PT-2006-6905 · Sun · Sun Java System Application Server +2

Name of the Vulnerable Software and Affected Versions: Sun Java System Proxy Server versions prior to 20061130 Description: The issue allows remote attackers to bypass HTTP request filtering, hijack web sessions, perform cross-site scripting XSS, and poison web caches. This is achieved via...

CVE-2006-4099

Business Objects Crystal Enterprise 9 and 10 generates predictable session identifiers, which allows remote attackers to hijack sessions of other users via WCSID cookie values...

CVE-2006-4099

Business Objects Crystal Enterprise 9 and 10 generates predictable session identifiers, which allows remote attackers to hijack sessions of other users via WCSID cookie values...

CVE-2006-5901

Hawking Technology wireless router WR254-CA uses a hardcoded IP address among the set of DNS server IP addresses, which could allow remote attackers to cause a denial of service or hijack the router by attacking or spoofing the server at the hardcoded address. NOTE: it could be argued that this...

CVE-2006-5901

Hawking Technology wireless router WR254-CA uses a hardcoded IP address among the set of DNS server IP addresses, which could allow remote attackers to cause a denial of service or hijack the router by attacking or spoofing the server at the hardcoded address. NOTE: it could be argued that this...

CVE-2006-5901

CVE-2006-5901 affects Hawking Technology wireless router WR254-CA. The entry notes the device uses a hardcoded IP address among DNS server addresses, which could allow remote attackers to cause a denial of service or hijack the router by attacking or spoofing the server at that hardcoded address....

Sniffer Sniffer to get back on the machine lost QQ number-vulnerability warning-the black bar safety net

Hot long-awaited QQ communication tool, not only to the crawlers of communication brings convenience, but it also in the surf the Internet, play an integral role, it is a“Gabriel and no harm,”the communication software. That is why, for a hacker to“peg”wantonly on the user's machine, mad Pirates ...

msn-xss-galore.txt

Title: Hotmail/MSN Multiple cross site scripting XSS Author: Securma Massine MorX Security Research Team http://www.morx.org Original Advisory/Xploit : http://www.morx.org/msnxss.txt Vulnerability : Multiple cross site scripting XSS Severity: Medium/High Description : msn.com is suffers from...

JVN#99776858 Multiple vulnerabilities in Webmin and Usermin

Impact A remote attacker could conduct the followings: Steal Webmin and Usermin's configuration information Execute an arbitrary script on the user's web browser Possibly conduct a session hijack attack if session information from a cookie is leaked Solution Products Affected Webmin 1.290 and...

Sun ONE and Sun Java System Applications vulnerable to cross-site scripting via default error page

Overview A cross-site scripting vulnerability in Sun ONE and Sun Java System Applications may allow an attacker to read or modify data in web pages and cookies. Description From Sun Alert Notification 102164: A Cross Site Scripting XSS vulnerability in various releases of the Sun Java System Web...

CVE-2006-3583

Session fixation vulnerability in Jetbox CMS 2.1 SR1 allows remote attackers to hijack web sessions via a crafted link and the administrator section...

CVE-2006-3583

CVE-2006-3583 describes a session- fixation vulnerability in Jetbox CMS 2.1 SR1 . The root cause involves login/session handling flaws and unsanitised input in server-side scripts (notably in index.php and admin/cms/index.php), enabling an attacker to hijack a user’s session via a crafted link an...

security flaw

Mozilla Firefox before 1.5.0.5, Thunderbird before 1.5.0.5, and SeaMonkey before 1.0.3 allows remote attackers to hijack native DOM methods from objects in another domain and conduct cross-site scripting XSS attacks using DOM methods of the top-level object...

CVE-2006-3665

SquirrelMail 1.4.6 and earlier, with registerglobals enabled, allows remote attackers to hijack cookies in src/redirect.php via unknown vectors. NOTE: while "cookie theft" is frequently associated with XSS, the vendor disclosure is too vague to be certain of this...

Hidden in the conspiracy behind the browser hijack attack and Defense-bug warning-the black bar safety net

“Browser hijacking”, the popular point said is deliberately misleading browser the route of a phenomenon, a common browser hijacker phenomenon:to access the normal site is diverted to a malicious Web page, when input the wrong URL was transferred to the hijacking software the specified website,...

Crlf injection

CRLF injection vulnerability in inc/function.php in MyBulletinBoard MyBB 1.04 allows remote attackers to conduct cross-site scripting XSS, poison caches, or hijack pages via CRLF %0A%0D sequences in the Referrer HTTP header field, possibly when redirecting to other web pages...

CVE-2006-1267

Invision Power Board 2.1.4 allows remote attackers to hijack sessions and possibly gain administrative privileges by obtaining the session ID from the s parameter, then replaying it in another request...

UebiMiauXSS.txt

I.Vulnerability UebiMiau Webmail System Cross Site Scripting Vulnerability II.Vendor Aldoir Ventura III.Affected Systems UebiMiau 2.7.9 latest release and probably previous versions. IV.About UebiMiau is a simple, yet efficient mail reader webmail supporting both IMAP and POP3 without dependence ...

CVE-2006-0411

claroinitlocal.inc.php in Claroline 1.7.2 uses guessable session cookies MD5 hash of connection time, which allows remote attackers to hijack sessions and possibly gain administrative privileges...

Session fixation

claroinitlocal.inc.php in Claroline 1.7.2 uses guessable session cookies MD5 hash of connection time, which allows remote attackers to hijack sessions and possibly gain administrative privileges...