CVE-2007-3382: Handling of cookies containing a ' character

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 CVE-2007-3382: Handling of cookies containing a ' character Severity: Low Session Hi-jacking Vendor: The Apache Software Foundation Versions Affected: 6.0.0 to 6.0.13 5.5.0 to 5.5.24 5.0.0 to 5.0.30 4.1.0 to 4.1.36 3.3 to 3.3.2 Description: Tomcat...

CVE-2007-3382: Exposure of Sensitive Information to an Unauthorized Actor

Apache Tomcat 6.0.0 to 6.0.13, 5.5.0 to 5.5.24, 5.0.0 to 5.0.30, 4.1.0 to 4.1.36, and 3.3 to 3.3.2 treats single quotes "'" as delimiters in cookies, which might cause sensitive information such as session IDs to be leaked and allow remote attackers to conduct session hijacking attacks...

Apache Tomcat fails to properly handle cookies containing single quotes

Overview Apache Tomcat fails to properly handle cookies that contain a single quote, which may allow session hijacking. Description Apache Tomcat is an implementation of the Java Servlet and JavaServer Page JSP technologies. Apache Tomcat incorrectly treats a single quote as a cookie delimiter...

Joomla 1.0.12 CMS - Session fixation Issue in backend Administration interface

==================================================================================== Team Intell Security Advisory TISA2007-03 ------------------------------------------------------------------------------------ Joomla 1.0.12 CMS - Session fixation Issue in backend Administration interface...

Fixed in Apache Tomcat 6.0.14

Low: Cross-site scripting CVE-2007-2449 JSPs within the examples web application did not escape user provided data before including it in the output. This enabled a XSS attack. These JSPs now filter the data before use. This issue may be mitigated by undeploying the examples web application. Note...

Mambo 4.6.2 CMS - Session fixation Issue in backend Administration interface

==================================================================================== Team Intell Security Advisory TISA2007-04 ------------------------------------------------------------------------------------ Mambo 4.6.2 CMS - Session fixation Issue in backend Administration interface...

joomla -- multiple vulnerabilities

A Secunia Advisory reports: joomla can be exploited to conduct session fixation attacks, cross-site scripting attacks or HTTP response splitting attacks. Certain unspecified input passed in comsearch, comcontent and modlogin is not properly sanitised before being returned to a user. This can be...

CVE-2007-3978: Undefined Security Weakness

Session fixation vulnerability in bwired allows remote attackers to hijack web sessions by setting the PHPSESSID parameter...

CVE-2004-2681: Undefined Security Weakness

PeerSec MatrixSSL before 1.1 caches session keys for an indefinitely long time, which might make it easier for remote attackers to hijack a session...

Simple Machines Forum < 1.1.3 PHPSESSIONID Cookie Session Hijacking

Binary data 4101.prm...

JVN#63602912 dotProject cross-site scripting vulnerability

This vulnerability is different from JVN97636431. Impact An arbitrary script may be executed on the user's web browser. In particular, if session information from a cookie is leaked, session hijacking could be conducted. Solution Update the Software The developer has released dotProject version 2...

CVE-2007-3053: Undefined Security Weakness

Session fixation vulnerability in Calimero.CMS 3.3.1232 and earlier allows remote attackers to hijack web sessions by setting the PHPSESSID parameter...

CVE-2007-2978: Improper Link Resolution Before File Access

Session fixation vulnerability in eggblog 3.1.0 and earlier allows remote attackers to hijack web sessions by setting the PHPSESSID parameter...

Design/Logic Flaw

Packeteer PacketShaper uses fixed increments in TCP initial sequence number ISN values, which allows remote attackers to predict the ISN value, and perform session hijacking or disruption...

CVE-2007-2782

CVE-2007-2782 concerns Packeteer PacketShaper where fixed increments in TCP initial sequence number (ISN) values make ISNs predictable, enabling remote attackers to predict the ISN and potentially hijack or disrupt sessions. Root cause: deterministic ISN generation. Exploitation details beyond pr...

CVE-2007-2782

Packeteer PacketShaper uses fixed increments in TCP initial sequence number ISN values, which allows remote attackers to predict the ISN value, and perform session hijacking or disruption...

CVE-2007-2782: Undefined Security Weakness

Packeteer PacketShaper uses fixed increments in TCP initial sequence number ISN values, which allows remote attackers to predict the ISN value, and perform session hijacking or disruption...

HP Systems Insight Manager for Windows unauthorized access

Invalid session cookie processing allows administrative session hijacknig...

CVE-2007-2719: Improper Authentication

Session fixation vulnerability in HP Systems Insight Manager SIM 4.2 and 5.0 SP4 and SP5 allows remote attackers to hijack web sessions by setting the JSESSIONID cookie...

Then talk about the Exchange environment session hijacking(For windows2000)-vulnerability warning-the black bar safety net

The first step is to open the IP Routing function, modify the registry HKEYLOCALMACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\IPEnableRouter to 0x1, and restart the system. The second step is ARP spoofing, the specific principle I will not say. The third step is to start the hijackin...