CVE-2010-5067

MediumCVSS 6.8/10Last modified Jun 16, 2026

Description

Virtual War (aka VWar) 1.6.1 R2 uses static session cookies that depend only on a user's password, which makes it easier for remote attackers to bypass timeout and logout actions, and retain access for a long period of time, by leveraging knowledge of a session cookie.

Metrics

CVSS 2.0 6.8/10AV:N/AC:M/Au:N/C:P/I:P/A:P

Weakness enumeration

CWE-255

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://dmcdonald.net/vwar.txtExploit
http://seclists.org/fulldisclosure/2010/Aug/235Exploit
http://dmcdonald.net/vwar.txtExploit
http://seclists.org/fulldisclosure/2010/Aug/235Exploit

Timeline

Published: Oct 8, 2012
Last modified: Jun 16, 2026
NVD status: Modified

Related CVEs from 2010

CVE-2010-50684.3The Cascading Style Sheets (CSS) implementation in Opera 10.5 does not properly handle the :visited pseudo-class, which allows remote attack CVE-2010-50694.3The Cascading Style Sheets (CSS) implementation in Google Chrome 4 does not properly handle the :visited pseudo-class, which allows remote a CVE-2010-50705.0The JavaScript implementation in Apple Safari 4 does not properly restrict the set of values contained in the object returned by the getComp CVE-2010-50715.0The JavaScript implementation in Microsoft Internet Explorer 8.0 and earlier does not properly restrict the set of values contained in the o CVE-2010-50725.0The JavaScript implementation in Opera 10.5 does not properly restrict the set of values contained in the object returned by the getComputed CVE-2010-50735.0The JavaScript implementation in Google Chrome 4 does not properly restrict the set of values contained in the object returned by the getCom CVE-2010-50744.3The layout engine in Mozilla Firefox before 4.0, Thunderbird before 3.3, and SeaMonkey before 2.1 executes different code for visited and un CVE-2010-50752.1Integer overflow in aswFW.sys 5.0.594.0 in Avast! Internet Security 5.0 Korean Trial allows local users to cause a denial of service (memory CVE-2010-50764.3QSslSocket in Qt before 4.7.0-rc1 recognizes a wildcard IP address in the subject's Common Name field of an X.509 certificate, which might a CVE-2010-50777.8server/sv_main.c in Quake3 Arena, as used in ioquake3 before r1762, OpenArena, Tremulous, and other products, allows remote attackers to cau CVE-2010-50785.0SilverStripe 2.3.x before 2.3.10 and 2.4.x before 2.4.4 stores sensitive information under the web root with insufficient access control, wh CVE-2010-50795.0SilverStripe 2.3.x before 2.3.10 and 2.4.x before 2.4.4 uses weak entropy when generating tokens for (1) the CSRF protection mechanism, (2)