Description

IIS 4.0 and 5.0 .ASP pages send the same Session ID cookie for secure and insecure web sessions, which could allow remote attackers to hijack the secure web session of the user if that user moves to an insecure session, aka the "Session ID Cookie Marking" vulnerability.

Remediation

References

CVE-2000-0970

Related Vulnerabilities

MySQL CVE-2010-3834 Vulnerability (CVE-2010-3834)

WordPress Plugin ZoomSounds-WordPress Wave Audio Player with Playlist Arbitrary File Upload (2.0)

PostgreSQL Improper Restriction of Operations within the Bounds of a Memory Buffer Vulnerability (CVE-2002-1401)

Plone CMS Improper Control of Generation of Code ('Code Injection') Vulnerability (CVE-2012-5485)

WordPress Plugin WP Easy Columns Cross-Site Scripting (2.1.3)

Severity

High

Classification

CVE-2000-0970

Tags

Missing Update Known Vulnerabilities