CVE-2010-0756

Session fixation vulnerability in WikyBlog 1.7.3 rc2 allows remote attackers to hijack web sessions by setting the jsessionid parameter to 1 index.php/Comment/Main, 2 index.php/Comment/Main/HomeWiky, or 3 index.php/Edit/Main...

WikyBlog 1.7.3rc2 XSS / Shell Upload / RFI

======================================================================================== | Title : WikyBlog-1.7.3rc2 Mullti Vulnerability | Author : indoushka | email : [email protected] | Home : www.iq-ty.com | Web Site : http://www.wikyblog.com/ | Dork : Powered by WikyBlog | Tested on:...

GLSA-201001-08 : SquirrelMail: Multiple vulnerabilities

The remote host is affected by the vulnerability described in GLSA-201001-08 SquirrelMail: Multiple vulnerabilities Multiple vulnerabilities were found in SquirrelMail: Niels Teusink reported multiple input sanitation flaws in certain encrypted strings in e-mail headers, related to...

WikyBlog Multiple Remote Input Validation Vulnerabilities

WikyBlog is prone to multiple vulnerabilities, including an arbitrary-file- upload issue, a cross-site scripting issue, a remote file-include issue and a session-fixation issue. Attackers can exploit these issues to: - execute arbitrary script code in the browser of an unsuspecting user in the...

WikyBlog <= 1.7.3rc2 Multiple Vulnerabilities

WikyBlog is prone to multiple vulnerabilities, including an arbitrary file upload issue, a cross-site scripting XSS issue, a remote file include issue and a session-fixation issue. SPDX-FileCopyrightText: 2010 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and a...

WikyBlog 1.7.3rc2 - Multiple Vulnerabilities

======================================================================================== | Title : WikyBlog-1.7.3rc2 Mullti Vulnerability | Author : indoushka | email : [email protected] | Home : www.iq-ty.com | Web Site : http://www.wikyblog.com/ | Dork : Powered by WikyBlog | Tested on:...

WikyBlog 1.7.3rc2 - Multiple Vulnerabilities

WikyBlog 1.7.3rc2 - Multiple Vulnerabilities ======================================================================================== | Title : WikyBlog-1.7.3rc2 Mullti Vulnerability | Author : indoushka | email : [email protected] | Home : www.iq-ty.com | Web Site : http://www.wikyblog.com/ ...

WikyBlog v1.7.3rc2 Multiple Vulnerabilities

Exploit for unknown platform in category web applications =========================================== WikyBlog v1.7.3rc2 Multiple Vulnerabilities =========================================== ======================================================================================== | Title :...

Web Server Generic Cookie Injection

The remote host is running a web server that fails to adequately sanitize request strings of malicious JavaScript. By leveraging this issue, an attacker may be able to inject arbitrary cookies. Depending on the structure of the web application, it may be possible to launch a 'session fixation'...

CGI Generic Cookie Injection Scripting

The remote web server hosts at least one CGI script that fails to adequately sanitize request strings with malicious JavaScript. By leveraging this issue, an attacker may be able to inject arbitrary cookies. Depending on the structure of the web application, it may be possible to launch a 'sessio...

Session fixation

A certain ActiveX control in msgsc.14.0.8089.726.dll in Microsoft Windows Live Messenger 2009 build 14.0.8089.726 on Windows Vista and Windows 7 allows remote attackers to cause a denial of service msnmsgr.exe crash by calling the ViewProfile method with a crafted argument during an MSN Messenger...

Unable to use HTTPS for login only

If you setup the urlrewrite.xml like so: noformat ^/s/.//download/images/^?. /images/$2 ^/s/.//^?. /$2 ^/login.action https https://localhost:8443/login.action ^/dologin.action https https://localhost:8443/dologin.action ^/. https /login.action. /dologin.action. /s/. http://localhost:8080/$...

Unable to use HTTPS for login only

If you setup the urlrewrite.xml like so: noformat ^/s/.//download/images/^?. /images/$2 ^/s/.//^?. /$2 ^/login.action https https://localhost:8443/login.action ^/dologin.action https https://localhost:8443/dologin.action ^/. https /login.action. /dologin.action. /s/. http://localhost:8080/$...

Unable to use HTTPS for login only

If you setup the urlrewrite.xml like so: noformat ^/s/.//download/images/^?. /images/$2 ^/s/.//^?. /$2 ^/login.action https https://localhost:8443/login.action ^/dologin.action https https://localhost:8443/dologin.action ^/. https /login.action. /dologin.action. /s/. http://localhost:8080/$...

Session fixation

SQL-Ledger 2.8.24 does not set the secure flag for the session cookie in an https session, which makes it easier for remote attackers to capture this cookie by intercepting its transmission within an http session...

GLSA-200912-02 : Ruby on Rails: Multiple vulnerabilities

The remote host is affected by the vulnerability described in GLSA-200912-02 Ruby on Rails: Multiple vulnerabilities The following vulnerabilities were discovered: sameer reported that lib/actioncontroller/cgiprocess.rb removes the :cookieonly attribute from the default session options...

Ruby on Rails: Multiple vulnerabilities

Background Ruby on Rails is a web-application and persistence framework. Description The following vulnerabilities were discovered: sameer reported that lib/actioncontroller/cgiprocess.rb removes the :cookieonly attribute from the default session options CVE-2007-6077, due to an incomplete fix fo...

FreeBSD Ports: rt

The remote host is missing an update to the system as announced in the referenced advisory. SPDX-FileCopyrightText: 2009 E-Soft Inc. Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only...

FreeBSD Ports: rt

The remote host is missing an update to the system as announced in the referenced advisory. VID 714c1406-e4cf-11de-883a-003048590f9e OpenVAS Vulnerability Test $ Description: Auto generated from VID 714c1406-e4cf-11de-883a-003048590f9e Authors: Thomas Reinke Copyright: Copyright c 2009 E-Soft Inc...

FreeBSD : rt -- Session fixation vulnerability (714c1406-e4cf-11de-883a-003048590f9e)

Secunia reports : A vulnerability has been reported in RT, which can be exploited by malicious people to conduct session fixation attacks. The vulnerability is caused due to an error in the handling of sessions and can be exploited to hijack another user's session by tricking the user into loggin...