XSS In Neoteris IVE Allows Session Hijacking

Note to Moderator: In light of some recent cross-site scripting posts allowed through to Bugtraq recently, grateful if you would pass this one onto the list....thanks. -d. ----------------------------------------------------------------------------------------------------=sMax. Security Advisory=...

Neoteris IVE swsrv.cgi XSS

The remote host is running the Neoteris IVE. There is a cross-site scripting issue in this server in the CGI swsrv.cgi that could allow an attacker to perform a session hijacking. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. Ref : Date: Tue, 6 May 2003 19:14:40 -0700 PDT From: Dave Palumb...

CommuniGate Pro Webmail 4.0.6 - Session Hijacking

!/usr/bin/perl Below is exploit code. Place it into cgi-bin, then recommended make symlink from DocumentRoot/AnyImage.gif to shj.pl, configure at least $url variable, and possible other vars and send victim HTML message with img src to your AnyImage.gif. When victim will read message, script will...

CommuniGatePro 4.0.6 [EXPLOIT]

Vulnerability in CommuniGatePro webmail under some circumstances may allow attacker to get access to users mailbox. Object: CommuniGatePro version 4.0.6 and earlier. Not vulnerable according to Stalker.com 4.1b2 with UseCookies option Vendor: Stalker Software Inc. www.stalker.com Description:...

CommuniGate Pro Referer Field Session Token Disclosure

The remote install of CommuniGate Pro, according to its version number, is vulnerable to a flaw that could allow a remote attacker to access the mailbox of a targeted user. To exploit such a flaw, an attacker needs to send an email to its victim with a link to an image hosted on a rogue server th...

CommuniGate Pro Webmail 4.0.6 - Session Hijacking

CommuniGate Pro Webmail 4.0.6 - Session Hijacking !/usr/bin/perl Below is exploit code. Place it into cgi-bin, then recommended make symlink from DocumentRoot/AnyImage.gif to shj.pl, configure at least $url variable, and possible other vars and send victim HTML message with img src to your...

Session Hijacking in CommunigatePro

In webmail interface session identifier is passed to server as a part of GET requiest, thouse may be discovered by third party via Referer: field...

CommuniGate Pro Webmail 4.0.6 Session Hijacking Exploit

Exploit for linux platform in category remote exploits ======================================================= CommuniGate Pro Webmail 4.0.6 Session Hijacking Exploit ======================================================= !/usr/bin/perl Below is exploit code. Place it into cgi-bin, then...

PHP-Nuke Splatt Forum 4.0 Module - HTML Injection

PHP-Nuke Splatt Forum 4.0 Module - HTML Injection source: https://www.securityfocus.com/bid/7484/info A problem with Splatt Forum could allow remote users to execute arbitrary code in the context of the web site running the Splatt Forum module. The problem occurs due to the lack of sanitization...

PHP-Nuke Splatt Forum 4.0 Module - HTML Injection

source: https://www.securityfocus.com/bid/7484/info A problem with Splatt Forum could allow remote users to execute arbitrary code in the context of the web site running the Splatt Forum module. The problem occurs due to the lack of sanitization performed on character representations of HTML tags...

Onecenter Forum 4.0 - IMG Tag Script Injection

Onecenter Forum 4.0 - IMG Tag Script Injection source: https://www.securityfocus.com/bid/7441/info OneCenter ForumOne 4.0 is a full-featured, web-based group discussion forum. A problem with Onecenter ForumOne could allow remote users to execute arbitrary code in the context of the web site hosti...

Onecenter Forum 4.0 - IMG Tag Script Injection

source: https://www.securityfocus.com/bid/7441/info OneCenter ForumOne 4.0 is a full-featured, web-based group discussion forum. A problem with Onecenter ForumOne could allow remote users to execute arbitrary code in the context of the web site hosting ForumOne. The problem occurs due to the lack...

CVE-2002-0872

l2tpd 0.67 does not initialize the random number generator, which allows remote attackers to hijack sessions...

CVE-2002-0872: Undefined Security Weakness

l2tpd 0.67 does not initialize the random number generator, which allows remote attackers to hijack sessions...

[SECURITY] [DSA 229-1] New IMP packages fix SQL injection

-------------------------------------------------------------------------- Debian Security Advisory DSA 229-1 [email protected] http://www.debian.org/security/ Martin Schulze January 15th, 2003 http://www.debian.org/security/faq -...

WebIntelligence session hijacking vulnerability

Ubizen Security Intelligence Lab Security Advisory SIL/03/001 ---------------------------------------- Product: WebIntelligencer Tested version: 2.7.1 Advisory date: Jan 09, 2003 Vulnerability type: session hijacking leading to remote unauthorized access Severity: High...

WebIntelligence session hijacking

Weak cookie generation mechanism allows session hijacking...

PHP-Nuke 6.0 - Multiple Cross-Site Scripting Vulnerabilities

PHP-Nuke 6.0 - Multiple Cross-Site Scripting Vulnerabilities source: https://www.securityfocus.com/bid/6409/info It has been discovered that multiple PHP scripts used by PHP-Nuke are vulnerable to cross-sitescripting attacks. Due to insufficient sanitization of web requests it is possible for...

vBulletin 2.0.x/2.2.x - 'members2.php' Cross-Site Scripting

source: https://www.securityfocus.com/bid/6246/info Due to insufficient sanitization of user supplied values, it is possible to exploit a vulnerability in VBulletin. By passing an invalid value to a variable located in 'members2.php', it is possible to generate an error page which will include...

CVE-2002-1150

The Remote Desktop Sharing RDS Screen Saver Protection capability for Microsoft NetMeeting 3.01 through SP2 4.4.3396 allows attackers with physical access to hijack remote sessions by entering certain logoff or shutdown sequences such as CTRL-ALT-DEL and canceling out of the resulting user...