7350 matches found
WS FTP Server Session Hijacking Vulnerability (Nov 2005)
WSFTP server is prone to session hijacking during passive connections and to a FTP bounce attack when a user submits a specially crafted FTP command. SPDX-FileCopyrightText: 2005 David Maciejak Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the...
JVN#77105349 XOOPS cross-site scripting vulnerability
Impact A remote attacker may upload a script to be executed by a user reading a private message or a forum article. This may allow a remote attacker to perform a session-hijacking and manipulate the screens after the user logs in. Solution Products Affected XOOPS 2.0.12 JP and earlier XOOPS...
phorum5x.txt
======================================================================================= XOR Crew :: Security Advisory 9/1/2005 ======================================================================================= Phorum 5.x Multiple XSS and Session Hijacking Vulnerabilities...
SqWebMail 5.0.4 - HTML Email IMG Tag Script Injection
SqWebMail 5.0.4 - HTML Email IMG Tag Script Injection source: https://www.securityfocus.com/bid/14676/info SqWebMail is affected by a vulnerability that may allow remote attackers to inject and execute arbitrary script code in a user's browser. This may allow for various attacks including session...
SqWebMail 5.0.4 - HTML Email IMG Tag Script Injection
source: https://www.securityfocus.com/bid/14676/info SqWebMail is affected by a vulnerability that may allow remote attackers to inject and execute arbitrary script code in a user's browser. This may allow for various attacks including session hijacking due to the theft of user credentials...
FreeBSD : apache -- http request smuggling (651996e0-fe07-11d9-8329-000e0c2e438a)
A Watchfire whitepaper reports an vulnerability in the Apache webserver. The vulnerability can be exploited by malicious people causing cross site scripting, web cache poisoining, session hijacking and most importantly the ability to bypass web application firewall protection. Exploiting this...
apache -- http request smuggling
A Watchfire whitepaper reports an vulnerability in the Apache webserver. The vulnerability can be exploited by malicious people causing cross site scripting, web cache poisoining, session hijacking and most importantly the ability to bypass web application firewall protection. Exploiting this...
CVE-2004-2243
Phorum allows remote attackers to hijack sessions of other users by stealing and replaying the session hash in the phorumuriauth parameter, as demonstrated using profile.php. NOTE: the affected version was reported to be 4.3.7, but this may be erroneous...
CVE-2001-1545
Macromedia JRun 3.0 and 3.1 appends the jsessionid to URL requests a.k.a. rewriting when client browsers have cookies enabled, which allows remote attackers to obtain session IDs and hijack sessions via HTTP referrer fields or sniffing...
CVE-2001-1532
CVE-2001-1532 affects WebX where authentication data is stored in the HTTP_REFERER variable and is then included in URL links in user bulletin board messages. This design allows remote attackers to hijack sessions by luring users to click crafted links containing the referer-stored credentials. R...
CVE-2001-1513
CVE-2001-1513 affects Macromedia JRun 3.0 and 3.1. The issue allows remote attackers to obtain duplicate active user session IDs and perform actions as other users by crafting a URL request for the web application directory without the trailing '/'. This implies potential session impersonation wi...
CVE-2002-1672
Webmin 0.92 (RPM install) creates /var/webmin with world-readable permissions, enabling local users to read the root cookie-based authentication credentials and potentially hijack the root session. The issue is documented in CVE-2002-1672 and corroborated by multiple sources (NVD/Nessus). Affecte...
CVE-2002-1763
CVE-2002-1763 targets the Sun Solaris 8 CDE screensaver (dtscreen). The vulnerability arises when the Shift and Return keys are pressed repeatedly and quickly, causing a crash that enables local users to access the current session. The description does not specify a patch or workaround within the...
SquirrelMail < 1.4.5 Multiple Vulnerabilities
Binary data 3016.prm...
SquirrelMail < 1.45 Multiple Vulnerabilities
According to its banner, the version of SquirrelMail installed on the remote host is prone to multiple flaws : - Post Variable Handling Vulnerabilities Using specially crafted POST requests, an attacker may be able to set random variables in the file 'optionsidentities.php', which could lead to...
PAFileDB 1.1.32.1.13.03.1 - Multiple Input Validation Vulnerabilities
PAFileDB 1.1.32.1.13.03.1 - Multiple Input Validation Vulnerabilities source: https://www.securityfocus.com/bid/13967/info paFileDB is prone to multiple input validation vulnerabilities. The following issues are reported: Multiple SQL injection issues exist in paFileDB. The impact of these issues...
PAFileDB 1.1.3/2.1.1/3.0/3.1 - Multiple Input Validation Vulnerabilities
source: https://www.securityfocus.com/bid/13967/info paFileDB is prone to multiple input validation vulnerabilities. The following issues are reported: Multiple SQL injection issues exist in paFileDB. The impact of these issues will vary depending on features supported by the database...
FishCart 3.1 - 'upstracking.php' Multiple Cross-Site Scripting Vulnerabilities
source: https://www.securityfocus.com/bid/13499/info FishCart is prone to multiple cross-site scripting and SQL-injection vulnerabilities because the application fails to properly sanitize user-supplied input. A successful exploit of the SQL-injection issues could allow an attacker to compromise...
CVE-2005-0744
The web GUI for Novell iChain 2.2 and 2.3 SP2 and SP3 allows attackers to hijack sessions and gain administrator privileges by 1 sniffing the connection on TCP port 51100 and replaying the authentication information or 2 obtaining and replaying the PCZQX02 authentication cookie from the browser...