PT-2023-22082 · Sveltekit · Sveltekit

Name of the Vulnerable Software and Affected Versions: SvelteKit versions prior to 1.15.2 Description: The SvelteKit framework provides out-of-the-box cross-site request forgery CSRF protection. However, this protection can be bypassed in versions prior to 1.15.2 by specifying an upper-cased...

K10065173: TMM TLS virtual server vulnerability CVE-2019-6593

Security Advisory Description A BIG-IP virtual server configured with a Client SSL profile may be vulnerable to a chosen ciphertext attack against CBC ciphers. When exploited, this may result in plaintext recovery of encrypted messages through a man-in-the-middle MITM attack, despite the attacker...

WordPress plugin Ezoic has a cross-site scripting vulnerability

WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL. A cross-site scripting vulnerability exists in WordPress Ezoic 2.8.8 and earlier versions, which stems from a lack of effective filtering and...

Password Storage Application Cross-Site Script Vulnerability

Password Storage Application is a password storage application. A cross-site scripting vulnerability exists in the Carlo Montero Password Storage Application, which stems from a lack of effective filtering and escaping of user-supplied data on the settings page, and can be exploited by an attacke...

Cookie Leakage in Proxy in Grafana

Grafana is an open source observability and data visualization platform. Starting with version 5.0.0-beta1 and prior to versions 8.5.14 and 9.1.8, Grafana could leak the authentication cookie of users to plugins. The vulnerability impacts data source and plugin proxy endpoints under certain...

YTStealer targets YouTube content creators

Researchers are reporting the discovery of malware targeting YouTub content creators. The aim is to compromise accounts and then take over the victims channels completely. The malware, dubbed YTStealer, has one game plan: Grabbing authentication cookies. A site gives you an authentication cookie...

New YTStealer Malware Aims to Hijack Accounts of YouTube Content Creators

Cybersecurity researchers have documented a new information-stealing malware that targets YouTube content creators by plundering their authentication cookies. Dubbed "YTStealer" by Intezer, the malicious tool is likely believed to be sold as a service on the dark web, with it distributed using fa...

DEBIAN-CVE-2022-24758

The Jupyter notebook is a web-based notebook environment for interactive computing. Prior to version 6.4.9, unauthorized actors can access sensitive information from server logs. Anytime a 5xx error is triggered, the auth cookie and other header values are recorded in Jupyter server logs by...

PT-2022-16860 · Unknown +3 · Jupyter Notebook +3

Name of the Vulnerable Software and Affected Versions: Jupyter notebook versions prior to 6.4.9 Description: The Jupyter notebook is a web-based notebook environment for interactive computing. Prior to version 6.4.9, unauthorized actors can access sensitive information from server logs. Anytime a...

DEBIAN-CVE-2022-24757

The Jupyter Server provides the backend i.e. the core services, APIs, and REST endpoints for Jupyter web applications. Prior to version 1.15.4, unauthorized actors can access sensitive information from server logs. Anytime a 5xx error is triggered, the auth cookie and other header values are...

CVE-2020-4879

IBM Cognos Controller 10.4.0, 10.4.1, and 10.4.2 could allow a remote attacker to bypass security restrictions, caused by improper validation of authentication cookies. IBM X-Force ID: 190847...

CVE-2020-4879

CVE-2020-4879 affects IBM Cognos Controller 10.4.0, 10.4.1, and 10.4.2, where improper validation of authentication cookies could allow a remote attacker to bypass security restrictions. Connected sources confirm the vulnerability is tied to cookie handling and describe the remediation: IBM Cogno...

CVE-2020-4879

IBM Cognos Controller 10.4.0, 10.4.1, and 10.4.2 could allow a remote attacker to bypass security restrictions, caused by improper validation of authentication cookies. IBM X-Force ID: 190847...

Crime Shop Sells Hacked Logins to Other Crime Shops

Up for the "Most Meta Cybercrime Offering" award this year is Accountz Club, a new cybercrime store that sells access to purloined accounts at services built for cybercriminals, including shops peddling stolen payment cards and identities, spamming tools, email and phone bombing services, and tho...

CVE-2020-4879: Improper Authentication

IBM Cognos Controller 10.4.0, 10.4.1, and 10.4.2 could allow a remote attacker to bypass security restrictions, caused by improper validation of authentication cookies. IBM X-Force ID: 190847...

PT-2022-2573

Name of the Vulnerable Software and Affected Versions IBM Cognos Controller versions 10.4.0 through 10.4.2 Description The issue is related to improper validation of authentication cookies, which could allow a remote attacker to bypass security restrictions. This may impact the confidentiality,...

WordPress Pie Register 3.7.1.4 Plugin - Admin Privilege Escalation Vulnerability

Exploit Title: WordPress Plugin Pie Register 3.7.1.4 - Admin Privilege Escalation Unauthenticated Google Dork: inurl:/plugins/pie-register/ Exploit Author: Lotfi13-DZ Vendor Homepage: https://wordpress.org/plugins/pie-register/ Software Link:...

Vulnerability fixed in IBM Aspera

A vulnerability has been fixed in IBM Aspera. The vulnerability allows a remote malicious party to perform a Cross-Site Scripting attack and thereby steal authentication cookies. IBM has released updates to fix the vulnerability. More information can be found on the page below:...

FileBrowser Cross-Site Scripting Vulnerability (CNVD-2025-22709)

FileBrowser is an open source web file browser . Provides a file management interface in a specified directory , can be used to upload , delete , preview , rename and edit your files . FileBrowser suffers from a cross-site scripting vulnerability that is caused by improper validation of...

Unspecified Vulnerability in Wordpress MStore API

Wordpress MStore API is Wordpress open source an application plugin . Provides a configuration for Mstore, FluxStore mobile devices and support RestAPI to connect to the application features . MStore API WordPress plugin version 3.2.0 before the existence of a security vulnerability that can be...