2323 matches found
CVE-2006-1095
The CVE-2006-1095 entry applies to Apache’s mod_python (FileSession object) and 3.2.7, where a directory traversal via a crafted session cookie can allow local code execution. Affected component: mod_python 3.2.7 for Apache (FileSession). Root cause: directory traversal in session handling. Impac...
CVE-2006-1095
Directory traversal vulnerability in the FileSession object in Modpython module 3.2.7 for Apache allows local users to execute arbitrary code via a crafted session cookie...
Geeklog lib-sessions.php Session Cookie Handling Administrative Bypass
Binary data 3464.prm...
CVE-2006-0704
iE Integrator 4.4.220114, when configured without a "bespoke error page" in acm.ini, allows remote attackers to obtain sensitive information via a URL that calls a non-existent .aspx script in the integrator/apps directory, which results in an error message that displays the installation path, we...
CVE-2006-0704
iE Integrator 4.4.220114, when configured without a "bespoke error page" in acm.ini, allows remote attackers to obtain sensitive information via a URL that calls a non-existent .aspx script in the integrator/apps directory, which results in an error message that displays the installation path, we...
CVE-2006-0411
claroinitlocal.inc.php in Claroline 1.7.2 uses guessable session cookies MD5 hash of connection time, which allows remote attackers to hijack sessions and possibly gain administrative privileges...
HTTP login page
This script logs onto a web server through a login page and stores the authentication / session cookie. OpenVAS Vulnerability Test $Id: httplogin.nasl 8023 2017-12-07 08:36:26Z teissa $ Description: HTTP login page Authors: Michel Arboi Copyright: Copyright C 2002 Michel Arboi This program is fre...
XOOPS < 2.0.12 Multiple Vulnerabilities
The installed version of XOOPS on the remote host is affected by several vulnerabilities : - A SQL Injection Vulnerability The bundled XMLRPC server fails to sanitize user- supplied input to the 'xmlrpc.php' script. An attacker can exploit this flaw to launch SQL injection attacks, which could le...
Bea Weblogic application server Server Console crossite scripting
Crossite scripting; no session cookie timeout is implemented...
SqWebMail redirect Parameter CRLF Injected XSS
The remote host is running a version of SqWebMail that does not properly sanitize user-supplied input through the 'redirect' parameter. An attacker can exploit this flaw to inject arbitrary HTML and script code into a user's browser to be executed within the context of the affected website. Such...
[Hackers Center Security Group] Sqwebmail Http Splitting Vulnerability
Hackers Center Security Group http://www.hackerscenter.com/ Zinho's Security Advisory Desc: Http Splitting leads to email account stealing Product: SQWebmail Risk: High A dangerous http splitting attack can be taken against mailboxes that use Sqwebmail as web mail interface. Anyone can send a...
Horde Nag common-footer.inc Parent Frame Page Title XSS
According to its version, the remote installation of Nag fails to fully sanitize user-supplied input when setting the parent frame's page title by JavaScript in 'templates/common-footer.inc'. By leveraging this flaw, an attacker may be able to inject arbitrary HTML and script code into a user's...
IMP common-footer.inc Parent Frame Page Title XSS
According to its version, the remote installation of IMP fails to fully sanitize user-supplied input when setting the parent frame's page title by JavaScript in 'templates/common-footer.inc'. By leveraging this flaw, an attacker may be able to inject arbitrary HTML and script code into a user's...
Magic Winmail Server 4.0 (Build 1112) - download.php Traversal Arbitrary File Access
Magic Winmail Server 4.0 Build 1112 - download.php Traversal Arbitrary File Access source: https://www.securityfocus.com/bid/12388/info Magic Winmail Server is reportedly affected by multiple vulnerabilities. There are two distinct directory traversal vulnerabilities in the Webmail interface...
ubbXSS.txt
Vendor: Infopop URL: http://www.infopop.com/ tested Versions: 6.2.3 & 6.5 remote: yes vendor notified: 06 Dec 2004 at 01:08 AM Vendor response: 06/07 Dec 2004 01:33 AM/06:08 PM Update status: ..in process ============================================================ Summary: UBBThreads is a High e...
[Full-Disclosure] Multiple XSS Vulnerabilities in several UBB.Thread Versions
Vendor: Infopop URL: http://www.infopop.com/ tested Versions: 6.2.3 & 6.5 remote: yes vendor notified: 06 Dec 2004 at 01:08 AM Vendor response: 06/07 Dec 2004 01:33 AM/06:08 PM Update status: ..in process ============================================================ Summary: UBBThreads is a High e...
Debian DSA-436-1 : mailman - several vulnerabilities
Several vulnerabilities have been fixed in the mailman package : - CAN-2003-0038 - potential cross-site scripting via certain CGI parameters not known to be exploitable in this version - CAN-2003-0965 - cross-site scripting in the administrative interface - CAN-2003-0991 - certain malformed email...
Debian DSA-388-1 : kdebase - several vulnerabilities
Two vulnerabilities were discovered in kdebase : - CAN-2003-0690 : KDM in KDE 3.1.3 and earlier does not verify whether the pamsetcred function call succeeds, which may allow attackers to gain root privileges by triggering error conditions within PAM modules, as demonstrated in certain...
kdelibs: Cross-domain cookie injection vulnerability
Background KDE is a widely-used desktop environment based on the Qt toolkit. kcookiejar in kdelibs is responsible for storing and managing HTTP cookies. Konqueror uses kcookiejar for storing and managing cookies. Description kcookiejar contains a vulnerability which may allow a malicious website ...
Mandrake Linux Security Advisory : kdebase (MDKSA-2003:091)
A vulnerability was discovered in all versions of KDE 2.2.0 up to and including 3.1.3. KDM does not check for successful completion of the pamsetcred call and in the case of error conditions in the installed PAM modules, KDM may grant local root access to any user with valid login credentials. It...