CVE-2008-0128

The SingleSignOn Valve org.apache.catalina.authenticator.SingleSignOn in Apache Tomcat before 5.5.21 does not set the secure flag for the JSESSIONIDSSO cookie in an https session, which can cause the cookie to be sent in http requests and make it easier for remote attackers to capture this cookie...

Code injection

The SingleSignOn Valve org.apache.catalina.authenticator.SingleSignOn in Apache Tomcat before 5.5.21 does not set the secure flag for the JSESSIONIDSSO cookie in an https session, which can cause the cookie to be sent in http requests and make it easier for remote attackers to capture this cookie...

CVE-2008-0128

The SingleSignOn Valve org.apache.catalina.authenticator.SingleSignOn in Apache Tomcat before 5.5.21 does not set the secure flag for the JSESSIONIDSSO cookie in an https session, which can cause the cookie to be sent in http requests and make it easier for remote attackers to capture this cookie...

CVE-2008-0128

The SingleSignOn Valve org.apache.catalina.authenticator.SingleSignOn in Apache Tomcat before 5.5.21 does not set the secure flag for the JSESSIONIDSSO cookie in an https session, which can cause the cookie to be sent in http requests and make it easier for remote attackers to capture this cookie...

CVE-2008-0128

Apache Tomcat 5.x before 5.5.21 is affected by CVE-2008-0128: when the SingleSignOn valve is used over HTTPS, the JSESSIONIDSSO cookie is not marked secure, allowing it to be sent over HTTP and potentially captured by an attacker via a crafted HTTP request. This information is supported by multip...

CVE-2003-1381

AMX 0.9.2 and earlier, a plugin for Valve Software’s Half-Life Server, is affected by a format string vulnerability in the amx_say command. This allows remote attackers to execute arbitrary commands. Exploitation details, affected versions beyond those stated, and mitigations are not provided in ...

CVE-2003-1325

The SVCheckForDuplicateNames function in Valve Software Half-Life CSTRIKE Dedicated Server 1.1.1.0 and earlier allows remote authenticated users to cause a denial of service infinite loop and daemon hang via a certain connection string to UDP port 27015 that represents "absence of player...

CVE-2003-1325

The CVE affects Valve Software’s Half-Life CSTRIKE Dedicated Server. The SV_CheckForDuplicateNames function in versions such as 1.6 and earlier is vulnerable when handling a connection string to UDP port 27015, where a backslash character at the end of the string can trigger an infinite loop and ...

Fixed in Apache Tomcat 6.0.9

Moderate: Session hi-jacking CVE-2008-0128 When using the SingleSignOn Valve via https the Cookie JSESSIONIDSSO is transmitted without the "secure" attribute, resulting in it being transmitted to any content that is - by purpose or error - requested via http from the same server. Affects:...

CVE-2006-0734

The SVCheckForDuplicateNames function in Valve Software Half-Life CSTRIKE Dedicated Server 1.6 and earlier allows remote authenticated users to cause a denial of service infinite loop and daemon hang via a backslash character at the end of a connection string to UDP port 27015...

Code injection

The SVCheckForDuplicateNames function in Valve Software Half-Life CSTRIKE Dedicated Server 1.6 and earlier allows remote authenticated users to cause a denial of service infinite loop and daemon hang via a backslash character at the end of a connection string to UDP port 27015...

CVE-2006-0734

CVE-2006-0734 affects Valve Software’s Half-Life CSTRIKE Dedicated Server 1.6 and earlier. The vulnerability is in the SV_CheckForDuplicateNames function, which allows remote authenticated users to cause a denial of service (infinite loop and daemon hang) by sending a backslash character at the e...

Valve CS source format string bug

Format string bug in name command...

CVE-2003-1325

The SVCheckForDuplicateNames function in Valve Software Half-Life CSTRIKE Dedicated Server 1.1.1.0 and earlier allows remote authenticated users to cause a denial of service infinite loop and daemon hang via a certain connection string to UDP port 27015 that represents "absence of player...

Half Life dedicated server information leak

Dear [email protected], Probably is known, but is not documented: Vendor: Valve software Software: hlds, all versions including steam. Problem: Information leak, DoS Author: SYZoSND Problem: in server configuration, if allowdownload = 1, it's possible to download any file from directory o...

Advisory: Half-Life remote buffer overflow vulnerability

Author: Stan Bubrouski [email protected] Date: September 20, 2001 Program: Half-Life Versions Affected: 1.1.0.8 September 19, 2001 and all previous versions Severity: A Half-Life server can exploit buffer overflow in Client to execute arbitrary code on their machines. Vendor: Valve Software...

half-life.txt

-----BEGIN PGP SIGNED MESSAGE----- Vulnerability Report by Mark Cooper Date Published: 16th October 2000 Advisory ID: N/A Bugtraq ID: 1799 http://www.securityfocus.com/bid/1799 CVE CAN: N/A Title: Half-Life Dedicated Server Vulnerability Class: Buffer Overflow Remotely Exploitable: Yes Locally...