CVE-2004-0305

CVE-2004-0305 describes a cross-site scripting (XSS) vulnerability in WebCortex WebStores 2000 version 6.0, specifically in error.asp. The underlying issue is the handling of the Message_id parameter, enabling remote attackers to execute arbitrary scripts in the context of other users’ sessions a...

CVE-2004-0305

Cross-site scripting XSS vulnerability in error.asp in WebCortex WebStores 2000 6.0 allows remote attackers to execute arbitrary script as other users and steal session IDs via the Messageid parameter...

GNU Radius DoS

NULL reference on empty Acct-Session-Id attribute...

CVE-2003-1312

siteminderagent/SmMakeCookie.ccc in Netegrity SiteMinder places a session ID string in the value of the SMSESSION parameter in a URL, which might allow remote attackers to obtain the ID by sniffing, reading Referer logs, or other methods...

CVE-2003-1245

index2.php in Mambo 4.0.12 allows remote attackers to gain administrator access via a URL request where sessionid is set to the MD5 hash of a session cookie...

CVE-2003-1481

CommuniGate Pro 3.1 through 4.0.6 sends the session ID in the referer field for an HTTP request for an image, which allows remote attackers to hijack mail sessions via an e-mail with an IMG tag that references a malicious URL that captures the referer...

osCommerce Malformed Session ID XSS Vuln

Vendor : osCommerce URL : http://www.oscommerce.com Version : All Current Versions Risk : Cross Site Scripting Description: osCommerce is an online shop e-commerce solution under on going development by the open source community. Its feature packed out-of-the-box installation allows store owners ...

CVE-2003-0728

Horde before 2.2.4 allows remote malicious web sites to steal session IDs and read or create arbitrary email by stealing the ID from a referrer URL...

CVE-2003-0728

Horde before 2.2.4 allows remote malicious web sites to steal session IDs and read or create arbitrary email by stealing the ID from a referrer URL...

CVE-2003-0728

CVE-2003-0728 affects Horde before 2.2.4. The vulnerability allows remote malicious websites to steal session IDs and read or create arbitrary email by stealing the ID from a referrer URL. The NVD entry lists a CVSSv2 base score of 6.4 (Medium) with network access, low attack complexity, and no u...

CVE-2003-0728: Undefined Security Weakness

Horde before 2.2.4 allows remote malicious web sites to steal session IDs and read or create arbitrary email by stealing the ID from a referrer URL...

CVE-2003-0493

Snitz Forums 3.4.03 and earlier allows attackers to gain privileges as other users by stealing and replaying the encrypted password after obtaining a valid session ID...

PHP4 crossite scripting

Crossite scripting in transparent session ID feature...

0006_AP.CF-rds-dump.txt

-- ------------------------- -- - AngryPacket Security Advisory - -- ------------------------- -- - +--------------------- -- - + advisory information +------------------ -- - Exploit Code: Victim1 Initial Bug Report By: rs2112 release date: 06/26/2003 +------------------- -- - + timeline of...

CVE-2003-0493

Snitz Forums 3.4.03 and earlier are affected by an authentication vulnerability where an attacker can gain privileges as another user by stealing and replaying the encrypted password after obtaining a valid session ID. The available sources (NVD entry for CVE-2003-0493 and related records) descri...

CVE-2003-0493

Snitz Forums 3.4.03 and earlier allows attackers to gain privileges as other users by stealing and replaying the encrypted password after obtaining a valid session ID...

CVE-2003-0493: Undefined Security Weakness

Snitz Forums 3.4.03 and earlier allows attackers to gain privileges as other users by stealing and replaying the encrypted password after obtaining a valid session ID...

[SECURITY] [DSA-319-1] New webmin packages fix remote session ID spoofing

-------------------------------------------------------------------------- Debian Security Advisory DSA 319-1 [email protected] http://www.debian.org/security/ Matt Zimmerman June 12th, 2003 http://www.debian.org/security/faq -...

DSA-319 webmin - session ID spoofing

Bulletin has no description...

PHP Trans SID XSS (Was: New php release with security fixes)

It also fixes the following, which wasn't mentioned in the summary or elsewhere, as far as I can see: "Cross-site Scripting in PHP's Transparent Session ID Support" http://shh.thathost.com/secadv/2003-05-11-php.txt Sverre. -- [email protected] http://shh.thathost.com/...