WS_FTP Server Multiple Vulnerabilities (Bounce, PASV Hijacking)

According to its version number, the remote WSFTP server is vulnerable to session hijacking during passive connections and to an FTP bounce attack when a user submits a specially crafted FTP command. C Tenable Network Security, Inc. include"compat.inc"; if description scriptid14599;...

GLSA-200408-23 : kdelibs: Cross-domain cookie injection vulnerability

The remote host is affected by the vulnerability described in GLSA-200408-23 kdelibs: Cross-domain cookie injection vulnerability kcookiejar contains a vulnerability which may allow a malicious website to set cookies for other websites under the same second-level domain. This vulnerability applie...

CVE-2004-0755

The CVE concerns Ruby CGI::Session FileStore creating session files with insecure permissions, enabling local users to read session data and hijack sessions. Technical details across connected docs confirm: FileStore writes session files with improper permissions, enabling a local information lea...

CVE-2004-0755

The FileStore capability in CGI::Session for Ruby before 1.8.1, and possibly PStore, creates files with insecure permissions, which can allow local users to steal session information and hijack sessions...

CVE-2004-0755: Undefined Security Weakness

The FileStore capability in CGI::Session for Ruby before 1.8.1, and possibly PStore, creates files with insecure permissions, which can allow local users to steal session information and hijack sessions...

Microsoft Exchange Outlook Web Access HTTP Response Splitting Vulnerability

Description Microsoft Exchange Outlook Web Access OWA is prone to HTTP response splitting attacks. This issue could permit hostile script to be injected into client sessions, which could gain access to properties of the OWA server and Web pages hosted on the site. It is noted that the attacker mu...

Basilix Webmail Attachment Crafted POST Arbitrary File Access

The remote host appears to be running a BasiliX version 1.1.0 or lower. Such versions allow retrieval of arbitrary files that are accessible to the web server user when sending a message since they accept a list of attachment names from the client yet do not verify that the attachments were in fa...

[Full-Disclosure] Ph0rum phorum_uriauth replay attack

Arhont Ltd.- Information Security Arhont Advisory by: Konstantin Gavrilenko http://www.arhont.com Advisory: Ph0rum phorumuriauth replay attack Class: design bug ? Version: 4.3.7 Model Specific: Other version might have the same bug Contact Date: 11/05/2004 email sent to [email protected] PD releas...

NetBSD Security Advisory 2004-006: TCP protocol and implementation vulnerability

-----BEGIN PGP SIGNED MESSAGE----- NetBSD Security Advisory 2004-006 ================================= Topic: TCP protocol and implementation vulnerability Version: NetBSD-current: source prior to April 22, 2004 NetBSD 2.0: branch affected, release will include the fix NetBSD 1.6.2: affected NetB...

phpx324.txt

PHPX 3.2.4 http://www.phpx.org Versions Affected: PHPX 2.x - 3.2.4 Type of bug: Session Hi-jacking/Admin Access via Cookies Impact: Ability to steal another users account Found-by: HelloWorld Ryan Wray Vendor: Notified Table Of Contents ===================== 1 The Program 2 The Problem 3 The Proo...

CVE-2004-0192

Cross-site scripting XSS vulnerability in the Management Service for Symantec Gateway Security 2.0 allows remote attackers to steal cookies and hijack a management session via a /sgmi URL that contains malicious script, which is not quoted in the resulting error page...

CVE-2004-0192

Cross-site scripting XSS vulnerability in the Management Service for Symantec Gateway Security 2.0 allows remote attackers to steal cookies and hijack a management session via a /sgmi URL that contains malicious script, which is not quoted in the resulting error page...

CVE-2004-0944

The web management interface for Mitel 3300 Integrated Communications Platform ICP before 4.2.2.11 generates easily predictable web session IDs, which allows remote attackers to hijack other sessions via the parentsessionid cookie...

[Full-Disclosure] Symantec Gateway Security Management Service Cross Site Scripting

Symantec Gateway Security Management Service Cross Site Scripting Product: Symantec Gateway Security 2.0 Date: 02/25/2004 Author: Brian Soby, Raytheon 1. Overview ---------------------------------------- A cross site scripting vulnerability exists in Symantec Gateway Security's management service...

CVE-2003-1481

CommuniGate Pro 3.1 through 4.0.6 sends the session ID in the referer field for an HTTP request for an image, which allows remote attackers to hijack mail sessions via an e-mail with an IMG tag that references a malicious URL that captures the referer...

CVE-2003-1249

WebIntelligence 2.7.1 uses guessable user session cookies, which allows remote attackers to hijack sessions...

Cyclonic Webmail 4 multiple vulnerabilities

Software: Cyclonic Webmail Version : 4 vendor : Stallion Networking 1. Software description ---------------------- Cyclonic is a webbased interface allowing users to handle emails stored on a POP Server. This software is Freeware 2. Vulnerability description ------------------------- - bypassing...

calacode @mail webmail system 3.52 - Multiple Vulnerabilities

calacode @mail webmail system 3.52 - Multiple Vulnerabilities source: https://www.securityfocus.com/bid/9180/info It has been reported that @mail Webmail System may be prone to multiple vulnerabilities that include directory traversal, SQL injection, session hijacking, and cross-site scripting...

[Full-Disclosure] @Mail web interface multiple security vulnerabilities

S-Quadra Advisory 2003-12-09 Topic: @Mail web interface multiple security vulnerabilities Severity: Average Vendor URL: http://www.atmail.com Advisory URL: http://www.s-quadra.com/advisories/Adv-20031209.txt Release date: 09 Dec 2003 1. DESCRIPTION "@Mail is a feature rich Email solution that...

calacode @mail webmail system 3.52 - Multiple Vulnerabilities

source: https://www.securityfocus.com/bid/9180/info It has been reported that @mail Webmail System may be prone to multiple vulnerabilities that include directory traversal, SQL injection, session hijacking, and cross-site scripting. These issues may allow an attacker to gain access to sensitive...