CVE-2004-1478

JRun 4.0 does not properly generate and handle the JSESSIONID, which allows remote attackers to perform a session fixation attack and hijack a user's HTTP session...

CVE-2004-1477

Cross-site scripting XSS vulnerability in the Management Console in JRun 4.0 allows remote attackers to execute arbitrary web script or HTML and possibly hijack a user's session...

Multiple devices process HTTP requests inconsistently

Overview Multiple interconnected devices process valid HTTP request headers inconsistently and in this may manner may allow a remote attacker to poison a cache, conduct cross-site scripting attacks, and hijack user sessions. Attackers may use these flaws to launch a class of attacks referred to a...

Advisore: UeBIMIAU <= 2.7.2 Multiples Vulnerabilities

ADVISORE 01 15/01/2005 INTRUDERS TIGER TEAM SECURITY - SECURITY ADVISORE http://www.intruders.com.br/ http://www.intruders.org.br/ ADVISORE/0105 - UEBIMIAU 2.7.2 MULTIPLES VULNERABILITIES PRIORITY: HIGH I - INTRODUCTION: ---------------- From http://www.uebimiau.org/ "UebiMiau is a simple, yet...

CVE-2004-2182

Session fixation vulnerability in Macromedia JRun 4.0 allows remote attackers to hijack user sessions by pre-setting the user session ID information used by the session server...

CVE-2004-1527

Microsoft Internet Explorer 6.0 SP1 does not properly handle certain character strings in the Path attribute, which can cause it to modify cookies in other domains when the attacker's domain name is within the target's domain name or when wildcard DNS is being used, which allows remote attackers ...

CVE-2004-1477

Cross-site scripting XSS vulnerability in the Management Console in JRun 4.0 allows remote attackers to execute arbitrary web script or HTML and possibly hijack a user's session...

CVE-2004-2681

PeerSec MatrixSSL before 1.1 caches session keys for an indefinitely long time, which might make it easier for remote attackers to hijack a session...

CVE-2004-2243

Phorum allows remote attackers to hijack sessions of other users by stealing and replaying the session hash in the phorumuriauth parameter, as demonstrated using profile.php. NOTE: the affected version was reported to be 4.3.7, but this may be erroneous...

CVE-2004-2558

Unspecified vulnerability in IBM Tivoli SecureWay Policy Director 3.8, Access Manager for e-business 3.9 to 5.1, Access Manager Identity Manager Solution 5.1, Configuration Manager 4.2, Configuration Manager for Automated Teller Machines 2.1.0, and IBM WebSphere Everyplace Server, Service Provide...

CVE-2004-1478

JRun 4.0 does not properly generate and handle the JSESSIONID, which allows remote attackers to perform a session fixation attack and hijack a user's HTTP session...

phpCMS <= 1.2.1 Xss Vulnerability, Information disclosure

Title: phpCMS = 1.2.1 Xss Vulnerability, Information disclosure Affects: - = 1.2.1 Effect: Cross Site Attack session hijacking, ... Id: cbsa-0006 Release Date: 2004/11/26 Author: Cyrille Barthelemy [email protected] -- 1. Introduction ------------------------ phpCMS is a content management...

[SNS Advisory No.79] A Possibility of Cookie Overwrite in Microsoft Internet Explorer

---------------------------------------------------------------------- SNS Advisory No.79 A Possibility of Cookie Overwrite in Microsoft Internet Explorer Problem first discovered on: Mon, 01 Sept 2003 Published on: Mon, 15 Nov 2004...

[SA12937] Sun ONE Messaging Server Webmail Session Hijacking Vulnerability

---------------------------------------------------------------------- Monitor, Filter, and Manage Security Information - Filtering and Management of Secunia advisories - Overview, documentation, and detailed reports - Alerting via email and SMS Request Trial: https://ca.secunia.com/?f=l...

Sun ONE Messaging Server session hijacking

Webmail sessions hijacking...

CVE-2004-0755

The FileStore capability in CGI::Session for Ruby before 1.8.1, and possibly PStore, creates files with insecure permissions, which can allow local users to steal session information and hijack sessions...

CVE-2004-0755

The FileStore capability in CGI::Session for Ruby before 1.8.1, and possibly PStore, creates files with insecure permissions, which can allow local users to steal session information and hijack sessions...

ACROS Security: HTML Injection in JRun Management Console

=====BEGIN-ACROS-REPORT===== PUBLIC ========================================================================= ACROS Security Problem Report 2004-10-14-1 ------------------------------------------------------------------------- ASPR 2004-10-14-1: HTML Injection in JRun Management Console...

Multiple Macromedia JRun bugs

DoS, source code leakage, session hijacking, crossite scripting, buffer overflow...

XXS in SCT email client

Vendor : SCT URL : http://www.SCT.com/ Version: Campus Pipeline Risk : Cross site scripting Description: Fusetalk SCT Campus Pipeline is the Web platform of choice at over 175 institutions. It improves efficiency, builds community, and provides freedom of choice by integrating disparate systems a...