CVE-2009-1629

Removed by vendor...

CVE-2009-1629: Improper Authentication

ajaxterm.js in AjaxTerm 0.10 and earlier generates session IDs with predictable random numbers based on certain JavaScript functions, which makes it easier for remote attackers to 1 hijack a session or 2 cause a denial of service session ID exhaustion via a brute-force attack...

openSUSE 10 Security Update : squirrelmail (squirrelmail-6242)

Multiple vulnerabilities have been fixed in SquirrelMail: an XSS and input sanitization bug both CVE-2009-1578, a server-side code execution CVE-2009-1579, a login session hijacking bug CVE-2009-1580 and another bug that allowed phishing and XSS attacks CVE-2009-1581. %NASLMINLEVEL 70300 C Tenabl...

[oCERT-2009-004] AjaxTerm session id collision

2009-004 AjaxTerm session id collision Description: AjaxTerm, an open source web based terminal, uses a form of random session id generation which can lead to remote session hijacking. The ajaxterm.js script allocates session ids on the client side using the following method: var...

Tiger Dms - Authentication Bypass

============================================================================== DDDDD OOOO SSSS DDDD ZZZZZZ TTTTTTTTT EEEEE A MM MM D D o O S D D Z T E A A M M M M D D o o SSSS D D Z T EEEEE AAAAA M M M D D o o S D D Z T E A A M M DDDD oooO SSSS DDDD ZZZZZZ T EEEEE A A M M...

Design/Logic Flaw

Multiple unspecified vulnerabilities in the Control Center in Symantec Brightmail Gateway Appliance before 8.0.1 allow remote authenticated users to gain privileges, and possibly obtain sensitive information or hijack sessions of arbitrary users, via vectors involving 1 administrative scripts or ...

Mandrake Linux Security Advisory : tomcat5 (MDKSA-2007:241)

A number of vulnerabilities were found in Tomcat : A directory traversal vulnerability, when using certain proxy modules, allows a remote attacker to read arbitrary files via a .. dot dot sequence with various slash, backslash, or url-encoded backslash characters CVE-2007-0450; affects Mandriva...

Banner Student System Cross Site Scripting

| | ||| ||| | | | | | || || By: gamr | | | | | | ||| ||| Header Product - Banner Student System by SunGard Specific Page - http://www.EXAMPLE.com/PATH/twbkwbis.PSecurityQuestion Change Security Question Version - 7.4 / earlier versions could be effected also Product URL -...

IBM WebSphere Application Server < 6.1.0.23 Multiple Vulnerabilities

Binary data 4996.prm...

CVE-2008-6722

CVE-2008-6722 affects Novell Access Manager 3 SP4. The vulnerability arises because SSL/X.509 sessions are not expired, allowing physically proximate attackers to reuse a victim’s valid SSL sessionID via the victim’s browser process. This is linked to Apache Tomcat’s failure to clear entries from...

CVE-2008-6722: Exposure of Sensitive Information to an Unauthorized Actor

Novell Access Manager 3 SP4 does not properly expire X.509 certificate sessions, which allows physically proximate attackers to obtain a logged-in session by using a victim's web-browser process that continues to send the original and valid SSL sessionID, related to inability of Apache Tomcat to...

Mandriva Update for tomcat5 MDKSA-2007:241 (tomcat5)

Check for the Version of tomcat5 OpenVAS Vulnerability Test Mandriva Update for tomcat5 MDKSA-2007:241 tomcat5 Authors: System Generated Check Copyright: Copyright c 2009 Greenbone Networks GmbH, http://www.greenbone.net This program is free software; you can redistribute it and/or modify it unde...

Mandriva Update for tomcat5 MDKSA-2007:241 (tomcat5)

Check for the Version of tomcat5 OpenVAS Vulnerability Test Mandriva Update for tomcat5 MDKSA-2007:241 tomcat5 Authors: System Generated Check Copyright: Copyright c 2009 Greenbone Networks GmbH, http://www.greenbone.net This program is free software; you can redistribute it and/or modify it unde...

CVE-2008-6564

Nortel UNIStim protocol, as used in Communication Server 1000 and other products, uses predictable sequence numbers, which allows remote attackers to hijack sessions via sniffing or brute force attacks...

Design/Logic Flaw

Nortel UNIStim protocol, as used in Communication Server 1000 and other products, uses predictable sequence numbers, which allows remote attackers to hijack sessions via sniffing or brute force attacks...

CVE-2009-0892

The administrative console in IBM WebSphere Application Server WAS 6.1 before 6.1.0.23 and 7.0 before 7.0.0.3 allows attackers to hijack user sessions in "specific scenarios" related to a forced logout...

CVE-2009-0892

The CVE concerns IBM WebSphere Application Server admin console: WAS 6.1 before 6.1.0.23 and WAS 7.0 before 7.0.0.3 allow attackers to hijack user sessions in specific scenarios related to a forced logout. Affected components are the administrative console on those releases; the root cause is des...

CVE-2008-6564: Undefined Security Weakness

Nortel UNIStim protocol, as used in Communication Server 1000 and other products, uses predictable sequence numbers, which allows remote attackers to hijack sessions via sniffing or brute force attacks...

CVE-2008-6569: Improper Authentication

Session fixation vulnerability in Cybozu Garoon 2.0.0 through 2.1.3 allows remote attackers to hijack web sessions via the session ID in the login page...

Java WebStart allows hidden code privilege escalation

Java Web Start JWS and Java Plug-in with Sun JDK and JRE 6 Update 10 and earlier; JDK and JRE 5.0 Update 16 and earlier; and SDK and JRE 1.4.218 and earlier allows remote attackers to make unauthorized network connections and hijack HTTP sessions via a crafted file that validates as both a GIF an...