Cross-subdomain cookie theft via scoping
A session cookie scoped to the parent domain is readable and settable by any subdomain, including one you can control.
Tag: session
Session fixation across the login boundary
If the session id is not rotated on authentication, an attacker who plants a known id before login rides the victim's session after.