CVE & Exploit Intelligence Database

CVE-2008-6128 EPSS 0.01

Session fixation vulnerability in moziloCMS 1.10.2 and earlier allows remote attackers to hijack web sessions by setting the PHPSESSID parameter.

CWE-287 Feb 13, 2009

CVE-2009-0360 1 PoC Analysis EPSS 0.00

Russ Allbery pam-krb5 before 3.13, when linked against MIT Kerberos, does not properly initialize the Kerberos libraries for setuid use, which allows local users to gain privileges by pointing an environment variable to a modified Kerberos configuration file, and then launching a PAM-based setuid application.

CWE-287 Feb 13, 2009

CVE-2009-0362 EPSS 0.01

filter.d/wuftpd.conf in Fail2ban 0.8.3 uses an incorrect regular expression that allows remote attackers to cause a denial of service (forced authentication failures) via a crafted reverse-resolved DNS name (rhost) entry that contains a substring that is interpreted as an IP address, a different vulnerability than CVE-2007-4321.

CWE-287 Feb 13, 2009

CVE-2009-0138 EPSS 0.02

servermgrd (Server Manager) in Apple Mac OS X 10.5.6 does not properly validate authentication credentials, which allows remote attackers to modify the system configuration.

CWE-287 Feb 13, 2009

CVE-2008-6118 2 PoCs Analysis EPSS 0.02

win/content/upload.php in Goople CMS 1.7 allows remote attackers to bypass authentication and gain administrative access by setting the loggedin cookie to 1.

CWE-287 Feb 11, 2009

CVE-2009-0461 2 PoCs Analysis EPSS 0.02

Whole Hog Password Protect: Enhanced 1.x allows remote attackers to bypass authentication and obtain administrative access via an integer value in the adminid cookie.

CWE-287 Feb 10, 2009

CVE-2009-0460 2 PoCs Analysis EPSS 0.02

Whole Hog Ware Support 1.x allows remote attackers to bypass authentication and obtain administrative access via an integer value in the adminid cookie.

CWE-287 Feb 10, 2009

CVE-2009-0492 EPSS 0.00

Unspecified vulnerability in SimpleIrcBot before 1.0 Stable has unknown impact and attack vectors related to an "auth vulnerability."

CWE-287 Feb 10, 2009

CVE-2008-6092 1 PoC Analysis EPSS 0.02

phpscripts Ranking Script allows remote attackers to bypass authentication and gain administrative access by sending an admin=ja cookie.

CWE-287 Feb 09, 2009

CVE-2002-2427 EPSS 0.00

The security handler in GoAhead WebServer before 2.1.1 allows remote attackers to bypass authentication and obtain access to protected web content via "an extra slash in a URL," a different vulnerability than CVE-2002-1603.

CWE-287 Feb 06, 2009

CVE-2009-0412 EPSS 0.00

The ProcessLogin function in class.auth.php in Interspire Shopping Cart (ISC) 4.0.1 Ultimate edition allows remote attackers to bypass authentication and obtain administrative access by reusing the RememberToken cookie after a failed admin login attempt.

CWE-287 Feb 03, 2009

CVE-2008-6045 1 PoC Analysis EPSS 0.01

Session fixation vulnerability in shopping_cart.php in xt:Commerce 3.0.4 and earlier allows remote attackers to hijack web sessions by setting the XTCsid parameter.

CWE-287 Feb 03, 2009

CVE-2008-6039 1 PoC Analysis EPSS 0.01

Session fixation vulnerability in BLUEPAGE CMS 2.5 and earlier allows remote attackers to hijack web sessions by setting the PHPSESSID parameter.

CWE-287 Feb 03, 2009

CVE-2008-5082 EPSS 0.00

The verifyProof function in the Token Processing System (TPS) component in Red Hat Certificate System (RHCS) 7.1 through 7.3 and Dogtag Certificate System 1.0 returns successfully even when token enrollment did not use the hardware key, which allows remote authenticated users with enrollment privileges to bypass intended authentication policies by performing enrollment with a software key.

CWE-287 Jan 30, 2009

CVE-2008-6009 1 PoC Analysis EPSS 0.02

SG Real Estate Portal 2.0 allows remote attackers to bypass authentication and gain administrative access by setting the Auth cookie to 1.

CWE-287 Jan 30, 2009

CVE-2009-0280 1 PoC Analysis EPSS 0.03

Asp Project Management 1.0 allows remote attackers to bypass authentication and gain administrative access by setting the crypt cookie to 1.

CWE-287 Jan 27, 2009

CVE-2008-5967 1 PoC Analysis EPSS 0.04

admin/index.php in PHP iCalendar 2.3.4, 2.24, and earlier does not require administrative authentication for an addupdate action, which allows remote attackers to upload a calendar (aka .ics) file with arbitrary content to the calendars/ directory outside the web root.

CWE-287 Jan 26, 2009

CVE-2008-5964 EPSS 0.01

Session fixation vulnerability in Social ImpressCMS before 1.1.1 RC1 allows remote attackers to hijack web sessions by setting the PHPSESSID parameter.

CWE-287 Jan 23, 2009

CVE-2009-0256 EPSS 0.01

Session fixation vulnerability in the authentication library in TYPO3 4.0.0 through 4.0.9, 4.1.0 through 4.1.7, and 4.2.0 through 4.2.3 allows remote attackers to hijack web sessions via unspecified vectors related to (1) frontend and (2) backend authentication.

CWE-287 Jan 22, 2009

CVE-2008-5945 1 PoC Analysis EPSS 0.02

Nukeviet 2.0 Beta allows remote attackers to bypass authentication and gain administrative access by setting the admf cookie to 1. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.

CWE-287 Jan 22, 2009