SqWebMail 5.0.4 - HTML Email IMG Tag Script Injection

source: https://www.securityfocus.com/bid/14676/info SqWebMail is affected by a vulnerability that may allow remote attackers to inject and execute arbitrary script code in a user's browser. This may allow for various attacks including session hijacking due to the theft of user credentials...

FreeBSD : apache -- http request smuggling (651996e0-fe07-11d9-8329-000e0c2e438a)

A Watchfire whitepaper reports an vulnerability in the Apache webserver. The vulnerability can be exploited by malicious people causing cross site scripting, web cache poisoining, session hijacking and most importantly the ability to bypass web application firewall protection. Exploiting this...

apache -- http request smuggling

A Watchfire whitepaper reports an vulnerability in the Apache webserver. The vulnerability can be exploited by malicious people causing cross site scripting, web cache poisoining, session hijacking and most importantly the ability to bypass web application firewall protection. Exploiting this...

CVE-2004-2243

Phorum allows remote attackers to hijack sessions of other users by stealing and replaying the session hash in the phorumuriauth parameter, as demonstrated using profile.php. NOTE: the affected version was reported to be 4.3.7, but this may be erroneous...

CVE-2004-2243: Undefined Security Weakness

Phorum allows remote attackers to hijack sessions of other users by stealing and replaying the session hash in the phorumuriauth parameter, as demonstrated using profile.php. NOTE: the affected version was reported to be 4.3.7, but this may be erroneous...

CVE-2001-1545

Macromedia JRun 3.0 and 3.1 appends the jsessionid to URL requests a.k.a. rewriting when client browsers have cookies enabled, which allows remote attackers to obtain session IDs and hijack sessions via HTTP referrer fields or sniffing...

CVE-2001-1532

CVE-2001-1532 affects WebX where authentication data is stored in the HTTP_REFERER variable and is then included in URL links in user bulletin board messages. This design allows remote attackers to hijack sessions by luring users to click crafted links containing the referer-stored credentials. R...

CVE-2001-1513

CVE-2001-1513 affects Macromedia JRun 3.0 and 3.1. The issue allows remote attackers to obtain duplicate active user session IDs and perform actions as other users by crafting a URL request for the web application directory without the trailing '/'. This implies potential session impersonation wi...

CVE-2001-1545: Undefined Security Weakness

Macromedia JRun 3.0 and 3.1 appends the jsessionid to URL requests a.k.a. rewriting when client browsers have cookies enabled, which allows remote attackers to obtain session IDs and hijack sessions via HTTP referrer fields or sniffing...

CVE-2001-1532: Undefined Security Weakness

WebX stores authentication information in the HTTPREFERER variable, which is included in URL links within bulletin board messages posted by users, which could allow remote attackers to hijack user sessions...

CVE-2004-2182: Improper Authentication

Session fixation vulnerability in Macromedia JRun 4.0 allows remote attackers to hijack user sessions by pre-setting the user session ID information used by the session server...

CVE-2002-1947: Undefined Security Weakness

Webmin 0.21 through 1.0 uses the same built-in SSL key for all installations, which allows remote attackers to eavesdrop or highjack the SSL session...

CVE-2002-1763

CVE-2002-1763 targets the Sun Solaris 8 CDE screensaver (dtscreen). The vulnerability arises when the Shift and Return keys are pressed repeatedly and quickly, causing a crash that enables local users to access the current session. The description does not specify a patch or workaround within the...

CVE-2002-1672

Webmin 0.92 (RPM install) creates /var/webmin with world-readable permissions, enabling local users to read the root cookie-based authentication credentials and potentially hijack the root session. The issue is documented in CVE-2002-1672 and corroborated by multiple sources (NVD/Nessus). Affecte...

CVE-2002-1747: Undefined Security Weakness

Vtun 2.5b1 does not authenticate forwarded packets, which allows remote attackers to inject data into user sessions without detection, and possibly control the data contents via cut-and-paste attacks on ECB...

SquirrelMail < 1.4.5 Multiple Vulnerabilities

Binary data 3016.prm...

SquirrelMail < 1.45 Multiple Vulnerabilities

According to its banner, the version of SquirrelMail installed on the remote host is prone to multiple flaws : - Post Variable Handling Vulnerabilities Using specially crafted POST requests, an attacker may be able to set random variables in the file 'optionsidentities.php', which could lead to...

PAFileDB 1.1.32.1.13.03.1 - Multiple Input Validation Vulnerabilities

PAFileDB 1.1.32.1.13.03.1 - Multiple Input Validation Vulnerabilities source: https://www.securityfocus.com/bid/13967/info paFileDB is prone to multiple input validation vulnerabilities. The following issues are reported: Multiple SQL injection issues exist in paFileDB. The impact of these issues...

PAFileDB 1.1.3/2.1.1/3.0/3.1 - Multiple Input Validation Vulnerabilities

source: https://www.securityfocus.com/bid/13967/info paFileDB is prone to multiple input validation vulnerabilities. The following issues are reported: Multiple SQL injection issues exist in paFileDB. The impact of these issues will vary depending on features supported by the database...

FishCart 3.1 - 'upstracking.php' Multiple Cross-Site Scripting Vulnerabilities

source: https://www.securityfocus.com/bid/13499/info FishCart is prone to multiple cross-site scripting and SQL-injection vulnerabilities because the application fails to properly sanitize user-supplied input. A successful exploit of the SQL-injection issues could allow an attacker to compromise...