649 matches found
CVE-2009-3584
SQL-Ledger 2.8.24 does not set the secure flag for the session cookie in an https session, which makes it easier for remote attackers to capture this cookie by intercepting its transmission within an http session...
CVE-2008-7086
The CVE-2008-7086 entry affects Maian Greetings 2.1, where an attacker can bypass authentication and escalate to administrative privileges by setting the mecard_admin_cookie cookie to admin. The vulnerability enables remote access with high severity (CVSS v2 base score 7.5) and is exploitable ove...
CVE-2008-7028
RPG.Board 0.8 Beta2 and earlier allows remote attackers to bypass authentication and gain privileges by setting the keep4u cookie to a certain value...
Authentication flaw
Absolute Podcast .NET 1.0 allows remote attackers to bypass authentication and gain administrative access by setting a cookie to a certain value...
Authentication flaw
Xigla Software Absolute Live Support .NET 5.1 allows remote attackers to bypass authentication and gain administrative access by setting a cookie to a certain value...
CVE-2008-6856
Xigla Software Absolute News Manager.NET 5.1 allows remote attackers to bypass authentication and gain administrative access by setting a cookie to a certain value...
CVE-2008-6861
The CVE-2008-6861 issue affects Xigla Software Absolute Newsletter (version 6.0 and 6.1). The vulnerability allows remote attackers to bypass authentication and gain administrative access by setting a specific cookie value, enabling partial confidentiality/integrity/availability impact as per the...
PT-2009-4810 · Phpmyblockchecker · Phpmyblockchecker
Name of the Vulnerable Software and Affected Versions: phpMyBlockchecker version 1.0.0055 Description: The issue allows remote attackers to bypass authentication and gain administrative access. This is achieved by setting the PHPMYBCAdmin cookie to LOGGEDIN. Recommendations: For phpMyBlockchecker...
CVE-2009-1835
CVE-2009-1835 affects Mozilla Firefox (pre-3.0.11) and SeaMonkey (pre-1.1.17). A URL containing file:// at the start can cause the browser to associate local documents with external domain names located after the file:// substring, allowing a user-assisted remote attacker to read arbitrary cookie...
Teraway LinkTracker 1.0 Insecure Cookie
-------------------------------------+ Homepage:http://www.teraway.com Product: Teraway LinkTracker V1.0 home:www.h4ckf0ru.com Note: Hawach x.CJP.x Ballk Ma tedirech Ihdae Note: سال الممكن المستحيل اين تقيم قال في احلام العاجز ------------------------------------- Teraway LinkTracker V1.0 Insecur...
Aqua CMS - 'Username' SQL Injection
================================================================================ Found : halkfild Dork : "Powered By Aqua Cms" Vendor: http://www.aquacms.net/ Advisory URL: http://crackfor.me/bugtraq/aquacms.v1.1.txt Visit : crackfor.me, forum.antichat.ru, raz0r.name Mail : bugtraqd0gcrackfor.me...
Family Connections CMS 1.8.2 - Blind SQL Injection
Salvatore "drosophila" Fresta + Application: Family Connections + Version: = 1.8.2 + Website: http://www.familycms.com + Bugs: A Blind SQL Injection + Exploitation: Remote + Date: 1 Apr 2009 + Discovered by: Salvatore "drosophila" Fresta + Author: Salvatore "drosophila" Fresta + Contact: e-mail:...
Cross site scripting
Multiple cross-site scripting XSS vulnerabilities in the export page displayexport.lib.php in phpMyAdmin 2.11.x before 2.11.9.5 and 3.x before 3.1.3.1 allow remote attackers to inject arbitrary web script or HTML via the pmadbfilenametemplate cookie...
Break IE security restrict access to the iframe sub-frame within the local cookie-vulnerability warning-the black bar safety net
Author: aullik5 Today this article is mainly to say the following so a few things: 1. iframe limitations 2. Break the iframe to get the local cookie ideas 3. Use Cross Iframe Trick breakthrough iframe security restrictions My test environment is: IE 7 7.0.5730.13 All of the following content all...
Grestul 1.x Auth Bypass by Cookie SQL Injection Vulnerability
No description provided by source. Grestul Sql Injection By Cookie bypass Autore: x0r Email: [email protected] Site: http://w00tz0ne.org Let's Go! \admin\login.php : $username = SafeAddSlashes$POST'username'; $passcode = SafeAddSlashesmd5$POST'passcode'; $time = time; $check =...
squirrelmail: session management flaw
A certain Red Hat patch for SquirrelMail 1.4.8 sets the same SQMSESSID cookie value for all sessions, which allows remote authenticated users to access other users' folder lists and configuration data in opportunistic circumstances by using the standard webmail.php interface. NOTE: this...
phpAddEdit 1.3 Login Bypass
------------------------------------- PhpAddEdit 1.3 Login By Pass ------------------------------------- Found By: x0r Evolution Team Email: [email protected] ------------------------------------- Bug In: Addedit-login.php if !$loginerror // --- Set admin cookie so favorite form field will sho...
Absolute News Feed 1.0 - Remote Insecure Cookie Handling
Discovered by : Hakxer Script : Absolute News Feed http://www.xigla.com/absolutenf/demo.htm Greetz : Allah , All My friend ,www.educ-up.com ------------------------------- Poc : javascript:document.cookie="xlaAFSuser=p=admin"; Exploit Go To admin login :...
NetScaler web management cookie information
The remote web server is prone to an information disclosure attack. Description : It is possible to extract information about the remote Citrix NetScaler appliance obtained from the web management interface's session cookie, including the appliance's main IP address and software version. OpenVAS...
