2375 matches found
ColdFusion cross-site scripting security vulnerability of an error page
The outline of vulnerability Macromedia's ColdFusion can display the various information about an error at the time of error occurred. There is information transmitted from a client machine like "Referer". ColdFusion displays the information as it is. An attacker can execute a script on victim's...
CVE-2002-0872
CVE-2002-0872 affects l2tpd up to version 0.67 (affected component: RNG initialization). The vulnerability allows remote attackers to hijack sessions due to not initializing the random number generator. Debian advisory DSA-152-1 (DSA-152) confirms fixes: upgrade to 0.67-1.1 (stable) or 0.68-1 (un...
CVE-2002-1672
Webmin 0.92, when installed from an RPM, creates /var/webmin with insecure permissions world readable, which could allow local users to read the root user's cookie-based authentication credentials and possibly hijack the root user's session using the credentials...
PHP-Nuke 6.0 - Multiple Cross-Site Scripting Vulnerabilities
source: https://www.securityfocus.com/bid/6409/info It has been discovered that multiple PHP scripts used by PHP-Nuke are vulnerable to cross-sitescripting attacks. Due to insufficient sanitization of web requests it is possible for script code to be embedded in PHP script requests. By constructi...
Deerfield VisNetic WebSite 3.5.13.1 - Cross-Site Scripting
source: https://www.securityfocus.com/bid/6369/info A vulnerability has been discovered in VisNetic Website when generating a 404 page for a non-existent resources. The issue is due to insufficient sanitization of the HTTP 'referer' header. It is possible to cause arbitrary code to be executed...
vBulletin 2.0.x2.2.x - members2.php Cross-Site Scripting
vBulletin 2.0.x2.2.x - members2.php Cross-Site Scripting source: https://www.securityfocus.com/bid/6246/info Due to insufficient sanitization of user supplied values, it is possible to exploit a vulnerability in VBulletin. By passing an invalid value to a variable located in 'members2.php', it is...
CVE-2002-1150: Undefined Security Weakness
The Remote Desktop Sharing RDS Screen Saver Protection capability for Microsoft NetMeeting 3.01 through SP2 4.4.3396 allows attackers with physical access to hijack remote sessions by entering certain logoff or shutdown sequences such as CTRL-ALT-DEL and canceling out of the resulting user...
KDE Security Advisory: Secure Cookie Vulnerability
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 KDE Security Advisory: Secure Cookie Vulnerability Original Release Date: 2002-09-08 URL: http://www.kde.org/info/security/advisory-20020908-1.txt 0. References None. 1. Systems affected: Konqueror in KDE 3.0, KDE 3.0.1 and KDE 3.0.2. KDE 2.2.2 and KD...
CVE-2002-0420
CVE-2002-0420 relates to PureTLS prior to version 0.9b2, with an injection-related vulnerability that could allow remote attackers to corrupt or hijack user sessions. The connected sources confirm the affected software and a remote-exploit goal, but do not provide further technical specifics, exp...
CVE-2001-1104
SonicWALL SOHO is affected by CVE-2001-1104 due to predictable TCP Initial Sequence Numbers, enabling remote attackers to spoof/hijack sessions. The vulnerability affects the firewall component handling TCP connections; exploitation could allow session hijacking without user interaction. A remedi...
CVE-2001-0922
The vulnerability CVE-2001-0922 affects Netdynamics ndcgi.exe (Netdynamics 4.x through 5.x, possibly earlier). The issue allows remote attackers to hijack user sessions by reading SPIDERSESSION and uniqueValue variables from the login field and then reusing them after the next user logs in, enabl...
CVE-1999-1268: Undefined Security Weakness
Vulnerability in KDE konsole allows local users to hijack or observe sessions of other users by accessing certain devices...
CVE-1999-1150: Undefined Security Weakness
Livingston Portmaster routers running ComOS use the same initial sequence number ISN for TCP connections, which allows remote attackers to conduct spoofing and hijack TCP sessions...
CVE-2000-0716
CVE-2000-0716 affects WorldClient email client in MDaemon 2.8. The session ID is included in the referer header of an HTTP request when the user clicks a URL, allowing the visited site to hijack the session ID and read the user’s email. Exploitation details are not provided in the documents, and ...