ActiveKB <= 1.5 Insecure Cookie Handling/Arbitrary Admin Access

No description provided by source. --==+================================================================================+==-- --==+ ActiveKB = 1.5 Insecure Cookie Handling/Arbitrary Admin Access +==-- --==+================================================================================+==--...

CVE-2008-2134

The Journal module in Tru-Zone Nuke ET 3.x allows remote attackers to obtain access to arbitrary user accounts, and alter or delete data, via a modified username in an unspecified cookie...

PT-2008-1472 · Apache +1 · Apache Tomcat +1

Name of the Vulnerable Software and Affected Versions: Apache Tomcat versions 4.1.0 through 4.1.36 Apache Tomcat versions 5.5.0 through 5.5.25 Apache Tomcat versions 6.0.0 through 6.0.14 Description: The issue arises from improper handling of double quote " characters or %5C encoded backslash...

Authentication flaw

Flat PHP Board 1.2 and earlier allows remote attackers to bypass authentication and obtain limited access to an arbitrary user account via the fpbusername cookie...

CVE-2004-2689

NewsPHP allows remote attackers to gain unauthorized administrative access by setting a cookie to the "autorized=admin; root=admin" value...

SWSoft Plesk 8.2 - login.php3 PLESKSESSID Cookie SQL Injection

SWSoft Plesk 8.2 - login.php3 PLESKSESSID Cookie SQL Injection source: https://www.securityfocus.com/bid/25646/info Plesk is prone to multiple SQL-injection vulnerabilities because it fails to sufficiently sanitize user-supplied data before using it in SQL queries. Exploiting these issues could...

CVE-2007-3382

The CVE-2007-3382 issue affects multiple Apache Tomcat releases (Tomcat 6.0.0–6.0.13, 5.5.0–5.5.24, 5.0.0–5.0.30, 4.1.0–4.1.36, 3.3–3.3.2). The root cause is that Tomcat treats the single quote (') as a delimiter in cookies, which can lead to leakage of sensitive data such as session IDs and enab...

Portcullis Security Advisory - 06-033

Portcullis Security Advisory - 06-033 Vulnerable System: Movable Type Vulnerability Title: The username and password hash for the administration interface is stored within a cookie. Vulnerability Discovery And Development: Portcullis Security Testing Services. Credit For Discovery: Tim Brown -...

CVE-2007-1362

Mozilla Firefox 1.5.x before 1.5.0.12 and 2.x before 2.0.0.4, and SeaMonkey 1.0.9 and 1.1.2, allows remote attackers to cause a denial of service via 1 a large cookie path parameter, which triggers memory consumption, or 2 an internal delimiter within cookie path or name values, which could trigg...

Directory traversal

Directory traversal vulnerability in SQLiteManager 1.2.0 allows remote attackers to read arbitrary files via a .. dot dot in a SQLiteManagercurrentTheme cookie...

Crack the Session cookie method-vulnerability warning-the black bar safety net

This method, I think, already with the 1,2 years, in the hope that there is a need friends useful. The so-called session cookie, is the site in your login is successful, the Send a cookie that indicates you have passed verification, but with the General cookie The difference is, he will not be...

CVE-2006-4352

The ArrowPoint cookie functionality for Cisco 11000 series Content Service Switches specifies an internal IP address if the administrator does not specify a string option, which allows remote attackers to obtain sensitive information...

JVN#65677118 Pixelpost cross-site scripting vulnerability

Impact An arbitrary script may be executed on the user's web browser. In addition, if session information from a cookie is leaked, session hijacking could be conducted. Solution Products Affected Pixelpost 1.5 RC1-2 and earlier...

CVE-2006-2636

newsadmin.asp in Katy Whitton NewsCMSLite allows remote attackers to bypass authentication and gain administrative access by setting the loggedIn cookie to "xY1zZoPQ"...

Chucky A. Ivey N.T. 1.1 - 'index.php' Multiple HTML Injection Vulnerabilities

source: https://www.securityfocus.com/bid/17387/info N.T. is prone to multiple HTML-injection vulnerabilities because the application fails to properly sanitize user-supplied input before using it in dynamically generated content. Attacker-supplied HTML and script code would be executed in the...

WebAlbum 2.02pl - COOKIE[skin2] Remote Code Execution

WebAlbum 2.02pl - COOKIEskin2 Remote Code Execution !/usr/bin/php -q -d shortopentag=on this works with magicquotesgpc=Off\r\n"; echo "dork: WEBalbum 2004-2006 duda\r\n"; if $argc 126 $result.=" ."; else $result.=" ".$string$i; if...

PHP iCalendar 2.21 - cookie Remote Code Execution

PHP iCalendar 2.21 - cookie Remote Code Execution !/usr/bin/php -q -d shortopentag=on arbitrary local inclusion through cookies\r\n"; echo "by rgod rgodautisticiorg\r\n"; echo "site: http://retrogod.altervista.org\r\n\r\n"; short explaination: phpICal stores language & template user preferences...

CVE-2006-0917

Technical details about CVE-2006-0917 are not provided in the connected documents; available sources describe cookies disclosure via a vulnerable link but do not specify affected versions, root cause, or remediation in these inputs.

Directory traversal

Directory traversal vulnerability in the "remember me" feature in liveuser.php in PHP Extension and Application Repository PEAR LiveUser 0.16.8 and earlier allows remote attackers to determine file existence, and possibly delete arbitrary files with short pathnames or possibly read arbitrary file...

Hacking tips-domestic famous website vulnerability-vulnerability warning-the black bar safety net

Recently about system vulnerabilities,has nothing of interest. Because now a patch out very quickly. The large site has been nothing system. Even if you use twwwscan,namp, etc. might very strong scanner also impossible to scan what the hell,there,is also deceptive. But,the so-called hundred Secre...