CVE-2006-0411

claroinitlocal.inc.php in Claroline 1.7.2 uses guessable session cookies MD5 hash of connection time, which allows remote attackers to hijack sessions and possibly gain administrative privileges...

Session fixation

claroinitlocal.inc.php in Claroline 1.7.2 uses guessable session cookies MD5 hash of connection time, which allows remote attackers to hijack sessions and possibly gain administrative privileges...

Microsoft Windows NT Null CIFS Sessions (CVE-2000-1200)

...

CVE-2005-1726

The CoreGraphics Window Server in Mac OS X 10.4.1 allows local users with console access to gain privileges by "launching commands into root sessions."...

CVE-2004-2558

Unspecified vulnerability in IBM Tivoli SecureWay Policy Director 3.8, Access Manager for e-business 3.9 to 5.1, Access Manager Identity Manager Solution 5.1, Configuration Manager 4.2, Configuration Manager for Automated Teller Machines 2.1.0, and IBM WebSphere Everyplace Server, Service Provide...

CVE-2002-2125

Internet Explorer 6.0 does not warn users when an expired certificate authority CA certificate is submitted to the user and a newer CA certificate is in the user's local repository, which could allow remote attackers to decrypt web sessions via a man-in-the-middle MITM attack...

CVE-2002-2125

In the provided documents, CVE-2002-2125 affects Internet Explorer 6.0 . The vulnerability occurs when an expired certificate authority (CA) certificate is submitted to the user while a newer CA certificate already exists in the local store, and IE does not warn the user. This can allow remote at...

CVE-2004-2424

BEA WebLogic Server and WebLogic Express 8.1 through 8.1 SP2 allow remote attackers to cause a denial of service network port consumption via unknown actions in HTTPS sessions, which prevents the server from releasing the network port when the session ends...

SUSE-SA:2005:039: zlib

The remote host is missing the patch for the advisory SUSE-SA:2005:039 zlib. A denial of service condition was fixed in the zlib library. Any program using zlib to decompress data can be crashed by a specially handcrafted invalid data stream. This includes web browsers or email programs able to...

CVE-2005-2150

Windows NT 4.0 and Windows 2000 before URP1 for Windows 2000 SP4 does not properly prevent NULL sessions from accessing certain alternate named pipes, which allows remote attackers to 1 list Windows services via svcctl or 2 read eventlogs via eventlog...

CVE-2005-2150

Windows NT 4.0 and Windows 2000 before URP1 for Windows 2000 SP4 does not properly prevent NULL sessions from accessing certain alternate named pipes, which allows remote attackers to 1 list Windows services via svcctl or 2 read eventlogs via eventlog...

CVE-2004-2182

Session fixation vulnerability in Macromedia JRun 4.0 allows remote attackers to hijack user sessions by pre-setting the user session ID information used by the session server...

CVE-2004-2182

CVE-2004-2182 (Macromedia JRun 4.0) describes a session fixation vulnerability where remote attackers can hijack user sessions by pre-setting the session ID information used by the session server. Public sources in the provided documents consistently identify JRun 4.0 as affected and cite the vul...

[Full-disclosure] NULL sessions vulnerabilities using alternate named pipes

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 NULL sessions vulnerabilities using alternate named pipes Hervй Schauer Consultants Security Advisory http://www.hsc.fr/ - - Summary - Advisory: NULL sessions vulnerabilities using alternate named pipes CVE identifier: CAN-2005-2150 Release date:...

CVE-2002-1942

Imatix Xitami 2.5 b5 is affected. The issue is that the product does not properly terminate certain Keep-Alive connections that have been broken or closed early, which can allow remote attackers to cause a denial of service (crash) through a large number of concurrent sessions. The vulnerability ...

CVE-2002-1746

Vtun 2.5b1 allows remote attackers to inject data into user sessions by sniffing and replaying packets...

CVE-2001-1505

tinc 1.0pre3 and 1.0pre4 allows remote attackers to inject data into user sessions by sniffing and replaying packets...

CVE-2002-1746

Affected software: Vtun 2.5b1. The CVE describes that remote attackers can inject data into user sessions by sniffing and replaying packets, enabling data injection into sessions. The provided documents do not specify a fix or patch version. No explicit exploitation details beyond the sniffing/re...

CVE-2002-1755

The CVE-2002-1755 entry concerns tinc VPN versions 1.0pre3 and 1.0pre4 that do not authenticate forwarded packets, enabling remote attackers to inject data into user sessions and potentially alter contents via CBC-related cut-and-paste. The root cause appears to be lack of authentication for forw...

CVE-2002-1747

Vulners notes CVE-2002-1747 affects Vtun 2.5b1, where lack of authentication for forwarded packets permits remote injection into user sessions and potential control of data contents via ECB-based cut-and-paste. This is the stated root cause and impact in connected sources; no remediation or patch...