Session fixation

Adobe Document Server for Reader Extensions 6.0 includes a user's session jsession ID in the HTTP Referer header, which allows remote attackers to gain access to PDF files that are being processed within that session...

Session fixation

gnome screensaver before 2.14, when running on an X server with AllowDeactivateGrabs and AllowClosedownGrabs enabled, allows attackers with physical access to cause the screensaver to crash and access the session via the Ctl+Alt+Keypad-Multiply keyboard sequence, which removes the grab from gnome...

Session fixation

Session fixation vulnerability in Drupal 4.5.x before 4.5.8 and 4.6.x before 4.5.8 allows remote attackers to gain privileges by tricking a user to click on a URL that fixes the session identifier...

CVE-2006-1228

Session fixation vulnerability in Drupal 4.5.x before 4.5.8 and 4.6.x before 4.5.8 allows remote attackers to gain privileges by tricking a user to click on a URL that fixes the session identifier...

CVE-2006-1228

Session fixation vulnerability in Drupal 4.5.x before 4.5.8 and 4.6.x before 4.5.8 allows remote attackers to gain privileges by tricking a user to click on a URL that fixes the session identifier...

CVE-2006-1228

Session fixation vulnerability in Drupal 4.5.x before 4.5.8 and 4.6.x before 4.5.8 allows remote attackers to gain privileges by tricking a user to click on a URL that fixes the session identifier...

CVE-2006-1228

Drupal is affected by CVE-2006-1228 (session fixation) in 4.5.x before 4.5.8 and 4.6.x before 4.5.8. The issue allows a remote attacker to gain Drupal user privileges by enticing a user to click a URL that fixes the session identifier. Publicly documented impact is user privilege elevation via cr...

[DRUPAL-SA-2006-003] Drupal 4.6.6 / 4.5.8 fixes session fixation issue

---------------------------------------------------------------------------- Drupal security advisory DRUPAL-SA-2006-003 ---------------------------------------------------------------------------- Advisory ID: DRUPAL-SA-2006-003 Project: Drupal core Date: 2006-03-13 Security risk: less critical...

drupal -- multiple vulnerabilities

Drupal reports: Mail header injection vulnerability. Linefeeds and carriage returns were not being stripped from email headers, raising the possibility of bogus headers being inserted into outgoing email. This could lead to Drupal sites being used to send unwanted email. Session fixation...

DRUPAL-SA-2006-003 Session fixation vulnerability

If someone creates a clever enough URL and convinces you to click on it, and you later log in but you do not log off then the attacker may be able to impersonate you. Versions affected All Drupal versions before 4.6.6. Solution The fix to this issue requires PHP 4.3.2 or higher, which is higher...

Session fixation

claroinitlocal.inc.php in Claroline 1.7.2 uses guessable session cookies MD5 hash of connection time, which allows remote attackers to hijack sessions and possibly gain administrative privileges...

CVE-2005-4731

The Next action in PEAR HTMLQuickFormController 1.0.4 includes the SID in the URL even when session.useonlycookies is configured, which allows remote attackers to obtain the SID via an HTTP Referer field and possibly other vectors...

FreeBSD : kdelibs -- konqueror cross-domain cookie injection (2797b27a-f55b-11d8-81b0-000347a4fa7d)

According to a KDE Security Advisory : WESTPOINT internet reconnaissance services alerted the KDE security team that the KDE web browser Konqueror allows websites to set cookies for certain country specific secondary top level domains. Websites operating under the affected domains can set HTTP...

CVE-2004-2182

Session fixation vulnerability in Macromedia JRun 4.0 allows remote attackers to hijack user sessions by pre-setting the user session ID information used by the session server...

CVE-2004-2182

CVE-2004-2182 (Macromedia JRun 4.0) describes a session fixation vulnerability where remote attackers can hijack user sessions by pre-setting the session ID information used by the session server. Public sources in the provided documents consistently identify JRun 4.0 as affected and cite the vul...

CVE-2004-1478

JRun 4.0 does not properly generate and handle the JSESSIONID, which allows remote attackers to perform a session fixation attack and hijack a user's HTTP session...

CVE-2004-1478

CVE-2004-1478 concerns JRun 4.0 where improper generation/handling of JSESSIONID enables remote attackers to perform session fixation and hijack HTTP sessions. Root cause: insecure/JSESSIONID management. Impact: remote session hijacking via fixation. Exploitation details are not provided beyond t...

CVE-2004-0866

Internet Explorer 6.0 allows web sites to set cookies for country-specific top-level domains, such as .ltd.uk, .plc.uk, and .sch.uk, which could allow remote attackers to perform a session fixation attack and hijack a user's HTTP session...

CVE-2004-2182

Session fixation vulnerability in Macromedia JRun 4.0 allows remote attackers to hijack user sessions by pre-setting the user session ID information used by the session server...

CVE-2004-1478

JRun 4.0 does not properly generate and handle the JSESSIONID, which allows remote attackers to perform a session fixation attack and hijack a user's HTTP session...