Fixed in Apache Tomcat 6.0.16

Low: Session hi-jacking CVE-2007-5333 The previous fix for CVE-2007-3385 was incomplete. It did not consider the use of quotes or %5C within a cookie value. Affects: 6.0.0-6.0.14 Low: Elevated privileges CVE-2007-5342 The JULI logging component allows web applications to provide their own logging...

Fixed in Apache Tomcat 5.5.26

Low: Session hi-jacking CVE-2007-5333 The previous fix for CVE-2007-3385 was incomplete. It did not consider the use of quotes or %5C within a cookie value. Affects: 5.5.0-5.5.25 Low: Elevated privileges CVE-2007-5342 The JULI logging component allows web applications to provide their own logging...

Fixed in Apache Tomcat 4.1.39

Moderate: Session hi-jacking CVE-2008-0128 When using the SingleSignOn Valve via https the Cookie JSESSIONIDSSO is transmitted without the "secure" attribute, resulting in it being transmitted to any content that is - by purpose or error - requested via http from the same server. This was fixed i...

Fixed in Apache Tomcat 5.5.21

Moderate: Session hi-jacking CVE-2008-0128 When using the SingleSignOn Valve via https the Cookie JSESSIONIDSSO is transmitted without the "secure" attribute, resulting in it being transmitted to any content that is - by purpose or error - requested via http from the same server. Affects:...

Debian Security Advisory DSA 1239-1 (sql-ledger)

The remote host is missing an update to sql-ledger announced via advisory DSA 1239-1. Several remote vulnerabilities have been discovered in SQL Ledger, a web based double-entry accounting program, which may lead to the execution of arbitrary code. The Common Vulnerabilities and Exposures project...

CVE-2007-6546

CVE-2007-6546 affects RunCMS prior to 1.6.1. The issue is a predictable session ID that enables remote attackers to hijack a user session by modifying the session identifier. The available data states the vulnerability could allow such session hijacking, with a base severity of medium (CVSSv2 6.4...

CVE-2007-6470

phpRPG 0.8 stores sensitive information under the web root with insufficient access control, which allows remote attackers to read session ID values in files under tmp/, and then hijack sessions via PHPSESSID cookies...

[Full-disclosure] CVE-2007-6244: Adobe Flash Player ActiveX Control Universal Cross-Site Scripting Vulnerability

CVE-2007-6244 Adobe Flash Player ActiveX Control Universal Cross-Site Scripting Vulnerability 19 December 2007 == Summary == Affected Vendor: Adobe Affected Products: Flash Player ActiveX Control for Internet Explorer Affected Versions: Adobe Flash Player 9.0.48.0 and earlier, 8.0.35.0 and earlie...

CVE-2007-6470

Affected software : phpRPG 0.8. Vulnerability : inadequate access control causes sensitive information to be stored under the web root, enabling remote attackers to read session IDs from tmp/ files and hijack sessions via PHPSESSID cookies. Root cause : improper handling/placement of session data...

CVE-2007-6470

phpRPG 0.8 stores sensitive information under the web root with insufficient access control, which allows remote attackers to read session ID values in files under tmp/, and then hijack sessions via PHPSESSID cookies...

phpRPG 0.8 - '/tmp' Directory PHPSESSID Cookie Session Hijacking

source: https://www.securityfocus.com/bid/26884/info phpRPG is prone to two vulnerabilities: - An SQL-injection vulnerability - A vulnerability that lets remote attackers gain access to sessions. Exploiting these issues may allow an unauthorized user to steal sessions, access or modify data, or...

phpRPG 0.8 - tmp Directory PHPSESSID Cookie Session Hijacking

phpRPG 0.8 - tmp Directory PHPSESSID Cookie Session Hijacking source: https://www.securityfocus.com/bid/26884/info phpRPG is prone to two vulnerabilities: - An SQL-injection vulnerability - A vulnerability that lets remote attackers gain access to sessions. Exploiting these issues may allow an...

CVE-2007-5614

Mortbay Jetty before 6.1.6rc1 does not properly handle "certain quote sequences" in HTML cookie parameters, which allows remote attackers to hijack browser sessions via unspecified vectors...

CVE-2007-5614

CVE-2007-5614 affects Mortbay Jetty prior to 6.1.6rc1, where improper handling of certain quote sequences in HTML cookie parameters can lead to remote session hijacking via unspecified vectors. This is documented in the original vulnerability description plus multiple vulnerability references (in...

Mortbay Jetty fails to properly handle cookies with quotes

Overview Mortbay Jetty fails to properly handle cookie quotes, which may allow session hijacking. Description Mortbay Jetty is a web server that is written in Java. Jetty fails to properly handle cookies with certain quote sequences. This can cause the Jetty cookie parsing mechanism to improperly...

USN-549-2: PHP regression

USN-549-1 fixed vulnerabilities in PHP. However, some upstream changes were incomplete, which caused crashes in certain situations with Ubuntu 7.10. This update fixes the problem. We apologize for the inconvenience. Original advisory details: It was discovered that the wordwrap function did not...

Moderate: Red Hat Security Advisory: tomcat security update for Red Hat Network Satellite Server

Updated tomcat packages that fix multiple security issues are now available for Red Hat Network Satellite Server. This update has been rated as having moderate security impact by the Red Hat Security Response Team. Tomcat is a servlet container for Java Servlet and JavaServer Pages technologies. ...

tomcat handling of cookies

Apache Tomcat 6.0.0 to 6.0.13, 5.5.0 to 5.5.24, 5.0.0 to 5.0.30, 4.1.0 to 4.1.36, and 3.3 to 3.3.2 treats single quotes "'" as delimiters in cookies, which might cause sensitive information such as session IDs to be leaked and allow remote attackers to conduct session hijacking attacks...

tomcat handling of cookie values

Apache Tomcat 6.0.0 to 6.0.13, 5.5.0 to 5.5.24, 5.0.0 to 5.0.30, 4.1.0 to 4.1.36, and 3.3 to 3.3.2 does not properly handle the " character sequence in a cookie value, which might cause sensitive information such as session IDs to be leaked to remote attackers and enable session hijacking attacks...

CVE-2007-5905

Adobe ColdFusion 8 and MX 7 allows remote attackers to hijack sessions via unspecified vectors that trigger establishment of a session to a ColdFusion application in which the 1 CFID or 2 CFTOKEN cookies have empty values, possibly due to a session fixation vulnerability...