Computer Associates多个CleverPath Portal环境会话劫持漏洞

CleverPath Portal环境一般配置在多个Portal服务器共享一个通用数据存储时存在安全问题。这可导致通过其中一个Portal服务器连接的用户可继承Portal会话，关联另一个Portal服务器中的某个用户的安全验证。 当多个Portal服务器共享通用数据存储并两个Portal服务器在同一时间里启动，由于CleverPath Portal环境变量数据存在问题，可导致以其他用户权限访问服务程序。CleverPath Portal环境变量不是默认配置。 Computer Associates Unicenter Workload Control Center 1.0 SP4...

JVN#78520316 a-blog cross-site scripting vulnerability

Impact An arbitrary script may be executed on the user's web browser. If session information from a cookie is leaked, an attacker could possibly conduct session hijacking. Solution Products Affected a-blog 1.51 and earlier...

JVN#74079537 SugarCRM cross-site scripting vulnerability

Impact An arbitrary script could be executed on the user's web browser where the user logged into SugarCRM. If an attacker obtains session information from a cookie, an attacker could possibly conduct session hijacking. Solution Products Affected SugarCRM 4.5.0f and earlier...

CVE-2006-6641

Unspecified vulnerability in CA CleverPath Portal before maintenance version 4.71.001179060830, as used in multiple products including BrightStor Portal r11.1, CleverPath Aion BPM r10 through r10.2, eTrust Security Command Center r1 and r8, and Unicenter, does not properly handle when multiple...

sql-ledger -- multiple vulnerabilities

The Debian security Team reports: Several remote vulnerabilities have been discovered in SQL Ledger, a web based double-entry accounting program, which may lead to the execution of arbitrary code. The Common Vulnerabilities and Exposures project identifies the following problems: Chris Travers...

arpspoof 3.1 b officially released-vulnerability warning-the black bar safety net

Main features: ARP spoofing is carried out during data modification, and session hijacking attacks Description: This program is open source code, in order to exchange for more friends. Examples: cheating 1 9 2. 1 6 8. 0. 1 0 8 to access the Baidu website, the whole process note:after I added the...

CVE-2006-6528

The Chatroom Module before 4.7.x.-1.0 for Drupal broadcasts Chatroom visitors' session IDs to all participants, which allows remote attackers to hijack sessions and gain privileges...

CVE-2006-6528

The Chatroom Module before 4.7.x.-1.0 for Drupal broadcasts Chatroom visitors' session IDs to all participants, which allows remote attackers to hijack sessions and gain privileges...

CVE-2006-6528

CVE-2006-6528 affects the Drupal Chatroom Module (versions before 4.7.x.-1.0). The vulnerability arises because the module broadcasts visitors’ session IDs to all participants, enabling remote attackers to hijack sessions and gain privileges. The published description explicitly states the impact...

CVE-2006-6528: Undefined Security Weakness

The Chatroom Module before 4.7.x.-1.0 for Drupal broadcasts Chatroom visitors' session IDs to all participants, which allows remote attackers to hijack sessions and gain privileges...

Sun Java系统服务器嵌入式HTTP请求处理漏洞

Sun Java系统应用和WEB服务器都是与J2EE平台兼容的应用服务器。 Sun Java System Application Server在处理HTTP请求时存在漏洞，远程攻击者可能利用此漏洞执行各种攻击。 如果Sun Java System Application Server或Sun Java System Web Server使用Sun Java System Proxy Server的话，由于未能正确地实现HTTP/1.1...

CVE-2006-6276

HTTP request smuggling vulnerability in Sun Java System Proxy Server before 20061130, when used with Sun Java System Application Server or Sun Java System Web Server, allows remote attackers to bypass HTTP request filtering, hijack web sessions, perform cross-site scripting XSS, and poison web...

CVE-2006-4099

CVE-2006-4099 concerns Business Objects Crystal Enterprise 9 and 10, where the system generates predictable session identifiers, allowing remote attackers to hijack other users’ sessions through the WCSID cookie. The connected documents confirm the vulnerable component and the impact (session hij...

CVE-2006-4099: Undefined Security Weakness

Business Objects Crystal Enterprise 9 and 10 generates predictable session identifiers, which allows remote attackers to hijack sessions of other users via WCSID cookie values...

JVN#21125043 Blogn cross-site scripting vulnerability

Impact An arbitrary script may be executed on the user's web browser. In addition, if session information from a cookie is leaked, an attacker could possibly conduct session hijacking. Solution Products Affected Blogn v1.9.3 and earlier...

JVN#57280612 phpComasy cross-site scripting vulnerability

Impact An arbitrary script may be executed on the user's web browser. If session information from a cookie is leaked, session hijacking could be conducted. Solution Products Affected phpComasy 0.7.9-pre and earlier...

JVN#61543834 EC-CUBE cross-site scripting vulnerability

Impact An arbitrary script may be executed on the user's web browser. If session information from a cookie is leaked, session hijacking could be conducted. Solution Products Affected EC-CUBE v1.0.0 and earlier For more information, refer to the vendor's website...

Armorize-ADV-2006-0009.txt

Armorize Technologies Security Advisory Advisory No: Armorize-ADV-2006-0009 Status: Partial Date: 2006/11/03 Summary: Armorize-ADV-2006-0009 discloses cross-site scripting vulnerability that is found in the sample codes of Zend Framework http://framework.zend.com/, which aims to provide a complet...

XSS Vulnerability in Zend Framework Preview 0.2.0

Armorize Technologies Security Advisory Advisory No: Armorize-ADV-2006-0009 Status: Partial Date: 2006/11/03 Summary: Armorize-ADV-2006-0009 discloses cross-site scripting vulnerability that is found in the sample codes of Zend Framework http://framework.zend.com/, which aims to provide a complet...

JVN#88325166 Hyper NIKKI System cross-site scripting vulnerability

Impact An arbitrary script may be executed on the user's web browser. If session information from a cookie is leaked, an attacker could possibly conduct session hijacking. Solution Products Affected hns-2.190.8 hns-lite-2.190.8 and earlier...