Session fixation

Adobe ColdFusion 8 and MX 7 allows remote attackers to hijack sessions via unspecified vectors that trigger establishment of a session to a ColdFusion application in which the 1 CFID or 2 CFTOKEN cookies have empty values, possibly due to a session fixation vulnerability...

tomcat handling of cookie values

Apache Tomcat 6.0.0 to 6.0.13, 5.5.0 to 5.5.24, 5.0.0 to 5.0.30, 4.1.0 to 4.1.36, and 3.3 to 3.3.2 does not properly handle the " character sequence in a cookie value, which might cause sensitive information such as session IDs to be leaked to remote attackers and enable session hijacking attacks...

CVE-2003-1481

CommuniGate Pro 3.1 through 4.0.6 sends the session ID in the referer field for an HTTP request for an image, which allows remote attackers to hijack mail sessions via an e-mail with an IMG tag that references a malicious URL that captures the referer...

Session fixation

Session fixation vulnerability in Joomla! before 1.0.13 aka Sunglow allows remote attackers to hijack administrative web sessions via unspecified vectors...

CVE-2007-4203: Improper Authentication

Session fixation vulnerability in Mambo 4.6.2 CMS allows remote attackers to hijack web sessions by setting the Cookie parameter...

CVE-2007-4188: Session Fixation

Session fixation vulnerability in Joomla! before 1.0.13 aka Sunglow allows remote attackers to hijack administrative web sessions via unspecified vectors...

FreeBSD : joomla -- multiple vulnerabilities (4872d9a7-4128-11dc-bdb0-0016179b2dd5)

A Secunia Advisory reports : joomla can be exploited to conduct session fixation attacks, cross-site scripting attacks or HTTP response splitting attacks. Certain unspecified input passed in comsearch, comcontent and modlogin is not properly sanitised before being returned to a user. This can be...

CVE-2007-3988: Improper Authentication

Session fixation vulnerability in Virtual Hosting Control System VHCS 2.4.7.1 and earlier allows remote attackers to hijack web sessions by setting the PHPSESSID parameter...

CVE-2007-3050: Improper Authentication

Session fixation vulnerability in chameleon cms 3.0 and earlier allows remote attackers to hijack web sessions by setting the PHPSESSID parameter...

CVE-2007-2546: Improper Authentication

Session fixation vulnerability in Simple Machines Forum SMF 1.1.2 and earlier allows remote attackers to hijack web sessions by setting the PHPSESSID parameter...

CVE-2007-1951: Improper Authentication

Session fixation vulnerability in onelook obo Shop allows remote attackers to hijack web sessions by setting a PHPSESSID cookie...

livor 2.5 Cross-Site Scripting Vulnerability

/ livor 2.5 Cross-Site Scripting Vulnerability / //Author: Arham Muhammad //Source: http://www.arizona-dream.com/Usa/Divers/scriptsphp/scripts/livor.zip //Vulnerable File: index.php //XsS: http://victim/path/index.php?page=///scriptscriptalert/xss/;/script //Risk: Session Hijack //Fix: The Variab...

livor-xss.txt

/ livor 2.5 Cross-Site Scripting Vulnerability / //Author: Arham Muhammad //Source: http://www.arizona-dream.com/Usa/Divers/scriptsphp/scripts/livor.zip //Vulnerable File: index.php //XsS: http://victim/path/index.php?page=//alert/xss/; //Risk: Session Hijack //Fix: The Variable "page" Need To Be...

Mephisto blog is vulnerable to XSS

Hello everyone! Current bleeding-edge version of Mephisto blog is vulnerable to XSS. Comment's author name accept javascript code. If admin approves/ rejects comments manually, he have to load all unapproved comments, so it's possible to fetch his session id. Example Add new comment with the...

CVE-2006-6276

HTTP request smuggling vulnerability in Sun Java System Proxy Server before 20061130, when used with Sun Java System Application Server or Sun Java System Web Server, allows remote attackers to bypass HTTP request filtering, hijack web sessions, perform cross-site scripting XSS, and poison web...

PT-2006-6905 · Sun · Sun Java System Application Server +2

Name of the Vulnerable Software and Affected Versions: Sun Java System Proxy Server versions prior to 20061130 Description: The issue allows remote attackers to bypass HTTP request filtering, hijack web sessions, perform cross-site scripting XSS, and poison web caches. This is achieved via...

CVE-2006-4099

Business Objects Crystal Enterprise 9 and 10 generates predictable session identifiers, which allows remote attackers to hijack sessions of other users via WCSID cookie values...

CVE-2006-4099

Business Objects Crystal Enterprise 9 and 10 generates predictable session identifiers, which allows remote attackers to hijack sessions of other users via WCSID cookie values...

JVN#99776858 Multiple vulnerabilities in Webmin and Usermin

Impact A remote attacker could conduct the followings: Steal Webmin and Usermin's configuration information Execute an arbitrary script on the user's web browser Possibly conduct a session hijack attack if session information from a cookie is leaked Solution Products Affected Webmin 1.290 and...

CVE-2006-1267

Invision Power Board 2.1.4 allows remote attackers to hijack sessions and possibly gain administrative privileges by obtaining the session ID from the s parameter, then replaying it in another request...