Drupal cross-site scripting vulnerability

Overview Drupal, an open source content management system, contains a cross-site scripting vulnerability. This vulnerability is different from JVN82240092. Impact An arbitrary script could be executed on the browser of the user who logged into Drupal. In addition, if session information from a...

b2evolution cross-site scripting vulnerability

Overview b2evolution, a blog publishing system, contains a cross-site scripting vulnerability. Impact An arbitrary script may be executed on the user's web browser. If session information from a cookie is leaked, session hijacking could be conducted. Solution None...

MODx cross-site scripting vulnerability

Overview MODxl, an open source content management system, contains a cross-site scripting vulnerability. Impact An arbitrary script may be executed on the user's web browser. If session information from a cookie is leaked, an attacker could possibly conduct session hijacking. Solution None...

Blogn cross-site scripting vulnerability

Overview Blogn, a script for the creation of blogs from R-ONE, contains a cross-site scripting vulnerability. Impact An arbitrary script may be executed on the user's web browser. In addition, if session information from a cookie is leaked, an attacker could possibly conduct session hijacking...

a-blog cross-site scripting vulnerability

Overview a-blog, a server-based blog tool from appleple, Inc. contains a cross-site scripting vulnerability. Impact An arbitrary script may be executed on the user's web browser. If session information from a cookie is leaked, an attacker could possibly conduct session hijacking. Solution None...

SSL-VPN products vulnerable to cookie theft

Overview When using an SSL-VPN product, if a user selects a mode in which the user can log in with the username and password without using the SSL client authentication, a session hijacking could be conducted. Impact An attacker may be able to intercept a session ID stored in a cookie and hijack ...

tomcat handling of cookie values

Apache Tomcat 6.0.0 to 6.0.13, 5.5.0 to 5.5.24, 5.0.0 to 5.0.30, 4.1.0 to 4.1.36, and 3.3 to 3.3.2 does not properly handle the " character sequence in a cookie value, which might cause sensitive information such as session IDs to be leaked to remote attackers and enable session hijacking attacks...

tomcat handling of cookies

Apache Tomcat 6.0.0 to 6.0.13, 5.5.0 to 5.5.24, 5.0.0 to 5.0.30, 4.1.0 to 4.1.36, and 3.3 to 3.3.2 treats single quotes "'" as delimiters in cookies, which might cause sensitive information such as session IDs to be leaked and allow remote attackers to conduct session hijacking attacks...

SSClone non-ARP session hijacking principle of analysis-vulnerability warning-the black bar safety net

Author: robur Source: CSNA network analysis Forum Two days before buy the magazines to see on a piece of software, just started also did not pay attention, later on hate yourself magazine buy late. This year 3 month the hack of Defense of That magic software, just like my title says, calling...

Bugzilla绕过安全限制和跨站脚本漏洞

BUGTRAQ ID: 29038 Bugzilla是很多软件项目都在使用的基于Web的BUG跟踪系统。 Bugzilla在处理用户请求时存在输入验证漏洞，远程攻击者可能利用此漏洞执行跨站脚本攻击或获取非授权访问。 在使用BUG列表的Format for Printing或Long Format时，没有过滤$bugids等参数的输入便返回给了用户，这可能允许攻击者执行跨站脚本攻击，在用户浏览器会话中执行任意HTML和脚本代码。...

tomcat handling of cookies

Apache Tomcat 6.0.0 to 6.0.13, 5.5.0 to 5.5.24, 5.0.0 to 5.0.30, 4.1.0 to 4.1.36, and 3.3 to 3.3.2 treats single quotes "'" as delimiters in cookies, which might cause sensitive information such as session IDs to be leaked and allow remote attackers to conduct session hijacking attacks...

tomcat handling of cookie values

Apache Tomcat 6.0.0 to 6.0.13, 5.5.0 to 5.5.24, 5.0.0 to 5.0.30, 4.1.0 to 4.1.36, and 3.3 to 3.3.2 does not properly handle the " character sequence in a cookie value, which might cause sensitive information such as session IDs to be leaked to remote attackers and enable session hijacking attacks...

GLSA-200804-10 : Tomcat: Multiple vulnerabilities

The remote host is affected by the vulnerability described in GLSA-200804-10 Tomcat: Multiple vulnerabilities The following vulnerabilities were reported: Delian Krustev discovered that the JULI logging component does not properly enforce access restrictions, allowing web application to add or...

GLSA-200804-13 : Asterisk: Multiple vulnerabilities

The remote host is affected by the vulnerability described in GLSA-200804-13 Asterisk: Multiple vulnerabilities Asterisk upstream developers reported multiple vulnerabilities: The Call Detail Record Postgres logging engine cdrpgsql does not correctly escape the ANI and DNIS arguments before using...

Tomcat: Multiple vulnerabilities

Background Tomcat is the Apache Jakarta Project's official implementation of Java Servlets and Java Server Pages. Description The following vulnerabilities were reported: Delian Krustev discovered that the JULI logging component does not properly enforce access restrictions, allowing web...

OpenSSH < 5.0 X11 Forwarding Local Session Hijacking

Binary data 4459.prm...

OpenSSH X11 Forwarding Session Hijacking

According to its banner, the version of SSH installed on the remote host is older than 5.0. Such versions may allow a local user to hijack X11 sessions because it improperly binds TCP ports on the local IPv6 interface if the corresponding ports on the IPv4 interface are in use. C Tenable, Inc...

Session fixation

The AsteriskGUI HTTP server in Asterisk Open Source 1.4.x before 1.4.19-rc3 and 1.6.x before 1.6.0-beta6, Business Edition C.x.x before C.1.6, AsteriskNOW before 1.0.2, Appliance Developer Kit before revision 104704, and s800i 1.0.x before 1.1.0.2 generates insufficiently random manager ID values...

phpbb2023-hijack.txt

+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ phpBB 2.0.23 Session Hijacking Vulnerability + found by NBBN 13 Mar 2008 + +++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ ::Information about this vulnerabilty If a moderator or an admin close a thread in phpBB 2.0.X, th...

phpBB 2.0.23 Session Hijacking Vulnerability

+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ phpBB 2.0.23 Session Hijacking Vulnerability + found by NBBN 13 Mar 2008 + +++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ ::Information about this vulnerabilty If a moderator or an admin close a thread in phpBB 2.0.X, th...