1296 matches found
Information disclosure
IBM Records Manager RM 4.5.x before 4.5.1.1-IER-FP001 places a session token in the URI, which might allow remote attackers to obtain sensitive information by reading a Referer log file...
CVE-2010-3319
IBM Records Manager (RM) 4.5.x before 4.5.1.1-IER-FP001 places a session token in the URI, potentially allowing remote attackers to read a Referer log file and obtain sensitive information. Remediate by upgrading to 4.5.1.1-IER-FP001.
CVE-2010-3319
IBM Records Manager RM 4.5.x before 4.5.1.1-IER-FP001 places a session token in the URI, which might allow remote attackers to obtain sensitive information by reading a Referer log file...
Simple Machines Forum 2.0 RC3 Cross Site Request Forgery
Exploit Title: Simple Machines Forum = 2.0 RC3 Sesc theft XSRF Date: 09-06-2010 Author: Xianur0 Software Link: http://download.simplemachines.org/ Version: =2.0 RC3 Tested on: 1.1.11 & 2.0 RC3 Vale, este "bug" es simple, y a decir verdad me parese bastante estupido, pero bueno... xD... El SMF en...
40 vulnerabilities in SMF 1.1.10/SMF 2.0RC2 by elhacker.net (Simple Audit)
This is the first batch of vulnerabilities found by the SimpleAudit team from elhacker.net http://labs.elhacker.net/simpleaudit Our goal is to evaluate the security of SMF 2.0 before using it on our own server, and we have found several security vulnerabilities. The vulnerabilities that also appl...
Novell Groupwise 8.0 Webaccess - Multiple Vulnerabilities
Novell Groupwise 8.0 Webaccess - Multiple Vulnerabilities source: https://www.securityfocus.com/bid/35066/info Novell GroupWise WebAccess is prone to multiple security vulnerabilities. An attacker may leverage these issues to bypass certain security restrictions or conduct cross-site scripting...
Novell Groupwise 8.0 Webaccess - Multiple Vulnerabilities
source: https://www.securityfocus.com/bid/35066/info Novell GroupWise WebAccess is prone to multiple security vulnerabilities. An attacker may leverage these issues to bypass certain security restrictions or conduct cross-site scripting attacks. Note that some of the issues may be related to BID...
typo3 -- multiple vulnerabilities
Secunia reports: Some vulnerabilities have been reported in Typo3, which can be exploited by malicious people to bypass certain security restrictions, conduct cross-site scripting and session fixation attacks, and compromise a vulnerable system. The "Install tool" system extension uses...
CVE-2008-2433
The web management console in Trend Micro OfficeScan 7.0 through 8.0, Worry-Free Business Security 5.0, and Client/Server/Messaging Suite 3.5 and 3.6 creates a random session token based only on the login time, which makes it easier for remote attackers to hijack sessions via brute-force attacks...
PT-2008-3901 · Trend Micro · Trend Micro Officescan +3
Name of the Vulnerable Software and Affected Versions: Trend Micro OfficeScan versions 7.0 through 8.0 Worry-Free Business Security version 5.0 Client/Server/Messaging Suite versions 3.5 and 3.6 Description: The web management console creates a random session token based only on the login time,...
CVE-2007-4306
Multiple cross-site scripting XSS vulnerabilities in phpMyAdmin 2.10.3 allow remote attackers to inject arbitrary web script or HTML via the 1 unlimnumrows, 2 sqlquery, or 3 pos parameter to a tblexport.php; the 4 sessionmaxrows or 5 pos parameter to b sql.php; the 6 username parameter to c...
CommuniGatePro < 4.1b2 Session Token Disclosure
Binary data 2178.prm...
Ipswitch IMail Web Interface URI Referer Session Token Disclosure
The remote host is running IMail web interface. In this version, the session is maintained via the URL. It will be disclosed in the Referer field if you receive an email with external links e.g. images %NASLMINLEVEL 70300 C Tenable Network Security, Inc. References: http://www.nessus.org/u?fd6d15...
Accounts easily compromised on Critical Path web mail service, CP does not respond after 30 days.
Security Advisory: Cross-site scripting vulnerability compromises accounts on Altavista, ICQ, US West/Qwest, others Date 21 August 2000 Author Jeffrey W. Baker, email [email protected] Copyright statement This security advisory is Copyright 2000 by Jeffrey William Baker [email protected]. The advisor...
Weak Token in Mail.Com Application Allows Compromise of Arbitrary User's Data
Weak Token in Mail.Com Application Allows Compromise of Arbitrary User's Data Black Watch Labs Security Advisory 00-02 March 6, 2000 Name: Weak Token in Mail.Com Application Allows Compromise of Arbitrary User's Data Black Watch Labs ID: BWL-00-02 Date Released: March 6, 2000 Category: Applicatio...
Use of a Broken or Risky Cryptographic Algorithm
✍️ Description The function mtrand is used to generate session tokens, this function is cryptographically flawed due to its nature being one pseudorandomness, an attacker can take advantage of the cryptographically insecure nature of this function to enumerate session tokens for accounts that are...