6719 matches found
CommuniGate Pro Webmail 4.0.6 Session Hijacking Exploit
Exploit for linux platform in category remote exploits ======================================================= CommuniGate Pro Webmail 4.0.6 Session Hijacking Exploit ======================================================= !/usr/bin/perl Below is exploit code. Place it into cgi-bin, then...
CommuniGate Pro Referer Field Session Token Disclosure
The remote install of CommuniGate Pro, according to its version number, is vulnerable to a flaw that could allow a remote attacker to access the mailbox of a targeted user. To exploit such a flaw, an attacker needs to send an email to its victim with a link to an image hosted on a rogue server th...
CommuniGate Pro Webmail 4.0.6 - Session Hijacking
!/usr/bin/perl Below is exploit code. Place it into cgi-bin, then recommended make symlink from DocumentRoot/AnyImage.gif to shj.pl, configure at least $url variable, and possible other vars and send victim HTML message with img src to your AnyImage.gif. When victim will read message, script will...
PHP-Nuke Splatt Forum 4.0 Module - HTML Injection
source: https://www.securityfocus.com/bid/7484/info A problem with Splatt Forum could allow remote users to execute arbitrary code in the context of the web site running the Splatt Forum module. The problem occurs due to the lack of sanitization performed on character representations of HTML tags...
PHP-Nuke Splatt Forum 4.0 Module - HTML Injection
PHP-Nuke Splatt Forum 4.0 Module - HTML Injection source: https://www.securityfocus.com/bid/7484/info A problem with Splatt Forum could allow remote users to execute arbitrary code in the context of the web site running the Splatt Forum module. The problem occurs due to the lack of sanitization...
Onecenter Forum 4.0 - IMG Tag Script Injection
source: https://www.securityfocus.com/bid/7441/info OneCenter ForumOne 4.0 is a full-featured, web-based group discussion forum. A problem with Onecenter ForumOne could allow remote users to execute arbitrary code in the context of the web site hosting ForumOne. The problem occurs due to the lack...
Onecenter Forum 4.0 - IMG Tag Script Injection
Onecenter Forum 4.0 - IMG Tag Script Injection source: https://www.securityfocus.com/bid/7441/info OneCenter ForumOne 4.0 is a full-featured, web-based group discussion forum. A problem with Onecenter ForumOne could allow remote users to execute arbitrary code in the context of the web site hosti...
CVE-2002-0872
l2tpd 0.67 does not initialize the random number generator, which allows remote attackers to hijack sessions...
[SECURITY] [DSA 229-1] New IMP packages fix SQL injection
-------------------------------------------------------------------------- Debian Security Advisory DSA 229-1 [email protected] http://www.debian.org/security/ Martin Schulze January 15th, 2003 http://www.debian.org/security/faq -...
WebIntelligence session hijacking vulnerability
Ubizen Security Intelligence Lab Security Advisory SIL/03/001 ---------------------------------------- Product: WebIntelligencer Tested version: 2.7.1 Advisory date: Jan 09, 2003 Vulnerability type: session hijacking leading to remote unauthorized access Severity: High...
WebIntelligence session hijacking
Weak cookie generation mechanism allows session hijacking...
PHP-Nuke 6.0 - Multiple Cross-Site Scripting Vulnerabilities
PHP-Nuke 6.0 - Multiple Cross-Site Scripting Vulnerabilities source: https://www.securityfocus.com/bid/6409/info It has been discovered that multiple PHP scripts used by PHP-Nuke are vulnerable to cross-sitescripting attacks. Due to insufficient sanitization of web requests it is possible for...
vBulletin 2.0.x/2.2.x - 'members2.php' Cross-Site Scripting
source: https://www.securityfocus.com/bid/6246/info Due to insufficient sanitization of user supplied values, it is possible to exploit a vulnerability in VBulletin. By passing an invalid value to a variable located in 'members2.php', it is possible to generate an error page which will include...
CVE-2002-1150
The Remote Desktop Sharing RDS Screen Saver Protection capability for Microsoft NetMeeting 3.01 through SP2 4.4.3396 allows attackers with physical access to hijack remote sessions by entering certain logoff or shutdown sequences such as CTRL-ALT-DEL and canceling out of the resulting user...
Apache 2 Cross-Site Scripting
This is being submitted without an update to Apache, but I am expecting an Apache Update Announcement shortly. The CVE has already assigned a candidate to this it is currently reserved, and CERT has assigned VU240329, but has not created a write-up yet. The reason for the ugly mail2web .sig is...
CVE-2002-1150
The CVE-2002-1150 entry concerns Microsoft NetMeeting 3.01 through SP2 (4.4.3396). The vulnerability stems from the Remote Desktop Sharing (RDS) Screen Saver Protection feature, which can be abused by an attacker with physical access to hijack a remote session by triggering logoff/shutdown sequen...
CVE-2002-0872
l2tpd 0.67 does not initialize the random number generator, which allows remote attackers to hijack sessions...
CVE-2002-0420
Vulnerability in PureTLS before 0.9b2 related to injection attacks, which could possibly allow remote attackers to corrupt or hijack user sessions...
IMHO Webmail 0.9x - Account Hijacking
IMHO Webmail 0.9x - Account Hijacking source: https://www.securityfocus.com/bid/5238/info A vulnerability has been reported in the IMHO Roxen webmail module which may enable a malicious user of the webmail system to gain access to the account of another user. This issue is due to an error in...