9437 matches found
PT-2024-35166 · Unopim · Unopim
Name of the Vulnerable Software and Affected Versions: UnoPim versions prior to 0.1.5 Description: A vulnerability exists in the Create User process, allowing the creation of a new admin account with an option to upload a profile image. An attacker can upload a malicious SVG file containing an...
mod_auth_openidc: DoS when using `OIDCSessionType client-cookie` and manipulating cookies
A flaw was found in modauthopenidc, an OpenID Certified™ authentication and authorization module for the Apache HTTP server. Missing input validation in the modauthopenidcsessionchunks cookie value can make the server vulnerable to a denial of service attack. This issue may allow a remote attacke...
EulerOS 2.0 SP10 : python3 (EulerOS-SA-2024-2892)
According to the versions of the python3 packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : An issue was found in the CPython zipfile module affecting versions 3.12.1, 3.11.7, 3.10.13, 3.9.18, and 3.8.18 and prior. The zipfile module is...
CVE-2024-30142
HCL BigFix Compliance is affected by a missing secure flag on a cookie, enabling cookie theft via XSS and potentially unauthorized access or cookies transmitted over unencrypted channels. The CVE refers to vulnerability in product HCL BigFix Compliance (reported as 2024-30142) and is corroborated...
IBM Concert Trust Management Issues Vulnerability (CNVD-2024-49175)
IBM Concert is a new tool from International Business Machines IBM Inc. that uses generative AI to help manage complex cloud-native applications. A trust management issue vulnerability exists in IBM Concert versions 1.0.0 and 1.0.1 that stems from vulnerability to attacks that rely on the use of...
HCL BigFix Compliance 安全漏洞
HCL BigFix Compliance is a continuous monitoring and application of endpoint security settings by HCL USA to ensure compliance with regulatory or organizational security policies. A security vulnerability exists in HCL BigFix Compliance version v2.0.11, which stems from being affected by a missin...
GHSA-HV6M-QJ65-26Q3 UnoPim Cross-site Scripting vulnerability
UnoPim 0.1.3 and below is vulnerable to Cross Site Scripting XSS in the Create User function. The vulnerability allows attackers to perform XSS in SVG file extension, which can be used to stealing cookies...
Warning: Hackers could take over your email account by stealing cookies, even if you have MFA
The Federal Bureau of Investigation FBI has issued a warning that cybercriminals are taking over email accounts via stolen session cookies, allowing them to bypass the multi-factor authentication MFA a user has set up. Here's how it works. Most of us don’t think twice about checking the “Remember...
RHEL 7 : openstack-manila-ui (RHSA-2016:2116)
The remote Redhat Enterprise Linux 7 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2016:2116 advisory. OpenStack's File Share Service manila provides the means to easily provision shared file systems that can be consumed by multiple instances. These...
Advanced Browser Data Extraction for Chromium and Gecko Browsers
This post-exploitation module extracts sensitive browser data from both Chromium-based and Gecko-based browsers on the target system. It supports the decryption of passwords and cookies using Windows Data Protection API DPAPI and can extract additional data such as browsing history, keyword searc...
Guizhou small code technology limited company jpress exist file upload vulnerability
jpress is a complete Java CMS web management system. Ltd. jpress has a file upload vulnerability, which can be exploited by attackers to obtain sensitive information such as user cookies by uploading files...
The vulnerability of the Session Cookie Handler component of the Ragic Enterprise Cloud Database platform allows a hacker to obtain user session cookies.
The vulnerability of the Session Cookie Handler component of the Ragic Enterprise Cloud Database platform’s tool for creating customizable databases is related to the lack of authentication for the critical function. Exploiting this vulnerability could allow a malicious actor to obtain user sessi...
The vulnerability of the http.cookies library in the Python programming language allows a hacker to trigger a service failure.
The vulnerability of the http.cookies library in the Python interpreter relates to the use of a regular expression with high computational complexity. Exploiting this vulnerability could allow an attacker, operating remotely, to cause service interruptions...
Chinese Hackers Use CloudScout Toolset to Steal Session Cookies from Cloud Services
A government entity and a religious organization in Taiwan were the target of a China-linked threat actor known as Evasive Panda that infected them with a previously undocumented post-compromise toolset codenamed CloudScout. "The CloudScout toolset is capable of retrieving data from various cloud...
PT-2024-31043 · Apple · Ipados +6
Name of the Vulnerable Software and Affected Versions: Safari versions prior to 18.1 visionOS versions prior to 2.1 tvOS versions prior to 18.1 iOS versions prior to 18.1 iPadOS versions prior to 18.1 watchOS versions prior to 11.1 Description: A cookie management issue was addressed with improve...
CVE-2024-9598
The AMP for WP – Accelerated Mobile Pages plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.99.1. This is due to missing or incorrect nonce validation on the 'proxy' function. This makes it possible for unauthenticated attackers to send the...
Security update for go1.21-openssl
This update for go1.21-openssl fixes the following issues: CVE-2024-24791: Fixed denial of service due to improper 100-continue handling bsc1227314 CVE-2024-24789: Fixed mishandling of corrupt central directory record in archive/zip bsc1225973 CVE-2024-24790: Fixed unexpected behavior from Is...
CVE-2024-43177
IBM Concert 1.0.0 and 1.0.1 vulnerable to attacks that rely on the use of cookies without the SameSite attribute...
CVE-2024-43177
CVE-2024-43177 affects IBM Concert Software versions 1.0.0–1.0.1, with the root cause described as cookies being used without the SameSite attribute. Public sources note the vulnerability could enable attacks related to cookie handling, and the NVD metrics show a critical impact (base score 9.8 i...
