cookie accepts cookie name path and domain with out of bounds characters

...

quarkus-vertx-http: a cross-site attack may be initiated which might lead to the Information Disclosure

A flaw was found in Quarkus. If the Quarkus Form Authentication session cookie Path attribute is set to /, then a cross-site attack may be initiated, which might lead to information disclosure...

SUSE CVE-2007-1362

Mozilla Firefox 1.5.x before 1.5.0.12 and 2.x before 2.0.0.4, and SeaMonkey 1.0.9 and 1.1.2, allows remote attackers to cause a denial of service via 1 a large cookie path parameter, which triggers memory consumption, or 2 an internal delimiter within cookie path or name values, which could trigg...

quarkus-vertx-http: a cross-site attack may be initiated which might lead to the Information Disclosure

A flaw was found in Quarkus. If the Quarkus Form Authentication session cookie Path attribute is set to /, then a cross-site attack may be initiated, which might lead to information disclosure...

CVE-2022-41158

Eyoom Builder (Eyoom) contains a path traversal/remote code execution flaw. Affects versions prior to 4.5.4; vulnerability arises from using cookie values as file paths, enabling remote attackers to execute or inject code. Reported across multiple feeds (CNNVD/CVE entries). Remediation cited: upd...

Eyoom Builder 路径遍历漏洞

Eyoom Builder is a builder from the Korean company Eyoom. A path traversal vulnerability exists in Eyoom Builder versions prior to 4.5.4, which originates from remote code execution using a cookie value as the path to a file, and can be exploited by remote attackers to execute or inject malicious...

in getgrav/grav

✍️ Description Developers often set cookies to be accessible from the root context path "/". Doing so exposes the cookie to all web applications on the domain. Since cookies often carry sensitive information such as session identifiers, sharing cookies across applications can lead a vulnerability...

Security Bulletin: IBM Cloud Automation Manager is affected by an issue with insecure cookie path attribute (CVE-2019-4616)

Summary IBM Cloud Automation Manager does not set the secure attribute on authorization tokens or session cookies. Vulnerability Details CVEID: CVE-2019-4616 DESCRIPTION: IBM Cloud Automation Manager does not set the secure attribute on authorization tokens or session cookies. Attackers may be ab...

CVE-2019-7267

Linear eMerge 50P/5000P devices allow Cookie Path Traversal...

CVE-2019-7267

Linear eMerge 50P/5000P devices allow Cookie Path Traversal...

Path traversal

Linear eMerge 50P/5000P devices allow Cookie Path Traversal...

CVE-2019-7267

Linear eMerge 50P/5000P devices allow Cookie Path Traversal...

PT-2019-18497 · Linear · Linear Emerge 50P/5000P

Name of the Vulnerable Software and Affected Versions: Linear eMerge 50P/5000P devices affected versions not specified Description: The issue allows Cookie Path Traversal, which may lead to unauthorized access or data manipulation. No information is provided about the estimated number of...

CVE-2019-7267: Improper Limitation of a Pathname to a Restricted Directory

Linear eMerge 50P/5000P devices allow Cookie Path Traversal...

Security Bulletin: Session Identifier Not Updated vulnerability in GDS component of IBM InfoSphere Master Data Management - Collaborative Edition (CVE-2014-3009)

Summary IBM InfoSphere Master Data Management - Collaborative Edition does not update the session identifier after a successful authentication. An attacker could exploit this vulnerability to gain unauthorized access to the application by acting as the session created by a regular user...

Fedora 23 : phpMyAdmin (2016-9df3915036)

phpMyAdmin 4.6.3 2016-06-23 ============================= This version includes many security fixes that are announced as PMASA-2016-17 through PMASA-2016-28 which are posted at https://www.phpmyadmin.net/security/ Furthermore, version 4.6.3 includes the regularly scheduled maintenance improvemen...

cURL / libcURL 7.x < 7.42.0 Multiple Vulnerabilities

Binary data 8863.prm...

FreeBSD : cURL -- multiple vulnerabilities (6294f75f-03f2-11e5-aab1-d050996490d0)

cURL reports : libcurl keeps a pool of its last few connections around after use to facilitate easy, convenient, and completely transparent connection re-use for applications. When doing HTTP requests NTLM authenticated, the entire connection becomes authenticated and not just the specific HTTP...

Fedora 21 : curl-7.37.0-14.fc21 (2015-6728)

require credentials to match for NTLM re-use CVE-2015-3143 - fix invalid write with a zero-length host name in URL CVE-2015-3144 - fix invalid write in cookie path sanitization code CVE-2015-3145 - close Negotiate connections when done CVE-2015-3148 Note that Tenable Network Security has...

Ubuntu 14.04 LTS : curl vulnerabilities (USN-2591-1)

The remote Ubuntu 14.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-2591-1 advisory. Paras Sethia discovered that curl could incorrectly re-use NTLM HTTP credentials when subsequently connecting to the same host over HTTP. CVE-2015-3143...