Session fixation

Session fixation vulnerability in Drupal 5.x before 5.9 and 6.x before 6.3, when contributed modules "terminate the current request during a login event," allows remote attackers to hijack web sessions via unknown vectors...

CVE-2008-3222

Session fixation vulnerability in Drupal 5.x before 5.9 and 6.x before 6.3, when contributed modules "terminate the current request during a login event," allows remote attackers to hijack web sessions via unknown vectors...

CVE-2008-3222

The CVE-2008-3222 entry describes a session fixation vulnerability in Drupal 5.x before 5.9 and 6.x before 6.3. The issue occurs when contributed modules terminate the current request during a login event, allowing remote attackers to hijack user sessions. The description specifies the vectors ar...

FreeBSD : drupal -- multiple vulnerabilities (ecedde1c-5128-11dd-a4e1-0030843d3802)

The Drupal Project reports : Free tagging taxonomy terms can be used to insert arbitrary script and HTML code cross site scripting or XSS on node preview pages. A successful exploit requires that the victim selects a term containing script code and chooses to preview the node. This issue affects...

Cross site scripting

Apple Safari allows web sites to set cookies for country-specific top-level domains, such as co.uk and com.au, which could allow remote attackers to perform a session fixation attack and hijack a user's HTTP session, aka "Cross-Site Cooking," a related issue to CVE-2004-0746, CVE-2004-0866, and...

CVE-2008-3172

Opera allows web sites to set cookies for country-specific top-level domains that have DNS A records, such as co.tv, which could allow remote attackers to perform a session fixation attack and hijack a user's HTTP session, aka "Cross-Site Cooking."...

Cross site scripting

Microsoft Internet Explorer allows web sites to set cookies for domains that have a public suffix with more than one dot character, which could allow remote attackers to perform a session fixation attack and hijack a user's HTTP session, aka "Cross-Site Cooking." NOTE: this issue may exist becaus...

Cross site scripting

Opera allows web sites to set cookies for country-specific top-level domains that have DNS A records, such as co.tv, which could allow remote attackers to perform a session fixation attack and hijack a user's HTTP session, aka "Cross-Site Cooking."...

CVE-2008-3173

Microsoft Internet Explorer allows web sites to set cookies for domains that have a public suffix with more than one dot character, which could allow remote attackers to perform a session fixation attack and hijack a user's HTTP session, aka "Cross-Site Cooking." NOTE: this issue may exist becaus...

CVE-2008-3170

Apple Safari allows web sites to set cookies for country-specific top-level domains, such as co.uk and com.au, which could allow remote attackers to perform a session fixation attack and hijack a user's HTTP session, aka "Cross-Site Cooking," a related issue to CVE-2004-0746, CVE-2004-0866, and...

CVE-2008-3173

Microsoft Internet Explorer is affected by CVE-2008-3173, where web sites can set cookies for domains with a public suffix containing more than one dot, enabling session fixation and potential HTTP session hijacking. The issue is tied to an insufficient fix for CVE-2004-0866, suggesting a remedia...

CVE-2008-3170

Technical details about CVE-2008-3170 are not publicly available in the provided connected documents; monitor for updates.

CVE-2008-3172

CVE-2008-3172 affects the Opera browser. The issue arises because websites could set cookies for country-specific top-level domains that have DNS A records (examples include co.tv). This could enable remote attackers to perform a session fixation attack and hijack a user’s HTTP session. The avail...

CVE-2008-3173

Microsoft Internet Explorer allows web sites to set cookies for domains that have a public suffix with more than one dot character, which could allow remote attackers to perform a session fixation attack and hijack a user's HTTP session, aka "Cross-Site Cooking." NOTE: this issue may exist becaus...

SA-2008-044 - Drupal core - Multiple vulnerabilities

Multiple vulnerabities and weaknesses were discovered in Drupal. Neither of these are readily exploitable. Cross site scripting Free tagging taxonomy terms can be used to insert arbitrary script and HTML code cross site scripting or XSS on node preview pages. A successful exploit requires that th...

Cybozu Garoon session fixation vulnerability

Overview Cybozu Garoon, a groupware from Cybozu, contains a session fixation vulnerability. Cybozu Garoon, a groupware from Cybozu, contains a session fixation vulnerability which may allow an attacker to impersonate a user when the user logs into Cybozu Garoon using a session ID provided by the...

Session fixation

Multiple session fixation vulnerabilities in Academic Web Tools AWT YEKTA 1.4.3.1, and 1.4.2.8 and earlier, allow remote attackers to hijack web sessions by setting the PHPSESSID parameter to 1 index.php and 2 login.php in homepg/...

CVE-2008-2970

Multiple session fixation vulnerabilities in Academic Web Tools AWT YEKTA 1.4.3.1, and 1.4.2.8 and earlier, allow remote attackers to hijack web sessions by setting the PHPSESSID parameter to 1 index.php and 2 login.php in homepg/...

CVE-2008-2970

CVE-2008-2970 describes multiple session fixation vulnerabilities in Academic Web Tools (AWT YEKTA) versions 1.4.3.1 and 1.4.2.8 and earlier. The issue allows remote attackers to hijack user sessions by supplying a crafted PHPSESSID value targeted at index.php and login.php within the homepg/ dir...

CVE-2008-2970

Multiple session fixation vulnerabilities in Academic Web Tools AWT YEKTA 1.4.3.1, and 1.4.2.8 and earlier, allow remote attackers to hijack web sessions by setting the PHPSESSID parameter to 1 index.php and 2 login.php in homepg/...