SUSE CVE-2022-40958

By injecting a cookie with certain special characters, an attacker on a shared subdomain which is not a secure context could set and thus overwrite cookies from a secure context, leading to session fixation and other attacks. This vulnerability affects Firefox ESR 102.3, Thunderbird 102.3, and...

SUSE CVE-2022-45410

When a ServiceWorker intercepted a request with FetchEvent, the origin of the request was lost after the ServiceWorker took ownership of it. This had the effect of negating SameSite cookie protections. This was addressed in the spec and then in browsers. This vulnerability affects Firefox ESR...

SUSE CVE-2022-45413

Using the S.browserfallbackurl parameter parameter, an attacker could redirect a user to a URL and cause SameSite=Strict cookies to be sent.This issue only affects Firefox for Android. Other operating systems are not affected.. This vulnerability affects Firefox 107...

SUSE CVE-2023-22792

A regular expression based DoS vulnerability in Action Dispatch 6.0.6.1, 6.1.7.1, and 7.0.4.1. Specially crafted cookies, in combination with a specially crafted XFORWARDEDHOST header can cause the regular expression engine to enter a state of catastrophic backtracking. This can cause the process...

Artica PFMS Pandora FMS 跨站脚本漏洞

Artica Pandora FMS is a monitoring system from the Spanish company Artica. The system monitors networks, servers, virtual infrastructures, applications, etc. in a visual way. A security vulnerability exists in Artica PFMS Pandora FMS version v765, which stems from improper neutralization of user...

CVE-2022-45436 Stored cross-site scripting vulnerability in network maps editor feature

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Artica PFMS Pandora FMS v765 on all platforms, allows Cross-Site Scripting XSS. As a manager privilege user , create a network map containing name as xss payload. Once created, admin user must clic...

Security Bulletin: IBM CICS TX Standard is vulnerable to allowing attackers access to an application via insecure session cookies (CVE-2022-34313).

Summary IBM CICS TX Standard could allow attackers to access an application via insecure session cookies. The fix removes this vulnerability CVE-2022-34313 from IBM CICS TX Standard. Vulnerability Details CVEID:CVE-2022-34313 DESCRIPTION: IBM CICS TX does not set the secure attribute on...

Security Bulletin: IBM CICS TX Advanced is vulnerable to allowing an attacker to access an application via insecure session cookies (CVE-2022-34313).

Summary IBM CICS TX Advanced could allow an attacker access to an application via insecure session cookies. The fix removes this vulnerability CVE-2022-34313 from IBM CICS TX Advanced. Vulnerability Details CVEID:CVE-2022-34313 DESCRIPTION: IBM CICS TX does not set the secure attribute on...

DEBIAN-CVE-2023-23934

Werkzeug is a comprehensive WSGI web application library. Browsers may allow "nameless" cookies that look like =value instead of key=value. A vulnerable browser may allow a compromised application on an adjacent subdomain to exploit this to set a cookie like =Host-test=bad for another subdomain...

AZL-13589 CVE-2023-23934 affecting package python-werkzeug for versions less than 2.2.3-1

Werkzeug is a comprehensive WSGI web application library. Browsers may allow "nameless" cookies that look like =value instead of key=value. A vulnerable browser may allow a compromised application on an adjacent subdomain to exploit this to set a cookie like =Host-test=bad for another subdomain...

PYSEC-2023-57

Werkzeug is a comprehensive WSGI web application library. Browsers may allow "nameless" cookies that look like =value instead of key=value. A vulnerable browser may allow a compromised application on an adjacent subdomain to exploit this to set a cookie like =Host-test=bad for another subdomain...

PYSEC-2023-57

Werkzeug is a comprehensive WSGI web application library. Browsers may allow "nameless" cookies that look like =value instead of key=value. A vulnerable browser may allow a compromised application on an adjacent subdomain to exploit this to set a cookie like =Host-test=bad for another subdomain...

CVE-2023-23934

Werkzeug is a comprehensive WSGI web application library. Browsers may allow "nameless" cookies that look like =value instead of key=value. A vulnerable browser may allow a compromised application on an adjacent subdomain to exploit this to set a cookie like =Host-test=bad for another subdomain...

UBUNTU-CVE-2023-23934

Werkzeug is a comprehensive WSGI web application library. Browsers may allow "nameless" cookies that look like =value instead of key=value. A vulnerable browser may allow a compromised application on an adjacent subdomain to exploit this to set a cookie like =Host-test=bad for another subdomain...

CVE-2023-23934 Wrkzeug's incorrect parsing of nameless cookies leads to __Host- cookies bypass

Werkzeug is a comprehensive WSGI web application library. Browsers may allow "nameless" cookies that look like =value instead of key=value. A vulnerable browser may allow a compromised application on an adjacent subdomain to exploit this to set a cookie like =Host-test=bad for another subdomain...

CVE-2023-23934 Wrkzeug's incorrect parsing of nameless cookies leads to __Host- cookies bypass

Werkzeug is a comprehensive WSGI web application library. Browsers may allow "nameless" cookies that look like =value instead of key=value. A vulnerable browser may allow a compromised application on an adjacent subdomain to exploit this to set a cookie like =Host-test=bad for another subdomain...

U.S. Dept Of Defense: Reflected XSS in ██████

A reflected XSS vulnerability was found on one of the subdomains of a system. The vulnerability was located in the emailbody parameter of the PreviewLetterhead.aspx page. An attacker could exploit this vulnerability to execute malicious scripts and steal user's cookies, launch phishing attacks, a...

SA44114 - 2019-04: Out-of-Cycle Advisory: Pulse Desktop Client and Network Connect improper handling of session cookies (CVE-2019-11213)

Ivanti 4th of March 2024 - This isn't an active SA and any new edits are part of an article maintenance project. Under certain conditions, the Pulse Desktop Client and Network Connect could allow an attacker to access session tokens to replay and spoof sessions, and as a result, gain unauthorized...

Pallets Werkzeug 输入验证错误漏洞

Pallets Werkzeug is a WSGI web application library. A security vulnerability exists in Pallets Werkzeug versions prior to 2.2.3, which stems from the possibility that browsers may allow "nameless" cookies that look like "=value" instead of "key=value". "no-name" cookies that look like "=value"...

openSUSE 15 Security Update : SUSE Manager Client Tools (SUSE-SU-2023:0353-1)

The remote openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2023:0353-1 advisory. dracut-saltboot: - Update to version 0.1.1673279145.e7616bd Add failsafe stop file when salt-minion does not stop bsc1172110 Copy existing wicked...