9440 matches found
phpMyFAQ vulnerable to Stored Cross-site Scripting
phpMyFAQ prior to version 3.1.13 has a stored cross site scripting vulnerability in name field in add question module. This allows an attacker to steal user cookies...
GHSA-F55R-8RCV-MQCF Concrete CMS missing secure cookie parameters
Concrete CMS previously concrete5 before 9.2 does not have Secure and HTTP only attributes set for ccmPoll cookies...
CVE-2023-28472
Concrete CMS previously concrete5 versions 8.5.12 and below, and 9.0 through 9.1.3 does not have Secure and HTTP only attributes set for ccmPoll cookies...
Code injection
Concrete CMS previously concrete5 versions 8.5.12 and below, and 9.0 through 9.1.3 does not have Secure and HTTP only attributes set for ccmPoll cookies...
MAL-2023-1 Malicious code in @hyperion-util/cookies (npm)
--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis e0ab5ff4c024f4310299914d0f443ad8ed3a4559be8770d8ed79485650e783b8 The OpenSSF Package Analysis project identified '@hyperion-util/cookies' @ 77.77.79 npm as malicious. It is considered malicious because: - The...
Malicious code in @hyperion-util/cookies (npm)
--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis e0ab5ff4c024f4310299914d0f443ad8ed3a4559be8770d8ed79485650e783b8 The OpenSSF Package Analysis project identified '@hyperion-util/cookies' @ 77.77.79 npm as malicious. It is considered malicious because: - The...
NETGEAR SRX5308 跨站脚本漏洞
The NETGEAR SRX5308 is a VPN firewall appliance from NETGEAR. The NETGEAR SRX5308 suffers from a cross-site scripting vulnerability that originates from a misuse of the parameter ntp.server2. The vulnerability can be exploited by an attacker to obtain sensitive information such as user cookies...
NETGEAR SRX5308 跨站脚本漏洞
The NETGEAR SRX5308 is a VPN firewall appliance from NETGEAR. The NETGEAR SRX5308 suffers from a cross-site scripting vulnerability that originates from incorrect manipulation of the parameter smtpServer.toAddr. The vulnerability can be exploited by an attacker to obtain sensitive information suc...
NETGEAR SRX5308 跨站脚本漏洞
The NETGEAR SRX5308 is a VPN firewall appliance from NETGEAR. The NETGEAR SRX5308 suffers from a cross-site scripting vulnerability that originates from an incorrect operation of the parameter IpsecIKEPolicy.IKEPolicyName. The vulnerability can be exploited by an attacker to obtain sensitive...
CVE-2023-28472
Concrete CMS previously concrete5 versions 8.5.12 and below, and 9.0 through 9.1.3 does not have Secure and HTTP only attributes set for ccmPoll cookies...
CVE-2023-28472
Concrete CMS (formerly concrete5) has a cookie security issue: the ccmPoll cookie lacks Secure and HttpOnly attributes in versions 8.5.12 and below, and 9.0–9.1.3. This could allow session access/unauthorized actions. The issue is fixed in 9.2+; apply the official patch or upgrade to 9.2 or later...
PT-2023-21742 · Unknown · Concrete Cms
Name of the Vulnerable Software and Affected Versions: Concrete CMS previously concrete5 versions 8.5.12 and below Concrete CMS previously concrete5 versions 9.0 through 9.1.3 Description: The issue is related to the ccmPoll cookies in Concrete CMS, where the Secure and HTTP only attributes are n...
GHSA-CJV6-W5HF-5WR6 Cross-site Scripting (XSS) in Ecommerce Pricing Rules name field
Impact This vulnerability has the potential to steal a user's cookie and gain unauthorized access to that user's account through the stolen cookie or redirect users to other malicious sites. Patches Update to version 10.5.21 or apply this patch manually...
PT-2023-18930 · Pimcore · Pimcore
Name of the Vulnerable Software and Affected Versions: pimcore/pimcore versions prior to 10.5.21 Description: The issue allows malicious JavaScript to access all the same objects as the rest of the web page, including access to cookies and local storage, which are often used to store session...
GHSA-4WFQ-JC9H-VPCX Lack of domain validation in Druple core
The Media oEmbed iframe route does not properly validate the iframe domain setting, which allows embeds to be displayed in the context of the primary domain. Under certain circumstances, this could lead to cross-site scripting, leaked cookies, or other vulnerabilities. Drupal 7 core does not...
CVE-2022-25276
The Media oEmbed iframe route does not properly validate the iframe domain setting, which allows embeds to be displayed in the context of the primary domain. Under certain circumstances, this could lead to cross-site scripting, leaked cookies, or other vulnerabilities...
Cross site scripting
The Media oEmbed iframe route does not properly validate the iframe domain setting, which allows embeds to be displayed in the context of the primary domain. Under certain circumstances, this could lead to cross-site scripting, leaked cookies, or other vulnerabilities...
CVE-2022-25276
The Media oEmbed iframe route does not properly validate the iframe domain setting, which allows embeds to be displayed in the context of the primary domain. Under certain circumstances, this could lead to cross-site scripting, leaked cookies, or other vulnerabilities...
CVE-2022-25276
The Media oEmbed iframe route does not properly validate the iframe domain setting, which allows embeds to be displayed in the context of the primary domain. Under certain circumstances, this could lead to cross-site scripting, leaked cookies, or other vulnerabilities...
