CVE-2002-1746

Affected software: Vtun 2.5b1. The CVE describes that remote attackers can inject data into user sessions by sniffing and replaying packets, enabling data injection into sessions. The provided documents do not specify a fix or patch version. No explicit exploitation details beyond the sniffing/re...

CVE-2002-1747

Vulners notes CVE-2002-1747 affects Vtun 2.5b1, where lack of authentication for forwarded packets permits remote injection into user sessions and potential control of data contents via ECB-based cut-and-paste. This is the stated root cause and impact in connected sources; no remediation or patch...

CVE-2002-1755

The CVE-2002-1755 entry concerns tinc VPN versions 1.0pre3 and 1.0pre4 that do not authenticate forwarded packets, enabling remote attackers to inject data into user sessions and potentially alter contents via CBC-related cut-and-paste. The root cause appears to be lack of authentication for forw...

CVE-2002-1747

Vtun 2.5b1 does not authenticate forwarded packets, which allows remote attackers to inject data into user sessions without detection, and possibly control the data contents via cut-and-paste attacks on ECB...

CVE-2001-1505

tinc 1.0pre3 and 1.0pre4 allows remote attackers to inject data into user sessions by sniffing and replaying packets...

CVE-2002-1747

Vtun 2.5b1 does not authenticate forwarded packets, which allows remote attackers to inject data into user sessions without detection, and possibly control the data contents via cut-and-paste attacks on ECB...

CVE-2002-1746

Vtun 2.5b1 allows remote attackers to inject data into user sessions by sniffing and replaying packets...

CVE-2005-1722

Unknown vulnerability in the CoreGraphics Window Server for Mac OS X 10.4.x up to 10.4.1 allows local users to inject arbitrary commands into root sessions...

ACROS Security: HTML Injection in BEA WebLogic Server Console (1)

=====BEGIN-ACROS-REPORT===== PUBLIC ========================================================================= ACROS Security Problem Report 2005-05-24-1 ------------------------------------------------------------------------- ASPR 2005-05-24-1: HTML Injection in BEA WebLogic Server Console 1...

CVE-2005-0839

Linux kernel 2.6 before 2.6.11 does not restrict access to the NMOUSE line discipline for a TTY, which allows local users to gain privileges by injecting mouse or keyboard events into other user sessions...

CVE-2001-1476

SSH before 2.0, with RC4 encryption and the "disallow NULL passwords" option enabled, makes it easier for remote attackers to guess portions of user passwords by replaying user sessions with certain modifications, which trigger different messages depending on whether the guess is correct or not...

Windows 2003 Server DoS vulnerabilities

DoS on network operation during high CPU load, on printing in terminal sessions...

photopost50rc3.txt

PhotoPost 5.0RC3, All Enthusiast, Inc, multiple vulnerabilities March 05 2005 For your consideration. 1. BACKGROUND PhotoPost is a popular commercial image publishing software. Everyone loves showing off their photos! Add PhotoPost to your site, or let us install it for you, and your visitors wil...

CVE-2004-1527: Undefined Security Weakness

Microsoft Internet Explorer 6.0 SP1 does not properly handle certain character strings in the Path attribute, which can cause it to modify cookies in other domains when the attacker's domain name is within the target's domain name or when wildcard DNS is being used, which allows remote attackers ...

Ingate Firewall disabled user PPTP disconnection problem

Then user is disabled active PPTP sessions are not disconnected...

CVE-2004-2424

BEA WebLogic Server and WebLogic Express 8.1 through 8.1 SP2 allow remote attackers to cause a denial of service network port consumption via unknown actions in HTTPS sessions, which prevents the server from releasing the network port when the session ends...

CVE-2004-0462

The built-in web servers for multiple networking devices do not set the Secure attribute for sensitive cookies in HTTPS sessions, which could cause the user agent to send those cookies in plaintext over an HTTP session with the same server...

CVE-2004-1219

PaFileDB

CVE-2004-1219: Undefined Security Weakness

paFileDB 3.1, when using sessions authentication and while the administrator logs on, allows remote attackers to read the administrator's password hash and conduct brute force password guessing attacks by listing the contents of the sessions directory and reading the associated file for the...

paFileDB sessions Directory Admin Hashed Password Disclosure

According to its version number, the remote installation of paFileDB is vulnerable to an attack that would allow the attacker to view the password hash of user accounts, including an administrator account, by making a direct request to the application's 'sessions' directory. This could allow an...