9440 matches found
CVE-2023-33847 IBM CICS TX information disclosure
IBM TXSeries for Multiplatforms 8.1, 8.2, 9.1, CICS TX Standard, 11.1, CICS TX Advanced 10.1, and 11.1 does not set the secure attribute on authorization tokens or session cookies. Attackers may be able to get the cookie values by sending a http:// link to a user or by planting this link in a sit...
CVE-2023-33847
IBM TXSeries for Multiplatforms (versions 8.1–9.1) and IBM CICS TX Standard/Advanced (TX Standard 11.1; TX Advanced 10.1–11.1) expose a vulnerability where authorization tokens and session cookies are issued without the Secure attribute. This allows an attacker to obtain cookie values by luring a...
IBM CICS TX Standard and Advanced 安全漏洞
IBM CICS TX Standard and Advanced is a comprehensive, single transaction runtime package from International Business Machines IBM, Inc. It can provide a cloud-native deployment model for standalone applications. A security vulnerability exists in IBM TXSeries for Multiplatforms, IBM CICS TX...
flask: Possible disclosure of permanent session cookie due to missing Vary: Cookie header
A flaw was found in the Python Flask package. A cached response may contain data for one client sent by a proxy to other clients, including session cookies, resulting in the compromise of data confidentiality contained in the leak requests or cookies. This happens when the following conditions ar...
[SECURITY] Fedora 38 Update: curl-8.0.1-2.fc38
curl is a command line tool for transferring data with URL syntax, supporting FTP, FTPS, HTTP, HTTPS, SCP, SFTP, TFTP, TELNET, DICT, LDAP, LDAPS, FILE, IMA P, SMTP, POP3 and RTSP. curl supports SSL certificates, HTTP POST, HTTP PUT, FTP uploading, HTTP form based upload, proxies, cookies,...
Important: python-flask
Issue Overview: Flask is a lightweight WSGI web application framework. When all of the following conditions are met, a response containing data intended for one client may be cached and subsequently sent by the proxy to other clients. If the proxy also caches Set-Cookie headers, it may send one...
WordPress Plugin photo-gallery 跨站脚本漏洞
WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL. A cross-site scripting vulnerability exists in WordPress Photo Gallery, which can be exploited by an attacker to execute script in a victim's web...
The vulnerability of the ABB eSOMS software for managing production processes allows a attacker to carry out XSS attacks.
The vulnerability of the ABB eSOMS production process management software is related to the absence of the “HttpOnly” flag in session cookie files. Exploiting this vulnerability allows a remote attacker to perform XSS attacks...
The vulnerability of the ABB eSOMS software for managing production processes allows a hacker to gain unauthorized access to protected information.
The vulnerability of the ABB eSOMS production process management software lies in the absence of a “Secure” flag in the session cookies files. Exploiting this vulnerability could allow an unauthorized attacker to gain unauthorized access to protected information...
flask: Possible disclosure of permanent session cookie due to missing Vary: Cookie header
A flaw was found in the Python Flask package. A cached response may contain data for one client sent by a proxy to other clients, including session cookies, resulting in the compromise of data confidentiality contained in the leak requests or cookies. This happens when the following conditions ar...
TikTok: CRLF to XSS & Open Redirection
Due to inadequate input validation, a vulnerability allowed for the injection of CRLF HTTP Response Splitting into a parameter on a TikTok seller endpoint. This could have resulted in Reflective XSS Cross-Site Scripting and open redirection attacks. The vulnerability has been resolved...
CVE-2023-29547
When a secure cookie existed in the Firefox cookie jar an insecure cookie for the same domain could have been created, when it should have silently failed. This could have led to a desynchronization in expected results when reading from the secure cookie. This vulnerability affects Firefox for...
PT-2023-3996 · Unknown · Cloudpanel
Name of the Vulnerable Software and Affected Versions: CloudPanel versions 2.0.0 through 2.3.0 CloudPanel version 2.3.0 Description: The issue is related to insufficient access control in the File Manager component of CloudPanel, specifically when handling clp-fm cookie files without verifying...
CLSA-2023-1685378052 curl: Fix of 2 CVEs
CVE-2022-43552: smb/telnet: do not free the protocol struct in done - CVE-2022-35252: cookie: reject cookies with "control bytes"...
Ubuntu 20.04 LTS / 22.04 LTS / 23.04 : Flask vulnerability (USN-6111-1)
The remote Ubuntu 20.04 LTS / 22.04 LTS / 23.04 host has a package installed that is affected by a vulnerability as referenced in the USN-6111-1 advisory. It was discovered that Flask incorrectly handled certain data responses. An attacker could possibly use this issue to expose sensitive...
Design/Logic Flaw
ntpd-rs is an NTP implementation written in Rust. ntpd-rs does not validate the length of NTS cookies in received NTP packets to the server. An attacker can crash the server by sending a specially crafted NTP packet containing a cookie shorter than what the server expects. The server also crashes...
CVE-2023-33192 Improper handling of NTS cookie length that could crash the ntpd-rs server
ntpd-rs is an NTP implementation written in Rust. ntpd-rs does not validate the length of NTS cookies in received NTP packets to the server. An attacker can crash the server by sending a specially crafted NTP packet containing a cookie shorter than what the server expects. The server also crashes...
Nextcloud Server 25.0.2 < 25.0.6, 26.0.x < 26.0.1 Insufficient Session Expiration Vulnerability (GHSA-q8c4-chpj-6v38)
Nextcloud Server is prone to an insufficient session expiration vulnerability. SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...
PT-2023-24209 · Ntpd-Rs · Ntpd-Rs
Name of the Vulnerable Software and Affected Versions: ntpd-rs versions prior to 0.3.3 Description: ntpd-rs does not validate the length of NTS cookies in received NTP packets to the server. An attacker can crash the server by sending a specially crafted NTP packet containing a cookie shorter tha...
