Zoom Client for Meetings < 5.10.0 Vulnerability (ZSB-22007)

The version of Zoom Client for Meetings installed on the remote host is prior to 5.10.0. It is, therefore, affected by a vulnerability as referenced in the ZSB-22007 advisory. - The Zoom Client for Meetings for Android, iOS, Linux, macOS, and Windows before version 5.10.0 fails to properly...

Malicious code in reload-update-cookies-ahref.com (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 376faca1de1f4e86cd9a30d3fc06721ffa353f7e48526e5fc3935840bf7bf839 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-5740 Malicious code in reload-update-cookies-ahref.com (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 376faca1de1f4e86cd9a30d3fc06721ffa353f7e48526e5fc3935840bf7bf839 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Mozilla: Cross-Site Tracing was possible via non-standard override headers

The Mozilla Foundation Security Advisory describes this flaw as: Cross-Site Tracing occurs when a server will echo a request back via the Trace method, allowing an XSS attack to access to authorization headers and cookies inaccessible to JavaScript such as cookies protected by HTTPOnly. To mitiga...

Mozilla: ServiceWorker-intercepted requests bypassed SameSite cookie policy

The Mozilla Foundation Security Advisory describes this flaw as: When a ServiceWorker intercepted a request with FetchEvent, the origin of the request was lost after the ServiceWorker took ownership of it. This had the effect of negating SameSite cookie protections. This was addressed in the spec...

Mozilla: Cross-Site Tracing was possible via non-standard override headers

The Mozilla Foundation Security Advisory describes this flaw as: Cross-Site Tracing occurs when a server will echo a request back via the Trace method, allowing an XSS attack to access to authorization headers and cookies inaccessible to JavaScript such as cookies protected by HTTPOnly. To mitiga...

Mozilla: ServiceWorker-intercepted requests bypassed SameSite cookie policy

The Mozilla Foundation Security Advisory describes this flaw as: When a ServiceWorker intercepted a request with FetchEvent, the origin of the request was lost after the ServiceWorker took ownership of it. This had the effect of negating SameSite cookie protections. This was addressed in the spec...

Information Disclosure

thorsten/phpmyfaq is vulnerable to information disclosure.The vulnerability exists in the setCookie function of session.php due to insecure HTTP cookies without the 'secure' attribute which allows an attacker to gain access to sensitive information...

FreeBSD : phpmyfaq -- multiple vulnerabilities (439f3f81-7a49-11ed-97ac-589cfc0f81b0)

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the 439f3f81-7a49-11ed-97ac-589cfc0f81b0 advisory. - phpmyfaq developers report: an authenticated SQL injection when adding categories in the admin backen...

GHSA-WPGC-5CR5-H9GG phpMyFAQ has insecure HTTP cookies

phpMyFAQ is contains Sensitive Cookie in HTTPS Session Without 'Secure' Attribute in versions prior to 3.1.9...

phpMyFAQ has insecure HTTP cookies

phpMyFAQ is contains Sensitive Cookie in HTTPS Session Without 'Secure' Attribute in versions prior to 3.1.9...

U.S. Dept Of Defense: Reflected XSS on ██████.mil

A reflected XSS vulnerability was discovered on a military website, allowing an attacker to fetch cookies/tokens from any website requiring login by using a CORS bug if the site is vulnerable to CORS. The vulnerability was exploitable by injecting a script into the search bar...

phpMyFAQ 安全漏洞

phpMyFAQ is a multilingual, fully database-driven FAQ system by Thorsten Rinne, an individual developer. A security vulnerability exists in phpMyFAQ versions prior to 3.1.9, which stems from the absence of a "secure" attribute for sensitive cookies in HTTPS sessions...

phpmyfaq -- multiple vulnerabilities

phpmyfaq developers report: an authenticated SQL injection when adding categories in the admin backend a stored cross-site scripting vulnerability in the category name a stored cross-site scripting vulnerability in the admin logging a stored cross-site scripting vulnerability in the FAQ title a...

Amazon Linux AMI : curl (ALAS-2022-1646)

The version of curl installed on the remote host is prior to 7.61.1-12.101. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS-2022-1646 advisory. A vulnerability was found in curl. This security flaw allows reusing OAUTH2-authenticated connections without properly...

Planet Enterprises Planet eStream SQL注入漏洞

Planet Enterprises Planet eStream is a very simple and secure tool from Planet Enterprises, Inc. It makes video more accessible to students and staff at all levels of education. A SQL injection vulnerability exists in Planet Enterprises Planet eStream versions prior to 6.72.10.07, which was...

curl: Incorrect handling of control code characters in cookies

A vulnerability found in curl. This security flaw happens when curl is used to retrieve and parse cookies from an HTTPS server, where it accepts cookies using control codes byte values below 32, and also when cookies that contain such control codes are later sent back to an HTTPS server, possibly...

curl: Unpreserved file permissions

A vulnerability was found in curl. This issue occurs because when curl saves cookies, alt-svc, and HSTS data to local files, it makes the operation atomic by finalizing the process with a rename from a temporary name to the final target file name. This flaw leads to unpreserved file permissions,...

curl: Unpreserved file permissions

A vulnerability was found in curl. This issue occurs because when curl saves cookies, alt-svc, and HSTS data to local files, it makes the operation atomic by finalizing the process with a rename from a temporary name to the final target file name. This flaw leads to unpreserved file permissions,...

curl: Incorrect handling of control code characters in cookies

A vulnerability found in curl. This security flaw happens when curl is used to retrieve and parse cookies from an HTTPS server, where it accepts cookies using control codes byte values below 32, and also when cookies that contain such control codes are later sent back to an HTTPS server, possibly...