Security Bulletin: IBM Sterling Connect:Express for UNIX browser UI is vulnerable to attacks that rely on the use of cookies without the SameSite attribute

Summary IBM Sterling Connect:Express for UNIX browser UI is vulnerable to attacks that rely on the use of cookies without the SameSite attribute Vulnerability Details CVEID:CVE-2023-29259 DESCRIPTION: IBM Sterling Connect:Express for UNIX browser UI is vulnerable to attacks that rely on the use o...

PT-2023-33025 · Npm +1 · Cookie-Session +1

Name of the Vulnerable Software and Affected Versions: Vendure affected versions not specified Description: The issue concerns the default cookie settings in Vendure, an e-commerce GraphQL framework, which are insecure due to the SameSite setting being false by default. This setting originates fr...

Missing Authorization

firefox is vulnerable to Missing Authorization. When storage of cookies is blocked, it is still possible to store data in local storage by using an iframe with a 'about.blank' source resulting in websites being able to store data without permission...

Nutanix AOS : (NXSA-AOS-6.5.3.5)

The version of AOS installed on the remote host is prior to 6.5.3.5. It is, therefore, affected by a vulnerability as referenced in the NXSA-AOS-6.5.3.5 advisory. - When using the RemoteIpFilter with requests received from a reverse proxy via HTTP that include the X-Forwarded-Proto header set to...

SUSE CVE-2023-3482

When Firefox is configured to block storage of all cookies, it was still possible to store data in localstorage by using an iframe with a source of 'about:blank'. This could have led to malicious websites storing tracking data without permission. This vulnerability affects Firefox 115...

Fedora 37 : firefox (2023-5c979c4971)

The remote Fedora 37 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2023-5c979c4971 advisory. - New upstream update 115.0 - Built with PGO Tenable has extracted the preceding description block directly from the Fedora security advisory. Note...

UBUNTU-CVE-2023-35934

yt-dlp is a command-line program to download videos from video sites. During file downloads, yt-dlp or the external downloaders that yt-dlp employs may leak cookies on HTTP redirects to a different host, or leak them when the host for download fragments differs from their parent manifest's host...

Design/Logic Flaw

yt-dlp is a command-line program to download videos from video sites. During file downloads, yt-dlp or the external downloaders that yt-dlp employs may leak cookies on HTTP redirects to a different host, or leak them when the host for download fragments differs from their parent manifest's host...

CVE-2023-35934 yt-dlp File Downloader cookie leak

yt-dlp is a command-line program to download videos from video sites. During file downloads, yt-dlp or the external downloaders that yt-dlp employs may leak cookies on HTTP redirects to a different host, or leak them when the host for download fragments differs from their parent manifest's host...

CVE-2023-35934

yt-dlp is a command-line program to download videos from video sites. During file downloads, yt-dlp or the external downloaders that yt-dlp employs may leak cookies on HTTP redirects to a different host, or leak them when the host for download fragments differs from their parent manifest's host...

yt-dlp 信息泄露漏洞

yt-dlp is based on the youtube-dl branch of the now-inactive youtube-dlc. An information disclosure vulnerability previously existed in yt-dlp version 2023.07.06, which stemmed from an external downloader used by the app that could leak cookies when HTTP redirected to other hosts...

Ubuntu: Security Advisory (USN-6201-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

CVE-2023-3482

When Firefox is configured to block storage of all cookies, it was still possible to store data in localstorage by using an iframe with a source of 'about:blank'. This could have led to malicious websites storing tracking data without permission. This vulnerability affects Firefox 115...

UBUNTU-CVE-2023-3482

When Firefox is configured to block storage of all cookies, it was still possible to store data in localstorage by using an iframe with a source of 'about:blank'. This could have led to malicious websites storing tracking data without permission. This vulnerability affects Firefox 115...

CVE-2023-3482

The CVE-2023-3482 issue affects Mozilla Firefox prior to version 115, where blocking all cookies does not prevent data exfiltration via localStorage using an iframe with src='about:blank'. This allows a malicious site to store tracking data in the local storage without permission, representing an...

Mozilla Firefox Security Advisory (MFSA2023-22) - Linux

The remote host is missing an update for Mozilla Firefox, announced via the advisory MFSA2023-22. SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-on...

CVE-2023-31999

CVE-2023-31999 affects all versions of @fastify/oauth2 due to a statically generated OAuth2 state parameter at startup, reused across requests for all users and sessions. This CSRF flaw could enable forged requests. The issue was addressed in v7.2.0, which switches to per-user state stored in a c...

Mozilla Firefox < 115.0

The version of Firefox installed on the remote Windows host is prior to 115.0. It is, therefore, affected by multiple vulnerabilities as referenced in the mfsa2023-22 advisory. - Memory safety bugs present in Firefox 114. Some of these bugs showed evidence of memory corruption and we presume that...

tough-cookie Prototype Pollution vulnerability

Versions of the package tough-cookie before 4.1.3 are vulnerable to Prototype Pollution due to improper handling of Cookies when using CookieJar in rejectPublicSuffixes=false mode. This issue arises from the manner in which the objects are initialized...

CVE-2023-26136

CVE-2023-26136 affects tough-cookie prior to 4.1.3. The issue is a Prototype Pollution vulnerability in CookieJar handling when rejectPublicSuffixes=false, arising from how objects are initialized. Impacted component: tough-cookie (node.js library). Reported root cause: improper object initializa...