CVE-2025-7654 Multiple Plugins By FunnelKit <= (Various Versions) - Authenticated (Contributor+) Sensitive Information Exposure to Privilege Escalation via Woofunnel Library

Multiple FunnelKit plugins are vulnerable to Sensitive Information Exposure via the wfgetcookie shortcode. This makes it possible for authenticated attackers, with Contributor-level access and above, to extract sensitive data including authentication cookies of other site users, which may make...

CLSA-2025-1747058667 golang: Fix of 2 CVEs

CVE-2024-45336: fix potential sending of sensitive headers in chain of redirections - CVE-2023-45289: fix potential sending of sensitive headers and cookies on IPv6 zones...

PT-2024-9851 · Jetbrains · Teamcity

Name of the Vulnerable Software and Affected Versions: JetBrains TeamCity versions prior to 2024.12 Description: The issue is related to the exposure of user credentials and session cookies in backup files. This is due to incorrect removal of critical data. An attacker could exploit this to revea...

The vulnerability of the Session Cookie Handler component of the Ragic Enterprise Cloud Database platform allows a hacker to obtain user session cookies.

The vulnerability of the Session Cookie Handler component of the Ragic Enterprise Cloud Database platform’s tool for creating customizable databases is related to the lack of authentication for the critical function. Exploiting this vulnerability could allow a malicious actor to obtain user sessi...

PT-2024-40259 · Passbolt · Passbolt

Name of the Vulnerable Software and Affected Versions: Passbolt affected versions not specified Description: The issue concerns the /auth/verify.json endpoint, which returns a JSON containing the cookies sent in the request. This could allow an attacker who exploits an XSS vulnerability to retrie...

OESA-2023-1908 python-twisted security update

Twisted is an event-based framework for internet applications, supporting Python 2.7 and Python 3.5+. It includes modules for many different purposes, including the following: Security Fixes: twisted is an event-driven networking engine written in Python. In affected versions twisted exposes...

SUSE CVE-2015-2330

Late TLS certificate verification in WebKitGTK+ prior to 2.6.6 allows remote attackers to view a secure HTTP request, including, for example, secure cookies...

SUSE CVE-2016-3100

kinit in KDE Frameworks before 5.23.0 uses weak permissions 644 for /tmp/xauth-xxx-y, which allows local users to obtain X11 cookies of other users and consequently capture keystrokes and possibly gain privileges by reading the file...

SUSE CVE-2022-1655

An Incorrect Permission Assignment for Critical Resource flaw was found in Horizon on Red Hat OpenStack. Horizon session cookies are created without the HttpOnly flag despite HorizonSecureCookies being set to true in the environmental files, possibly leading to a loss of confidentiality and...

SUSE CVE-2022-21712

twisted is an event-driven networking engine written in Python. In affected versions twisted exposes cookies and authorization headers when following cross-origin redirects. This issue is present in the twited.web.RedirectAgent and twisted.web. BrowserLikeRedirectAgent functions. Users are advise...

Mozilla: Cross-Site Tracing was possible via non-standard override headers

The Mozilla Foundation Security Advisory describes this flaw as: Cross-Site Tracing occurs when a server will echo a request back via the Trace method, allowing an XSS attack to access to authorization headers and cookies inaccessible to JavaScript such as cookies protected by HTTPOnly. To mitiga...

Vulnerability of functions twited.web.RedirectAgent and twisted.web.BrowserLikeRedirectAgent in the Twisted web framework, allowing attackers to access confidential data

The vulnerability of the twisted.web.RedirectAgent and twisted.web.BrowserLikeRedirectAgent functions in the Twisted web framework relates to the disclosure of cookies and authentication headers during redirects between sources. Exploiting this vulnerability allows a remote attacker to gain acces...

CVE-2021-27778

HCL Traveler is vulnerable to a cross-site scripting XSS caused by improper validation of the Name parameter for Approved Applications in the Traveler administration web pages. An attacker could exploit this vulnerability to execute a malicious script to access any cookies, session tokens, or oth...

GHSA-6H5X-7C5M-7CR7 Exposure of Sensitive Information in eventsource

When fetching an url with a link to an external site Redirect, the users Cookies & Autorisation headers are leaked to the third party application. According to the same-origin-policy, the header should be "sanitized."...

CVE-2022-0770

The Translate WordPress with GTranslate WordPress plugin before 2.9.9 does not have CSRF check in some files, and write debug data such as user's cookies in a publicly accessible file if a specific parameter is used when requesting them. Combining those two issues, an attacker could gain access t...

CVE-2022-24737 Exposure of Sensitive Information to an Unauthorized Actor in httpie

HTTPie is a command-line HTTP client. HTTPie has the practical concept of sessions, which help users to persistently store some of the state that belongs to the outgoing requests and incoming responses on the disk for further usage. Before 3.1.0, HTTPie didn‘t distinguish between cookies and host...

DEBIAN-CVE-2022-21712

twisted is an event-driven networking engine written in Python. In affected versions twisted exposes cookies and authorization headers when following cross-origin redirects. This issue is present in the twited.web.RedirectAgent and twisted.web. BrowserLikeRedirectAgent functions. Users are advise...

AZL-8505 CVE-2022-21712 affecting package python-twisted for versions less than 22.2.0-1

twisted is an event-driven networking engine written in Python. In affected versions twisted exposes cookies and authorization headers when following cross-origin redirects. This issue is present in the twited.web.RedirectAgent and twisted.web. BrowserLikeRedirectAgent functions. Users are advise...

UBUNTU-CVE-2022-21712

twisted is an event-driven networking engine written in Python. In affected versions twisted exposes cookies and authorization headers when following cross-origin redirects. This issue is present in the twited.web.RedirectAgent and twisted.web. BrowserLikeRedirectAgent functions. Users are advise...

Twisted 信息泄露漏洞

Twisted is an event-driven open source web engine written in Python. An information disclosure vulnerability exists in Twisted that originates from exposing cookies and authorization information during cross-origin redirects...