CVE-2006-0411

claroinitlocal.inc.php in Claroline 1.7.2 uses guessable session cookies MD5 hash of connection time, which allows remote attackers to hijack sessions and possibly gain administrative privileges...

CVE-2004-2243

CVE-2004-2243 affects Phorum where remote attackers can hijack other users’ sessions by stealing and replaying the session hash in the phorum_uriauth parameter (demonstrated via profile.php). The note says the affected version was reported as 4.3.7, but this may be erroneous. No explicit remediat...

CVE-2001-1545

Macromedia JRun 3.0/3.1 is affected by CVE-2001-1545, where the server appends the jsessionid to URLs (URL rewriting) when cookies are enabled. This can allow remote attackers to obtain session IDs and hijack sessions via HTTP referrer headers or sniffing. Public sources across NVD/Red Hat/CVE li...

CVE-2001-1532

WebX stores authentication information in the HTTPREFERER variable, which is included in URL links within bulletin board messages posted by users, which could allow remote attackers to hijack user sessions...

CVE-2002-1672: Undefined Security Weakness

Webmin 0.92, when installed from an RPM, creates /var/webmin with insecure permissions world readable, which could allow local users to read the root user's cookie-based authentication credentials and possibly hijack the root user's session using the credentials...

[Full-disclosure] Statcounter Script Injection User Session Hijack

Statcounter Script Injection User Session Hijack Class Input Validation & Session Hijack Remote Local Published / Updated Yes Yes 04th May 2005 Vulnerable http://www.statcounter.com/ All users of websites using the statcounter services Not Vulnerable - Discussion Statcounter.com is one of the bes...

Mitel 3300 ICP IP PBX VOIP device Web session hijack

Predictable session id allos to hijack Web administration session...

CVE-2004-0866

CVE-2004-0866 involves Internet Explorer 6.0. The vulnerability allows websites to set cookies for country‑specific top‑level domains (e.g., .ltd.uk, .plc.uk, .sch.uk), which could enable a remote attacker to perform a session fixation attack and hijack a user’s HTTP session. The provided documen...

CVE-2004-1478: Undefined Security Weakness

JRun 4.0 does not properly generate and handle the JSESSIONID, which allows remote attackers to perform a session fixation attack and hijack a user's HTTP session...

CVE-2004-1477: Undefined Security Weakness

Cross-site scripting XSS vulnerability in the Management Console in JRun 4.0 allows remote attackers to execute arbitrary web script or HTML and possibly hijack a user's session...

CVE-2004-0866: Undefined Security Weakness

Internet Explorer 6.0 allows web sites to set cookies for country-specific top-level domains, such as .ltd.uk, .plc.uk, and .sch.uk, which could allow remote attackers to perform a session fixation attack and hijack a user's HTTP session...

D-BUS message bus system session hijack

Malicious local user can connect to another user's session bus...

CVE-2005-0079

CVE-2005-0079 affects xtrlock 2.0, where a buffer overflow allows local users to cause a denial of service (application crash) and potentially hijack the desktop session. The vulnerability is confirmed across multiple feeds (NVD, OSV, Debian DSA, OpenVAS, Nessus) and is described as a local, low-...

CVE-2005-0079

Buffer overflow in xtrlock 2.0 allows local users to cause a denial of service application crash and hijack the desktop session...

CVE-2005-0079: Undefined Security Weakness

Buffer overflow in xtrlock 2.0 allows local users to cause a denial of service application crash and hijack the desktop session...

security flaw

The FileStore capability in CGI::Session for Ruby before 1.8.1, and possibly PStore, creates files with insecure permissions, which can allow local users to steal session information and hijack sessions...

CVE-2004-0746

CVE-2004-0746 affects Konqueror in KDE 3.2.3 and earlier. The issue allows a remote attacker to cause a web site to set cookies for country-specific top‑level domains (for example .ltd.uk, .plc.uk, .firm.in), enabling a session fixation attack and potential HTTP session hijacking. Connected docum...

CVE-2004-0746: Undefined Security Weakness

Konqueror in KDE 3.2.3 and earlier allows web sites to set cookies for country-specific top-level domains, such as .ltd.uk, .plc.uk and .firm.in, which could allow remote attackers to perform a session fixation attack and hijack a user's HTTP session...

bblog 0.7.2 cross site scripting

Introduction: Bblog, a blogging system scripted in PHP does not perform sufficient filtering when submitting a blog name. The severity of this flaw however, is low as the required privileges to access the administration panel for bblog is superuser. The problem: The flaw lies in...

CVE-2004-0192: Undefined Security Weakness

Cross-site scripting XSS vulnerability in the Management Service for Symantec Gateway Security 2.0 allows remote attackers to steal cookies and hijack a management session via a /sgmi URL that contains malicious script, which is not quoted in the resulting error page...