steal the user session ID via Javascript in a URL...

CVE-2001-1473

CVE-2001-1473 : The SSH-1 protocol vulnerability allows a remote attacker to perform man-in-the-middle and replay attacks by crafting a Session ID that matches the target’s Session ID but uses a weaker public key, enabling the attacker to compute the corresponding private key and masquerade as th...

AuraCMS.txt

--------------------------------------------------------------------------- Vulnerabilities in Aura CMS --------------------------------------------------------------------------- Author: y3dips Date: Januari, 25th 2005 Location: Indonesia, Jakarta Web: http://echo.or.id/adv/adv011-y3dips-2005.tx...

Vulnerabilities in Aura CMS

--------------------------------------------------------------------------- Vulnerabilities in Aura CMS --------------------------------------------------------------------------- Author: y3dips Date: Januari, 25th 2005 Location: Indonesia, Jakarta Web: http://echo.or.id/adv/adv011-y3dips-2005.tx...

[VulnWatch] Corsaire Security Advisory - Mitel 3300 ICP web interface session hijacking issue

-- Corsaire Security Advisory -- Title: Mitel 3300 ICP web interface session hijacking issue Date: 17.08.04 Application: Mitel Web Management Interface Environment: Mitel 3300 ICP prior to 4.2.2.11 Author: Stephen de Vries [email protected] Audience: General distribution Reference: c040817-002...

Mitel 3300 ICP IP PBX VOIP device Web session hijack

Predictable session id allos to hijack Web administration session...

CVE-2004-1385

CVE-2004-1385 affects phpGroupWare up to version 0.9.16.003. The vulnerability is an information-disclosure issue where an error message reveals the web server path due to (1) unexpected characters in the session ID (shell metacharacters), (2) an invalid appname parameter to preferences.php, or (...

Vulnerabilities in eXponent 0.95

ECHOADV02$2004 --------------------------------------------------------------------------- Vulnerabilities in eXponent --------------------------------------------------------------------------- Author: y3dips Date: Januari, 25th 2005 Location: Indonesia, Jakarta Web:...

CVE-2004-1385

phpGroupWare 0.9.16.003 and earlier allows remote attackers to gain sensitive information via 1 unexpected characters in the session ID such as shell metacharacters, 2 an invalid appname parameter to preferences.php or 3 an invalid menuaction parameter to index.php, which reveals the web server...