Squirrelmail: Session hijacking vulnerability, CVE-2008-3663

Squirrelmail: Session hijacking vulnerability, CVE-2008-3663 References https://vulners.com/cve/CVE-2008-3663 http://int21.de/cve/CVE-2008-3663-squirrelmail.html http://enablesecurity.com/2008/08/11/surf-jack-https-will-not-save-you/ https://www.defcon.org/html/defcon-16/dc-16-speakers.htmlPerry...

menalto gallery: Session hijacking vulnerability, CVE-2008-3102

menalto gallery: Session hijacking vulnerability, CVE-2008-3102 References https://vulners.com/cve/CVE-2008-3102 http://int21.de/cve/CVE-2008-3102-mantis.html http://www.mantisbt.org/bugs/view.php?id=9524 http://www.mantisbt.org/bugs/view.php?id=9533...

FreeBSD : squirrelmail -- Session hijacking vulnerability (a0afb4b9-89a1-11dd-a65b-00163e000016)

Hanno Boeck reports : When configuring a web application to use only ssl e.g. by forwarding all http-requests to https, a user would expect that sniffing and hijacking the session is impossible. Though, for this to be secure, one needs to set the session cookie to have the secure flag. Otherwise...

CVE-2008-3661

The CVE-2008-3661 entry concerns Drupal (likely affected versions 5.10 and 6.4) where the session cookie was not marked Secure in HTTPS, enabling cookie capture by remote attackers via cookie on insecure requests. OpenVAS/Fedora advisories reference updates to Drupal in Fedora 9 (e.g., drupal-6.1...

CVE-2008-3662

Gallery before 1.5.9, and 2.x before 2.2.6, does not set the secure flag for the session cookie in an https session, which can cause the cookie to be sent in http requests and make it easier for remote attackers to capture this cookie...

CVE-2008-3662

CVE-2008-3662 affects Gallery before 1.5.9 and 2.x before 2.2.6. Root cause: session cookies are not marked Secure in HTTPS sessions, allowing cookies to be sent over HTTP and potentially captured by remote attackers. Impact: information disclosure of the session cookie. Remediation: upgrade to G...

tomcat5 SSO cookie login information disclosure

The SingleSignOn Valve org.apache.catalina.authenticator.SingleSignOn in Apache Tomcat before 5.5.21 does not set the secure flag for the JSESSIONIDSSO cookie in an https session, which can cause the cookie to be sent in http requests and make it easier for remote attackers to capture this cookie...

squirrelmail -- Session hijacking vulnerability

Hanno Boeck reports: When configuring a web application to use only ssl e.g. by forwarding all http-requests to https, a user would expect that sniffing and hijacking the session is impossible. Though, for this to be secure, one needs to set the session cookie to have the secure flag. Otherwise t...

tomcat5 SSO cookie login information disclosure

The SingleSignOn Valve org.apache.catalina.authenticator.SingleSignOn in Apache Tomcat before 5.5.21 does not set the secure flag for the JSESSIONIDSSO cookie in an https session, which can cause the cookie to be sent in http requests and make it easier for remote attackers to capture this cookie...

tomcat5 SSO cookie login information disclosure

The SingleSignOn Valve org.apache.catalina.authenticator.SingleSignOn in Apache Tomcat before 5.5.21 does not set the secure flag for the JSESSIONIDSSO cookie in an https session, which can cause the cookie to be sent in http requests and make it easier for remote attackers to capture this cookie...

CVE-2002-1152

CVE-2002-1152 concerns Konqueror (KDE) versions 3.0 through 3.0.2. The issue is that Konqueror does not reliably detect the secure flag on HTTP cookies, allowing cookies to be sent over unencrypted channels. This could enable remote attackers to capture cookies via sniffing, potentially compromis...