CVE-2006-6276

HTTP request smuggling vulnerability in Sun Java System Proxy Server before 20061130, when used with Sun Java System Application Server or Sun Java System Web Server, allows remote attackers to bypass HTTP request filtering, hijack web sessions, perform cross-site scripting XSS, and poison web...

CVE-2006-4099

CVE-2006-4099 concerns Business Objects Crystal Enterprise 9 and 10, where the system generates predictable session identifiers, allowing remote attackers to hijack other users’ sessions through the WCSID cookie. The connected documents confirm the vulnerable component and the impact (session hij...

JVN#21125043 Blogn cross-site scripting vulnerability

Impact An arbitrary script may be executed on the user's web browser. In addition, if session information from a cookie is leaked, an attacker could possibly conduct session hijacking. Solution Products Affected Blogn v1.9.3 and earlier...

JVN#57280612 phpComasy cross-site scripting vulnerability

Impact An arbitrary script may be executed on the user's web browser. If session information from a cookie is leaked, session hijacking could be conducted. Solution Products Affected phpComasy 0.7.9-pre and earlier...

JVN#61543834 EC-CUBE cross-site scripting vulnerability

Impact An arbitrary script may be executed on the user's web browser. If session information from a cookie is leaked, session hijacking could be conducted. Solution Products Affected EC-CUBE v1.0.0 and earlier For more information, refer to the vendor's website...

Armorize-ADV-2006-0009.txt

Armorize Technologies Security Advisory Advisory No: Armorize-ADV-2006-0009 Status: Partial Date: 2006/11/03 Summary: Armorize-ADV-2006-0009 discloses cross-site scripting vulnerability that is found in the sample codes of Zend Framework http://framework.zend.com/, which aims to provide a complet...

XSS Vulnerability in Zend Framework Preview 0.2.0

Armorize Technologies Security Advisory Advisory No: Armorize-ADV-2006-0009 Status: Partial Date: 2006/11/03 Summary: Armorize-ADV-2006-0009 discloses cross-site scripting vulnerability that is found in the sample codes of Zend Framework http://framework.zend.com/, which aims to provide a complet...

JVN#88325166 Hyper NIKKI System cross-site scripting vulnerability

Impact An arbitrary script may be executed on the user's web browser. If session information from a cookie is leaked, an attacker could possibly conduct session hijacking. Solution Products Affected hns-2.190.8 hns-lite-2.190.8 and earlier...

Multiple XSS Vulnerabilities in Zend Google Data Client Library Preview 0.2.0

Armorize Technologies Security Advisory Advisory No: Armorize-ADV-2006-0008 Status: Partial Date: 2006/11/01 Summary: Armorize-ADV-2006-0008 discloses multiple cross-site scripting vulnerabilities that are found in the sample codes of Zend Google Data Client Library...

CommuniGate Pro Webmail 4.0.6 Session Hijacking Exploit

No description provided by source. !/usr/bin/perl Below is exploit code. Place it into cgi-bin, then recommended make symlink from DocumentRoot/AnyImage.gif to shj.pl, configure at least $url variable, and possible other vars and send victim HTML message with img src to your AnyImage.gif. When...

Re: Multiple XSS Vulnerabilities in Zen Cart 1.3.5

Full Disclosure Armorize Technologies Security Advisory Advisory No: Armorize-ADV-2006-0003 Status: Full Date: 2006/9/27 Summary: Armorize-ADV-2006-0003 discloses multiple cross-site scripting vulnerabilities that are found in Zen Cart, which is a PHP e-commerce shopping program and is Built on a...

Multiple XSS Vulnerabilities in Zen Cart 1.3.5

Armorize Technologies Security Advisory Advisory No: Armorize-ADV-2006-0003 Date: 2006/9/27 Summary: Armorize-ADV-2006-0003 discloses multiple cross-site scripting vulnerabilities that are found in Zen Cart, which is a PHP e-commerce shopping program and is Built on a foundation of OScommerce GPL...

JVN#82240092 Drupal cross-site scripting vulnerability

Impact An arbitrary script may be executed on the user's web browser. If session information from a cookie is leaked, an attacker could possible conduct session hijacking. Solution Products Affected Drupal 4.7.2 and earlier Drupal 4.6.8 and earlier...

JVN#79484135 Joomla! cross-site scripting vulnerability

Impact An arbitrary script may be executed on the user's web browser. If session information from a cookie is leaked, an attacker could possibly conduct session hijacking. Solution Products Affected Joomla! 1.0.8 and earlier...

JVN#30144870 SugarCRM cross-site scripting vulnerability

Impact An arbitrary script may be executed on the user's web browser. In addition, if session information from a cookie is leaked, an attacker could possibly conduct session hijacking. Solution Products Affected SugarCRM 4.2.1b and earlier SugarCRM 4.0.1g and earlier SugarCRM 3.5.1h and earlier...

JVN#68295640 Movable Type vulnerabile to cross-site scripting

Impact An arbitrary script may be executed on the user's web browser. In addition, if session information from a cookie is leaked, session hijacking could be conducted. Solution Products Affected Movable Type 3.3, 3.31, 3.32 Movable Type Enterprise 1.01, 1.02 For more information, refer to the...

JVN#46630603 MDPro cross-site scripting vulnerability

Impact An arbitrary script may be executed on the user's web browser. In addition, if session information from a cookie is leaked, an attacker could possibly conduct session hijacking. Solution Products Affected MDPro version 1.0.76 and earlier...

PT News 1.7.8 (Search.php) XSS Vulnerability

PT News 1.7.8 Search.php XSS Vulnerability ----------------------------------------------------------- PT News Version: 1.7.8 Website URL:http://www.openbg.net/ptsite/ ----------------------------------------------------------- Discoved by Snake Unkn0wn Security Researcher The original article ca...

[Full-disclosure] Session Token Remains Valid After Logout in IBM Lotus Domino Web Access

I. SYNOPSIS Title: Session Token Remains Valid After Logout in IBM Lotus Domino Web Access 7.0.1 Release Date: 09/12/2006 Affected Application: IBM Lotus Domino Web Access 7.0.1 versions prior to 7.0.1 were not tested but may still be vulnerable. Nominal Severity: Low Severity If Successfully...

Owl Intranet Engine <= 0.91 Multiple Vulnerabilities

The remote host is running Owl Intranet Engine, a web-based document management system written in PHP. The version of Owl Intranet Engine on the remote host fails to sanitize input to the session id cookie before using it in a database query. Provided PHP's 'magicquotesgpc' setting is disabled, a...