Drupal XSS Password Changer

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Problem Description: There have been quite a few Cross Site Scripting XSS vulnerabilities discovered in Drupal modules recently. Many people scoff at XSS and even argue that it's a low threat vulnerability. In many cases this is certainly true, howeve...

Mandrake Security Advisory MDVSA-2009:053 (squirrelmail)

The remote host is missing an update to squirrelmail announced via advisory MDVSA-2009:053. OpenVAS Vulnerability Test $Id: mdksa2009053.nasl 6587 2017-07-07 06:35:35Z cfischer $ Description: Auto-generated from advisory MDVSA-2009:053 squirrelmail Authors: Thomas Reinke Copyright: Copyright c 20...

SquirrelMail HTTPS Session Cookie Secure Flag Weakness

The version of SquirrelMail installed on the remote host does not set the 'secure' flag for session cookies established when communicating over SSL / TLS. This could lead to disclosure of those cookies if a user issues a request to a host in the same domain over HTTP as opposed to HTTPS...

CVE-2009-0030

A certain Red Hat patch for SquirrelMail 1.4.8 sets the same SQMSESSID cookie value for all sessions, which allows remote authenticated users to access other users' folder lists and configuration data in opportunistic circumstances by using the standard webmail.php interface. NOTE: this...

PT-2009-2743 · Squirrelmail +1 · Squirrelmail +1

Name of the Vulnerable Software and Affected Versions: SquirrelMail version 1.4.8 Description: The issue allows remote authenticated users to access other users' folder lists and configuration data under certain circumstances by using the standard webmail.php interface. This occurs because a Red...

Moderate: Red Hat Security Advisory: squirrelmail security update

An updated squirrelmail package that resolves various security issues is now available for Red Hat Enterprise Linux 3, 4 and 5. This update has been rated as having moderate security impact by the Red Hat Security Response Team. SquirrelMail is an easy-to-configure, standards-based, webmail packa...

squirrelmail: session hijacking - secure flag not set for HTTPS-only cookies

Squirrelmail 1.4.15 does not set the secure flag for the session cookie in an https session, which can cause the cookie to be sent in http requests and make it easier for remote attackers to capture this cookie...

PT-2009-14: BLOG CMS Cross-Site Scripting Vulnerability

BLOG CMS is a content management system CMS software, usually implemented as a Web application, for creating and managing HTML content. It is used to manage and control a large, dynamic collection of Web material HTML documents and their associated images. Vulnerability Description Positive...

PT-2009-12: UMI.CMS Cross-Site Scripting Vulnerability

UMI.CMS is a content management system CMS software, usually implemented as a Web application, for creating and managing HTML content. It is used to manage and control a large, dynamic collection of Web material HTML documents and their associated images. Vulnerability Description Positive...

CVE-2008-4122

Joomla! 1.5.8 does not set the secure flag for the session cookie in an https session, which makes it easier for remote attackers to capture this cookie by intercepting its transmission within an http session...

CVE-2008-4122

CVE-2008-4122 affects Joomla! 1.5.8, where the session cookie is not marked as Secure in HTTPS sessions. This allows interception of the session cookie if an attacker can observe HTTP traffic, potentially enabling session hijacking. The issue is rooted in the cookie not using the Secure flag, as ...

CVE-2008-4122

Joomla! 1.5.8 does not set the secure flag for the session cookie in an https session, which makes it easier for remote attackers to capture this cookie by intercepting its transmission within an http session...

PT-2008-5423 · Open Source Matters · Joomla!

Name of the Vulnerable Software and Affected Versions: Joomla! version 1.5.8 Description: The issue makes it easier for remote attackers to capture the session cookie by intercepting its transmission within an http session, as the secure flag is not set for the session cookie in an https session...

CVE-2008-4122: Cleartext Transmission of Sensitive Information

Joomla! 1.5.8 does not set the secure flag for the session cookie in an https session, which makes it easier for remote attackers to capture this cookie by intercepting its transmission within an http session...

FreeBSD Ports: mantis

The remote host is missing an update to the system as announced in the referenced advisory. SPDX-FileCopyrightText: 2008 E-Soft Inc. Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only...

Mantis < 1.1.4 HTTPS Session Cookie Secure Flag Weakness

Binary data 4694.prm...

CVE-2008-4689

Mantis before 1.1.3 does not unset the session cookie during logout, which makes it easier for remote attackers to hijack sessions...

CVE-2008-4383: Improper Restriction of Operations within the Bounds of a Memory Buffer

Stack-based buffer overflow in the Agranet-Emweb embedded management web server in Alcatel OmniSwitch OS7000, OS6600, OS6800, OS6850, and OS9000 Series devices with AoS 5.1 before 5.1.6.463.R02, 5.4 before 5.4.1.429.R01, 6.1.3 before 6.1.3.965.R01, 6.1.5 before 6.1.5.595.R01, and 6.3 before...

CVE-2008-3663

Squirrelmail 1.4.15 does not set the secure flag for the session cookie in an https session, which can cause the cookie to be sent in http requests and make it easier for remote attackers to capture this cookie...

CVE-2008-3663

Squirrelmail 1.4.15 does not set the secure flag for the session cookie in an https session, which can cause the cookie to be sent in http requests and make it easier for remote attackers to capture this cookie...