CVE-2005-2306

LowCVSS 3.7/10Last modified Jun 16, 2026

Description

Race condition in Macromedia JRun 4.0, ColdFusion MX 6.1 and 7.0, when under heavy load, causes JRun to assign a duplicate authentication token to multiple sessions, which could allow authenticated users to gain privileges as other users.

Metrics

CVSS 2.0 3.7/10AV:L/AC:H/Au:N/C:P/I:P/A:P

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://secunia.com/advisories/16081Patch, Vendor Advisory
http://securitytracker.com/id?1014489
http://www.macromedia.com/devnet/security/security_zone/mpsb05-05.htmlPatch
http://secunia.com/advisories/16081Patch, Vendor Advisory
http://securitytracker.com/id?1014489
http://www.macromedia.com/devnet/security/security_zone/mpsb05-05.htmlPatch

Timeline

Published: Jul 19, 2005
Last modified: Jun 16, 2026
NVD status: Modified

Related CVEs from 2005

CVE-2005-23075.0netman.dll in Microsoft Windows Connections Manager Library allows local users to cause a denial of service (Network Connections Service cra CVE-2005-23087.5The JPEG decoder in Microsoft Internet Explorer allows remote attackers to cause a denial of service (CPU consumption or crash) and possibly CVE-2005-23095.0Opera 8.01 allows remote attackers to cause a denial of service (CPU consumption) via a crafted JPEG image, as demonstrated using random.jpg CVE-2005-23109.3Buffer overflow in Winamp 5.03a, 5.09 and 5.091, and other versions before 5.094, allows remote attackers to execute arbitrary code via an M CVE-2005-23112.1SMS 1.9.2m and earlier allows local users to overwrite arbitrary files via a symlink attack on the (1) request1 or (2) request2 temporary fi CVE-2005-23127.5management.php in Realnode Emilda 1.2.2 and earlier allows remote attackers to perform actions as other users by modifying the user_id param CVE-2005-23137.2Check Point SecuRemote NG with Application Intelligence R54 allows attackers to obtain credentials and gain privileges via unknown attack ve CVE-2005-23147.5inc.login.php in PHPsFTPd 0.2 through 0.4 allows remote attackers to obtain the administrator's username and password by setting the do_logi CVE-2005-23157.5Buffer overflow in Domain Name Relay Daemon (DNRD) before 2.19.1 allows remote attackers to execute arbitrary code via a large number of lar CVE-2005-23165.0Domain Name Relay Daemon (DNRD) before 2.19.1 allows remote attackers to cause a denial of service (infinite recursion) via a DNS packet tha CVE-2005-23177.5Shorewall 2.4.x before 2.4.1, 2.2.x before 2.2.5, and 2.0.x before 2.0.17, when MACLIST_TTL is greater than 0 or MACLIST_DISPOSITION is set CVE-2005-23184.3Cross-site scripting (XSS) vulnerability in showerr.asp in DVBBS 7.1 SP2 allows remote attackers to inject arbitrary web script or HTML via