PYSEC-2023-192

urllib3 is a user-friendly HTTP client library for Python. urllib3 doesn't treat the Cookie HTTP header special or provide any helpers for managing cookies over HTTP, that is the responsibility of the user. However, it is possible for a user to specify a Cookie header and unknowingly leak...

Information disclosure

urllib3 is a user-friendly HTTP client library for Python. urllib3 doesn't treat the Cookie HTTP header special or provide any helpers for managing cookies over HTTP, that is the responsibility of the user. However, it is possible for a user to specify a Cookie header and unknowingly leak...

UBUNTU-CVE-2023-43804

urllib3 is a user-friendly HTTP client library for Python. urllib3 doesn't treat the Cookie HTTP header special or provide any helpers for managing cookies over HTTP, that is the responsibility of the user. However, it is possible for a user to specify a Cookie header and unknowingly leak...

CVE-2023-43804

urllib3 is a user-friendly HTTP client library for Python. urllib3 doesn't treat the Cookie HTTP header special or provide any helpers for managing cookies over HTTP, that is the responsibility of the user. However, it is possible for a user to specify a Cookie header and unknowingly leak...

CVE-2023-43804

CVE-2023-43804 affects the Python urllib3 library, where a Cookie header may be leaked across cross-origin redirects if redirects are not disabled. The issue is resolved in urllib3 1.26.17 or 2.0.5. Affected environments are confirmed in multiple reports, including AlmaLinux and Brocade advisorie...

CVE-2023-43804

urllib3 is a user-friendly HTTP client library for Python. urllib3 doesn't treat the Cookie HTTP header special or provide any helpers for managing cookies over HTTP, that is the responsibility of the user. However, it is possible for a user to specify a Cookie header and unknowingly leak...

CVE-2023-43804: Exposure of Sensitive Information to an Unauthorized Actor

urllib3 is a user-friendly HTTP client library for Python. urllib3 doesn't treat the Cookie HTTP header special or provide any helpers for managing cookies over HTTP, that is the responsibility of the user. However, it is possible for a user to specify a Cookie header and unknowingly leak...

`Cookie` HTTP header isn't stripped on cross-origin redirects

urllib3 doesn't treat the Cookie HTTP header special or provide any helpers for managing cookies over HTTP, that is the responsibility of the user. However, it is possible for a user to specify a Cookie header and unknowingly leak information via HTTP redirects to a different origin if that user...

GHSA-V845-JXX5-VC9F `Cookie` HTTP header isn't stripped on cross-origin redirects

urllib3 doesn't treat the Cookie HTTP header special or provide any helpers for managing cookies over HTTP, that is the responsibility of the user. However, it is possible for a user to specify a Cookie header and unknowingly leak information via HTTP redirects to a different origin if that user...

PT-2023-7669

Name of the Vulnerable Software and Affected Versions urllib3 versions prior to 1.26.17 urllib3 versions prior to 2.0.5 Description The issue is related to the handling of the Cookie HTTP header in urllib3, a user-friendly HTTP client library for Python. If a user specifies a Cookie header and do...

Exploit for CVE-2018-9995

CVE-2018-9995 Exploit Tool for Python3 This Python script is d...

Exploit for CVE-2018-9995

CVE-2018-9995 - DVR Authentication Bypass This repository add...

python-future: remote attackers can cause denial of service via crafted Set-Cookie header from malicious web server

A denial of service flaw was found in Python Charmers Future. This flaw allows an attacker to send a specially crafted Set-Cookie header in an HTTP request, resulting in a loss of system availability...

PT-2023-9252 · Actiontec · Actiontec Wcb6200Q

Name of the Vulnerable Software and Affected Versions: Actiontec WCB6200Q affected versions not specified Description: This issue allows network-adjacent attackers to execute arbitrary code on affected installations of Actiontec WCB6200Q routers. The flaw exists within the HTTP server, where a...

flask: Possible disclosure of permanent session cookie due to missing Vary: Cookie header

A flaw was found in the Python Flask package. A cached response may contain data for one client sent by a proxy to other clients, including session cookies, resulting in the compromise of data confidentiality contained in the leak requests or cookies. This happens when the following conditions ar...

flask: Possible disclosure of permanent session cookie due to missing Vary: Cookie header

A flaw was found in the Python Flask package. A cached response may contain data for one client sent by a proxy to other clients, including session cookies, resulting in the compromise of data confidentiality contained in the leak requests or cookies. This happens when the following conditions ar...

mod_auth_openidc core dump when OIDCStripCookies is set and an empty Cookie header is supplied

...

The vulnerability of the control panel of the microprogrammed software for DVR devices TBK DVR4104 and TBK DVR4216 allows intruders to bypass security restrictions and gain unauthorized access to protected information.

The vulnerability of the control panel of the microprogrammed software for DVR devices TBK DVR4104 and TBK DVR4216 lies in the lack of measures to neutralize special elements during the processing of the Cookie header: uid=admin. Exploiting this vulnerability allows a remote attacker to bypass...

SUSE CVE-2023-30861

Flask is a lightweight WSGI web application framework. When all of the following conditions are met, a response containing data intended for one client may be cached and subsequently sent by the proxy to other clients. If the proxy also caches Set-Cookie headers, it may send one client's session...

Information Disclosure

flask is vulnerable to Information Disclosure. The vulnerability exists due to the missing Vary cookie header in the savesession function of sessions.py, which leads to the disclosure of the session cookie, or sending data to a client who did not make the request...