1695 matches found
CVE-2004-2109
Multiple cross-site scripting XSS vulnerabilities in 1 imagezoom.asp or 2 recommend.asp in Q-Shop allow remote attackers to execute arbitrary script and steal the user session ID via Javascript in a URL...
[SA13437] Sun Java System Web Server / Application Server Session ID Disclosure
TITLE: Sun Java System Web Server / Application Server Session ID Disclosure SECUNIA ADVISORY ID: SA13437 VERIFY ADVISORY: http://secunia.com/advisories/13437/ CRITICAL: Less critical IMPACT: Exposure of sensitive information WHERE: From remote SOFTWARE: Sun Java System Web Server Sun ONE/iPlanet...
Multiple Sun ONE bugs
Session ID disclosure, crossite scripting...
CVE-2004-0305
Cross-site scripting XSS vulnerability in error.asp in WebCortex WebStores 2000 6.0 allows remote attackers to execute arbitrary script as other users and steal session IDs via the Messageid parameter...
ACROS Security: Unsanitized Session ID Cookie Allows Modifying Server Response
=====BEGIN-ACROS-REPORT===== PUBLIC ========================================================================= ACROS Security Problem Report 2004-10-14-3 ------------------------------------------------------------------------- ASPR 2004-10-14-3: Unsanitized Session ID Cookie Allows Modifying Serv...
Debian DSA-319-1 : webmin - session ID spoofing
miniserv.pl in the webmin package does not properly handle metacharacters, such as line feeds and carriage returns, in Base64-encoded strings used in Basic authentication. This vulnerability allows remote attackers to spoof a session ID, and thereby gain root privileges. %NASLMINLEVEL 70300 C...
[SA12616] Emulive Server4 Security Bypass and Denial of Service Vulnerabilities
TITLE: Emulive Server4 Security Bypass and Denial of Service Vulnerabilities SECUNIA ADVISORY ID: SA12616 VERIFY ADVISORY: http://secunia.com/advisories/12616/ CRITICAL: Moderately critical IMPACT: Security Bypass, DoS WHERE: From remote SOFTWARE: Emulive Server4 http://secunia.com/product/3934/...
SquirrelMail < 1.2.11 Multiple Script XSS
The target is running at least one instance of SquirrelMail whose version number is between 1.2.0 and 1.2.10 inclusive. Such versions do not properly sanitize From headers, leaving users vulnerable to XSS attacks. Further, since SquirrelMail displays From headers when listing a folder, attacks do...
Mandrake Linux Security Advisory : php (MDKSA-2003:082-1)
A vulnerability was discovered in the transparent session ID support in PHP4 prior to version 4.3.2. It did not properly escape user- supplied input prior to inserting it in the generated web page. This could be exploited by an attacker to execute embedded scripts within the context of the...
Mandrake Linux Security Advisory : webmin (MDKSA-2003:025)
A vulnerability was discovered in webmin by Cintia M. Imanishi, in the miniserv.pl program, which is the core server of webmin. This vulnerability allows an attacker to spoof a session ID by including special metacharacters in the BASE64 encoding string used during the authentication process. Thi...
Mandrake Linux Security Advisory : openssl (MDKSA-2002:046-1)
An audit of the OpenSSL code by A.L. Digital Ltd and The Bunker, under the DARPA program CHATS, discovered a number of vulnerabilities in the OpenSSL code that are all potentially remotely exploitable. From the OpenSSL advisory : 1. The client master key in SSL2 could be oversized and overrun a...
Cross Site Scripting in Moodle < 1.3
Cross Site Scripting in Moodle 1.3 ==================================== 2004-04-30 01 Author: author: Bartek Nowotarski silence location: Trzebinia, Poland mail: silence10atwpdotpl site: silencedot0dotpl 02 Discussion: "Moodle is a course management system CMS - a software package designed to hel...
CVE-2004-0305
CVE-2004-0305 describes a cross-site scripting (XSS) vulnerability in WebCortex WebStores 2000 version 6.0, specifically in error.asp. The underlying issue is the handling of the Message_id parameter, enabling remote attackers to execute arbitrary scripts in the context of other users’ sessions a...
CVE-2004-0305
Cross-site scripting XSS vulnerability in error.asp in WebCortex WebStores 2000 6.0 allows remote attackers to execute arbitrary script as other users and steal session IDs via the Messageid parameter...
GNU Radius DoS
NULL reference on empty Acct-Session-Id attribute...
CVE-2003-1312
siteminderagent/SmMakeCookie.ccc in Netegrity SiteMinder places a session ID string in the value of the SMSESSION parameter in a URL, which might allow remote attackers to obtain the ID by sniffing, reading Referer logs, or other methods...
CVE-2003-1481
CommuniGate Pro 3.1 through 4.0.6 sends the session ID in the referer field for an HTTP request for an image, which allows remote attackers to hijack mail sessions via an e-mail with an IMG tag that references a malicious URL that captures the referer...
CVE-2003-1245
index2.php in Mambo 4.0.12 allows remote attackers to gain administrator access via a URL request where sessionid is set to the MD5 hash of a session cookie...
osCommerce Malformed Session ID XSS Vuln
Vendor : osCommerce URL : http://www.oscommerce.com Version : All Current Versions Risk : Cross Site Scripting Description: osCommerce is an online shop e-commerce solution under on going development by the open source community. Its feature packed out-of-the-box installation allows store owners ...