Apoll 0.7b - Authentication Bypass

Apoll version Remote Auth Bypass Vulnerability version: beta 0.7 script dwonload: http://www.miticdjd.com/download/3/ ---------------------------------------------------------- Discovered By: ZoRLu Date: 03.11.2008 Home: www.z0rlu.blogspot.com contact: [email protected] N0T: YALNIZLIK, YiTiRDi...

CVE-2008-4689: Improper Authentication

Mantis before 1.1.3 does not unset the session cookie during logout, which makes it easier for remote attackers to hijack sessions...

CVE-2008-4649: Improper Authentication

Session fixation vulnerability in Elxis CMS 2008.1 revision 2204 allows remote attackers to hijack web sessions by setting the PHPSESSID parameter...

PhpWebGallery <= 1.7.2 Session Hijacking / Code Execution Exploit

No description provided by source. ?php / ------------------------------------------------------------------------ PhpWebGallery = 1.7.2 Remote Session Hijacking / Code Execution Exploit ------------------------------------------------------------------------ author...: EgiX mail.....:...

phpwebgallery-hijackexec.txt

$b'.$sort.';' 64. ; An attacker could be able to inject and execute PHP code through $GET'sort', that is passed to createfunction at line 63 see http://www.securityfocus.com/bid/31398. Only admin can access to the plugins management interface, but the attacker might be able to retrieve a valid...

PhpWebGallery <= 1.7.2 Session Hijacking / Code Execution Exploit

Exploit for unknown platform in category web applications ================================================================= PhpWebGallery $b'.$sort.';' 64. ; An attacker could be able to inject and execute PHP code through $GET'sort', that is passed to createfunction at line 63 see...

PHPWebGallery 1.7.2 - Session Hijacking Code Execution

PHPWebGallery 1.7.2 - Session Hijacking Code Execution $b'.$sort.';' 64. ; An attacker could be able to inject and execute PHP code through $GET'sort', that is passed to createfunction at line 63 see https://www.securityfocus.com/bid/31398. Only admin can access to the plugins management interfac...

PHPWebGallery 1.7.2 - Session Hijacking / Code Execution

$b'.$sort.';' 64. ; An attacker could be able to inject and execute PHP code through $GET'sort', that is passed to createfunction at line 63 see https://www.securityfocus.com/bid/31398. Only admin can access to the plugins management interface, but the attacker might be able to retrieve a valid...

CVE-2008-4294: Undefined Security Weakness

IBM Tivoli Netcool/Webtop 2.1 before 2.1.0.5 preserves cached user privileges after logout, which allows physically proximate attackers to hijack a session by visiting an unattended workstation, as demonstrated by a root session that is still valid after a subsequent read-only session has begun...

CVE-2008-4294

IBM Tivoli Netcool/Webtop 2.1 before 2.1.0.5 has a local-privilege/session-management flaw: it preserves cached user privileges after logout, enabling a physically proximate attacker to hijack a session by visiting an unattended workstation, with a root session remaining valid after a subsequent ...

Squirrelmail: Session hijacking vulnerability, CVE-2008-3663

Squirrelmail: Session hijacking vulnerability, CVE-2008-3663 References https://vulners.com/cve/CVE-2008-3663 http://int21.de/cve/CVE-2008-3663-squirrelmail.html http://enablesecurity.com/2008/08/11/surf-jack-https-will-not-save-you/ https://www.defcon.org/html/defcon-16/dc-16-speakers.htmlPerry...

Gentoo Security Advisory GLSA 200804-10 (tomcat)

The remote host is missing updates announced in advisory GLSA 200804-10. OpenVAS Vulnerability Test $ Description: Auto generated from Gentoo's XML based advisory Authors: Thomas Reinke Copyright: Copyright c 2008 E-Soft Inc. http://www.securityspace.com Text descriptions are largely excerpted fr...

menalto gallery: Session hijacking vulnerability, CVE-2008-3102

menalto gallery: Session hijacking vulnerability, CVE-2008-3102 References https://vulners.com/cve/CVE-2008-3102 http://int21.de/cve/CVE-2008-3102-mantis.html http://www.mantisbt.org/bugs/view.php?id=9524 http://www.mantisbt.org/bugs/view.php?id=9533...

drupal: Session hijacking vulnerability, CVE-2008-3661

drupal: Session hijacking vulnerability, CVE-2008-3661 References https://vulners.com/cve/CVE-2008-3661 http://int21.de/cve/CVE-2008-3661-drupal.html http://enablesecurity.com/2008/08/11/surf-jack-https-will-not-save-you/ https://www.defcon.org/html/defcon-16/dc-16-speakers.htmlPerry Description...

Gentoo Security Advisory GLSA 200804-13 (asterisk)

The remote host is missing updates announced in advisory GLSA 200804-13. OpenVAS Vulnerability Test $ Description: Auto generated from Gentoo's XML based advisory Authors: Thomas Reinke Copyright: Copyright c 2008 E-Soft Inc. http://www.securityspace.com Text descriptions are largely excerpted fr...

Gentoo Security Advisory GLSA 200804-10 (tomcat)

The remote host is missing updates announced in advisory GLSA 200804-10. SPDX-FileCopyrightText: 2008 E-Soft Inc. Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Gentoo Security Advisory GLSA 200804-13 (asterisk)

The remote host is missing updates announced in advisory GLSA 200804-13. SPDX-FileCopyrightText: 2008 E-Soft Inc. Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

FreeBSD : squirrelmail -- Session hijacking vulnerability (a0afb4b9-89a1-11dd-a65b-00163e000016)

Hanno Boeck reports : When configuring a web application to use only ssl e.g. by forwarding all http-requests to https, a user would expect that sniffing and hijacking the session is impossible. Though, for this to be secure, one needs to set the session cookie to have the secure flag. Otherwise...

menalto gallery: Session hijacking vulnerability, CVE-2008-3662

menalto gallery: Session hijacking vulnerability, CVE-2008-3662 References https://vulners.com/cve/CVE-2008-3662 http://int21.de/cve/CVE-2008-3662-gallery.html http://gallery.menalto.com/gallery2.2.6released http://enablesecurity.com/2008/08/11/surf-jack-https-will-not-save-you/...

FreeBSD Ports: jetty

The remote host is missing an update to the system as announced in the referenced advisory. VID 6ae7cef2-a6ae-11dc-95e6-000c29c5647f OpenVAS Vulnerability Test $ Description: Auto generated from vuxml or freebsd advisories Authors: Thomas Reinke Copyright: Copyright c 2008 E-Soft Inc...