CVE-2001-1284

Ipswitch IMail 7.04 and earlier are affected by predictable session IDs used for authentication, enabling remote attackers to hijack other users’ sessions. Root cause: predictable session identifiers in the authentication flow. Impact: remote session hijacking with partial confidentiality/integri...

CVE-2001-1286

Ipswitch IMail 7.04 and earlier stores a user’s session ID in a URL, enabling session hijacking if an attacker can obtain the URL (e.g., via an HTML email that causes the Referrer to reveal the URL under the attacker’s control). Affected product: Ipswitch IMail Web Interface. Root cause: session ...