ALSA-2024:5289 Moderate: mod_auth_openidc:2.3 security update

The modauthopenidc is an OpenID Connect authentication module for Apache HTTP Server. It enables an Apache HTTP Server to operate as an OpenID Connect Relying Party and/or OAuth 2.0 Resource Server. Security Fixes: modauthopenidc: DoS when using OIDCSessionType client-cookie and manipulating...

OESA-2024-1954 firefox security update

Mozilla Firefox is a standalone web browser, designed for standards compliance and performance. Its functionality can be enhanced via a plethora of extensions. Security Fixes:Mozilla Firefox is an open-source web browser, designed for standards compliance, performance and portability. Security...

Yoga Class Registration System 1.0 Cross Site Request Forgery

============================================================================================================================================= | Title : Yoga Class Registration System v1.0 CSRF Vulnerability | | Author : indoushka | | Tested on : windows 10 FrPro / browser : Mozilla firefox 128.0....

EulerOS 2.0 SP11 : python-pip (EulerOS-SA-2024-2110)

According to the versions of the python-pip packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : urllib3 is a user-friendly HTTP client library for Python. urllib3 doesn't treat the Cookie HTTP header special or provide any helpers for...

CVE-2024-33987

Cross-Site Scripting XSS vulnerability in School Attendance Monitoring System and School Event Management System affecting version 1.0. An attacker could create a specially crafted URL and send it to a victim to obtain details of their session cookie via the 'Attendance', 'attenddate', 'YearLevel...

CVE-2024-33985

Cross-Site Scripting XSS vulnerability in School Attendance Monitoring System and School Event Management System affecting version 1.0. An attacker could create a specially crafted URL and send it to a victim to obtain details of their session cookie via the 'View' parameter in '/course/index.php...

CVE-2024-33978

Cross-Site Scripting XSS vulnerability in E-Negosyo System affecting version 1.0. An attacker could create a specially crafted URL and send it to a victim to obtain their session cookie details via 'category' parameter in '/index.php'...

PT-2024-25620 · Unknown · School Management System +1

Name of the Vulnerable Software and Affected Versions: School Attendance Monitoring System and School Event Management System version 1.0 Description: A Cross-Site Scripting XSS issue allows an attacker to create a specially crafted URL and send it to a victim to obtain details of their session...

School Attendance Monitoring System和School Event Management System 跨站脚本漏洞

School Event Management System is a school event management system and School Attendance Monitoring System is a school attendance monitoring system. A cross-site scripting vulnerability exists in School Attendance Monitoring System and School Event Management System version 1.0. An attacker can...

School Attendance Monitoring System和School Event Management System 跨站脚本漏洞

School Event Management System is a school event management system and School Attendance Monitoring System is a school attendance monitoring system. A cross-site scripting vulnerability exists in School Attendance Monitoring System and School Event Management System version 1.0. An attacker can...

PayPal,Credit Card and Debit Card Payment 跨站脚本漏洞

PayPal,Credit Card and Debit Card Payment is a PayPal, Credit Card and Debit Card Payment software by janobe Personal Developer. A cross-site scripting vulnerability exists in PayPal,Credit Card and Debit Card Payment version 1.0. An attacker can create a specially crafted URL and send it to the...

PT-2024-25616 · Unknown · School Management System +1

Name of the Vulnerable Software and Affected Versions: School Attendance Monitoring System and School Event Management System version 1.0 Description: A Cross-Site Scripting XSS issue affects the system, allowing an attacker to create a specially crafted URL and send it to a victim. This could le...

PT-2024-25609 · Unknown · E-Negosyo System

Name of the Vulnerable Software and Affected Versions: E-Negosyo System version 1.0 Description: The issue is related to a Cross-Site Scripting XSS vulnerability. An attacker could create a specially crafted URL and send it to a victim to obtain their session cookie details via the view parameter...

Young Entrepreneur E-Negosyo System 跨站脚本漏洞

Young Entrepreneur E-Negosyo System is a Young Entrepreneur E-Negosyo System by janobe individual developers. A cross-site scripting vulnerability exists in Young Entrepreneur E-Negosyo System version 1.0. An attacker can create a specially crafted URL and send it to a victim to obtain their...

PayPal,Credit Card and Debit Card Payment 跨站脚本漏洞

PayPal,Credit Card and Debit Card Payment is a PayPal, Credit Card and Debit Card Payment software by janobe Personal Developer. A cross-site scripting vulnerability exists in PayPal,Credit Card and Debit Card Payment version 1.0. An attacker can create a specially crafted URL and send it to the...

nuxt vulnerable to Cross-site Scripting in navigateTo if used after SSR

Summary The navigateTo function attempts to blockthe javascript: protocol, but does not correctly use API's provided by unjs/ufo. This library also contains parsing discrepancies. Details The function first tests to see if the specified URL has a protocol. This uses the unjs/ufo package for URL...

PT-2024-25800 · Unjs/Ufo +1 · Unjs/Ufo +1

Name of the Vulnerable Software and Affected Versions: Nuxt versions prior to 3.12.4 Description: The navigateTo function does not correctly use APIs provided by unjs/ufo, leading to parsing discrepancies. The function first checks if a URL has a protocol using the unjs/ufo package, which works...

Exploit for Cross-site Scripting in Webcodingplace Ultimate_Classified_Listings

It is an exploit module/toolkit targeting a vulnerability in a s...

CVE-2024-33892

Insecure Permissions vulnerability in Cosy+ devices running a firmware 21.x below 21.2s10 or a firmware 22.x below 22.1s3 are susceptible to leaking information through cookies. This is fixed in version 21.2s10 and 22.1s3...

Google Chrome Adds App-Bound Encryption to Protect Cookies from Malware

Google has announced that it's adding a new layer of protection to its Chrome browser through what's called app-bound encryption to prevent information-stealing malware from grabbing cookies on Windows systems. "On Windows, Chrome uses the Data Protection API DPAPI which protects the data at rest...