6584 matches found
CVE-2008-2433
CVE-2008-2433 affects Trend Micro OfficeScan 7.0–8.0, Worry-Free Business Security 5.0, and Client/Server/Messaging Suite 3.5–3.6. The root cause is insufficient entropy in the web management console’s session token generation, which relies only on login time (granularity of one second). This wea...
CVE-2008-2433
The web management console in Trend Micro OfficeScan 7.0 through 8.0, Worry-Free Business Security 5.0, and Client/Server/Messaging Suite 3.5 and 3.6 creates a random session token based only on the login time, which makes it easier for remote attackers to hijack sessions via brute-force attacks...
squirrelmail -- Session hijacking vulnerability
Hanno Boeck reports: When configuring a web application to use only ssl e.g. by forwarding all http-requests to https, a user would expect that sniffing and hijacking the session is impossible. Though, for this to be secure, one needs to set the session cookie to have the secure flag. Otherwise t...
ScrewTurn-Wiki_08_008.txt
Portcullis Security Advisory 08008 Vulnerable System: ScrewTurn Wiki www.screwturn.eu. Vulnerability Title: Permanent Cross-site Scripting in the "System Log" page. Vulnerability Discovery And Development: Portcullis Security Testing Services. Credit For Discovery: Ferruh Mavituna - Portcullis...
icebb10-sql.txt
Author: GiReX 26/07/08 Homepage: girex.altervista.org CMS: IceBB \ input'autho...
IceBB <= 1.0-RC9.2 Blind SQL Injection / Session Hijacking Exploit
No description provided by source. Author: GiReX 26/07/08 Homepage: girex.altervista.org CMS: IceBB = 1.0-RC9.2 Site: icebb.net Bug: Blind SQL Injection Exploit: Session Hijacking PoC Works regardless of php.ini settings Description: IceBB is a powerful, fast, free, and open-source forum solution...
IceBB <= 1.0-RC9.2 Blind SQL Injection / Session Hijacking Exploit
Exploit for unknown platform in category web applications ================================================================== IceBB = 1.0-RC9.2 Blind SQL Injection / Session Hijacking Exploit ================================================================== Author: GiReX 26/07/08 Homepage:...
IceBB 1.0-RC9.2 - Blind SQL Injection Session Hijacking
IceBB 1.0-RC9.2 - Blind SQL Injection Session Hijacking Author: GiReX 26/07/08 Homepage: girex.altervista.org CMS: IceBB ...
IceBB 1.0-RC9.2 - Blind SQL Injection / Session Hijacking
Author: GiReX 26/07/08 Homepage: girex.altervista.org CMS: IceBB \ input'author''" Setting author=\ in this query: "SELECT...
OpenSSH X11 < 5.1 Session Hijacking
Binary data 4598.prm...
Oracle BEA Weblogic 10 — Multiple Linked ХSS vulnerabilities
Application: Oracle BEA Weblogic 10 Versions Affected: Oracle BEA Weblogic 10 Vendor URL: Bugs: Multiple XSS Vulnerabilities in samples Exploits: YES Reported: 16.07.2008 Vendor response: 18.07.2008 Last response: 30.10.2008 Description: Review Service sample of WebLogic Server. Date of Public...
CVE-2008-3170
Apple Safari allows web sites to set cookies for country-specific top-level domains, such as co.uk and com.au, which could allow remote attackers to perform a session fixation attack and hijack a user's HTTP session, aka "Cross-Site Cooking," a related issue to CVE-2004-0746, CVE-2004-0866, and...
CVE-2008-3170
Technical details about CVE-2008-3170 are not publicly available in the provided connected documents; monitor for updates.
siteatschool-uplaod.txt
?php / ------------------------------------------------------------------------- Site@School = 2.4.10 fckeditor Session Hijacking / File Upload Exploit ------------------------------------------------------------------------- author...: EgiX mail.....: n0b0d13satgmaildotcom link.....:...
Fedora 9 : jetty-5.1.14-1jpp.2.fc9 (2008-6141)
Bug 417411 - CVE-2007-5615: jetty CRLF injection - Bug 417391 - CVE-2007-5613: jetty cross site scripting - Bug 417401 - CVE-2007-5614: jetty session hijacking issue Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory...
Site@School <= 2.4.10 (fckeditor) Session Hijacking / File Upload Exploit
No description provided by source. ?php / ------------------------------------------------------------------------- Site@School = 2.4.10 fckeditor Session Hijacking / File Upload Exploit ------------------------------------------------------------------------- author...: EgiX mail.....:...
Site@School 2.4.10 - FCKeditor Session Hijacking Arbitrary File Upload
Site@School 2.4.10 - FCKeditor Session Hijacking Arbitrary File Upload ?php / ------------------------------------------------------------------------- Site@School = 2.4.10 fckeditor Session Hijacking / File Upload Exploit -------------------------------------------------------------------------...
Site@School 2.4.10 - 'FCKeditor' Session Hijacking / Arbitrary File Upload
?php / ------------------------------------------------------------------------- Site@School = 2.4.10 fckeditor Session Hijacking / File Upload Exploit ------------------------------------------------------------------------- author...: EgiX mail.....: n0b0d13satgmaildotcom link.....:...
[email protected] <= 2.4.10 (fckeditor) Session Hijacking / File Upload Exploit
Exploit for unknown platform in category web applications ========================================================================= email protected = 2.4.10 fckeditor Session Hijacking / File Upload Exploit ========================================================================= ?php /...
tomcat handling of cookies
Apache Tomcat 6.0.0 to 6.0.13, 5.5.0 to 5.5.24, 5.0.0 to 5.0.30, 4.1.0 to 4.1.36, and 3.3 to 3.3.2 treats single quotes "'" as delimiters in cookies, which might cause sensitive information such as session IDs to be leaked and allow remote attackers to conduct session hijacking attacks...