CVE-2002-1672: Undefined Security Weakness

Webmin 0.92, when installed from an RPM, creates /var/webmin with insecure permissions world readable, which could allow local users to read the root user's cookie-based authentication credentials and possibly hijack the root user's session using the credentials...

[Full-disclosure] Statcounter Script Injection User Session Hijack

Statcounter Script Injection User Session Hijack Class Input Validation & Session Hijack Remote Local Published / Updated Yes Yes 04th May 2005 Vulnerable http://www.statcounter.com/ All users of websites using the statcounter services Not Vulnerable - Discussion Statcounter.com is one of the bes...

Mitel 3300 ICP IP PBX VOIP device Web session hijack

Predictable session id allos to hijack Web administration session...

CVE-2004-0866

CVE-2004-0866 involves Internet Explorer 6.0. The vulnerability allows websites to set cookies for country‑specific top‑level domains (e.g., .ltd.uk, .plc.uk, .sch.uk), which could enable a remote attacker to perform a session fixation attack and hijack a user’s HTTP session. The provided documen...

CVE-2004-0866: Undefined Security Weakness

Internet Explorer 6.0 allows web sites to set cookies for country-specific top-level domains, such as .ltd.uk, .plc.uk, and .sch.uk, which could allow remote attackers to perform a session fixation attack and hijack a user's HTTP session...

CVE-2004-1478: Undefined Security Weakness

JRun 4.0 does not properly generate and handle the JSESSIONID, which allows remote attackers to perform a session fixation attack and hijack a user's HTTP session...

CVE-2004-1477: Undefined Security Weakness

Cross-site scripting XSS vulnerability in the Management Console in JRun 4.0 allows remote attackers to execute arbitrary web script or HTML and possibly hijack a user's session...

D-BUS message bus system session hijack

Malicious local user can connect to another user's session bus...

CVE-2005-0079

CVE-2005-0079 affects xtrlock 2.0, where a buffer overflow allows local users to cause a denial of service (application crash) and potentially hijack the desktop session. The vulnerability is confirmed across multiple feeds (NVD, OSV, Debian DSA, OpenVAS, Nessus) and is described as a local, low-...

CVE-2005-0079

Buffer overflow in xtrlock 2.0 allows local users to cause a denial of service application crash and hijack the desktop session...

CVE-2005-0079: Undefined Security Weakness

Buffer overflow in xtrlock 2.0 allows local users to cause a denial of service application crash and hijack the desktop session...

security flaw

The FileStore capability in CGI::Session for Ruby before 1.8.1, and possibly PStore, creates files with insecure permissions, which can allow local users to steal session information and hijack sessions...

CVE-2004-0746

CVE-2004-0746 affects Konqueror in KDE 3.2.3 and earlier. The issue allows a remote attacker to cause a web site to set cookies for country-specific top‑level domains (for example .ltd.uk, .plc.uk, .firm.in), enabling a session fixation attack and potential HTTP session hijacking. Connected docum...

CVE-2004-0746: Undefined Security Weakness

Konqueror in KDE 3.2.3 and earlier allows web sites to set cookies for country-specific top-level domains, such as .ltd.uk, .plc.uk and .firm.in, which could allow remote attackers to perform a session fixation attack and hijack a user's HTTP session...

bblog 0.7.2 cross site scripting

Introduction: Bblog, a blogging system scripted in PHP does not perform sufficient filtering when submitting a blog name. The severity of this flaw however, is low as the required privileges to access the administration panel for bblog is superuser. The problem: The flaw lies in...

CVE-2004-0192: Undefined Security Weakness

Cross-site scripting XSS vulnerability in the Management Service for Symantec Gateway Security 2.0 allows remote attackers to steal cookies and hijack a management session via a /sgmi URL that contains malicious script, which is not quoted in the resulting error page...

ColdFusion cross-site scripting security vulnerability of an error page

The outline of vulnerability Macromedia's ColdFusion can display the various information about an error at the time of error occurred. There is information transmitted from a client machine like "Referer". ColdFusion displays the information as it is. An attacker can execute a script on victim's...

CVE-2002-0872

CVE-2002-0872 affects l2tpd up to version 0.67 (affected component: RNG initialization). The vulnerability allows remote attackers to hijack sessions due to not initializing the random number generator. Debian advisory DSA-152-1 (DSA-152) confirms fixes: upgrade to 0.67-1.1 (stable) or 0.68-1 (un...

CVE-2002-1672

Webmin 0.92, when installed from an RPM, creates /var/webmin with insecure permissions world readable, which could allow local users to read the root user's cookie-based authentication credentials and possibly hijack the root user's session using the credentials...

PHP-Nuke 6.0 - Multiple Cross-Site Scripting Vulnerabilities

source: https://www.securityfocus.com/bid/6409/info It has been discovered that multiple PHP scripts used by PHP-Nuke are vulnerable to cross-sitescripting attacks. Due to insufficient sanitization of web requests it is possible for script code to be embedded in PHP script requests. By constructi...