9444 matches found
CVE-2022-27779
libcurl wrongly allows cookies to be set for Top Level Domains TLDs if thehost name is provided with a trailing dot.curl can be told to receive and send cookies. curl's "cookie engine" can bebuilt with or without Public Suffix Listawareness. If PSL support not provided, a more rudimentary check...
CVE-2022-27779
libcurl wrongly allows cookies to be set for Top Level Domains TLDs if thehost name is provided with a trailing dot.curl can be told to receive and send cookies. curl's "cookie engine" can bebuilt with or without Public Suffix Listawareness. If PSL support not provided, a more rudimentary check...
CVE-2022-27779
libcurl wrongly allows cookies to be set for Top Level Domains TLDs if thehost name is provided with a trailing dot.curl can be told to receive and send cookies. curl's "cookie engine" can bebuilt with or without Public Suffix Listawareness. If PSL support not provided, a more rudimentary check...
CVE-2021-27778
HCL Traveler is vulnerable to a cross-site scripting XSS caused by improper validation of the Name parameter for Approved Applications in the Traveler administration web pages. An attacker could exploit this vulnerability to execute a malicious script to access any cookies, session tokens, or oth...
The vulnerability of the microprogramming software for the Desigo DXR2, PXC3, PXC4, and PXC5 unit stations involves the absence of the “Secure”, “HttpOnly”, or “SameSite” flags in the session cookie files. This allows a malicious actor to gain unauthorized access to protected information.
The vulnerability of the microprogramming software for the Desigo DXR2, PXC3, PXC4, and PXC5 station modules is related to the absence of the “Secure”, “HttpOnly”, or “SameSite” flags in the session cookies files. Exploiting this vulnerability can allow an attacker to gain unauthorized access to...
What Do Those Pesky 'Cookie Preferences' Pop-Ups Really Mean?
We asked the engineer who invented cookies what they mean and how to handle them...
Guzzle Information Disclosure Vulnerability
Guzzle is a PHP HTTP client for guzzle individual developers that makes it easy to send HTTP requests and easily integrate with web services. An information disclosure vulnerability exists in Guzzle versions prior to 7.4.3, and prior to 6.5.6, which stems from a vulnerability that allows a...
PT-2022-23726 · Ivanti · Ivanti Avalanche
Name of the Vulnerable Software and Affected Versions: Ivanti Avalanche version 6.3.3.101 Description: This issue allows remote attackers to read arbitrary files on affected installations. Although authentication is required to exploit this issue, the existing authentication mechanism can be...
PT-2022-19740 · Linglong · Linglong
Name of the Vulnerable Software and Affected Versions: Linglong version 1.0 Description: An access control issue allows attackers to access the background of the application via a crafted cookie. Recommendations: For Linglong version 1.0, consider restricting access to sensitive areas of the...
Ivanti Avalanche AgentTaskHandler Directory Traversal Information Disclosure Vulnerability
This vulnerability allows remote attackers to read arbitrary files on affected installations of Ivanti Avalanche. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed. The specific flaw exists within the AgentTaskHandler class. T...
Guzzle 信息泄露漏洞
Guzzle is a PHP HTTP client for guzzle individual developers that makes it easy to send HTTP requests and easily integrate with web services. An information disclosure vulnerability exists in Guzzle versions prior to 7.4.3, and prior to 6.5.6, which stems from a vulnerability that allows a...
ZKEACMS Cross-Site Scripting Vulnerability
ZKEACMS v3.5.2 is a cross-site scripting vulnerability that can be exploited by attackers to inject malicious JavaScript programs to steal other users' cookies, etc...
WordPress plugin Advanced Contact form 7 DB 跨站脚本漏洞
WordPress and WordPress plugin are both products of the WordPress Foundation. WordPress is a set of blogging platforms developed using the PHP language. WordPress Advanced Contact form 7 DB 1.8.7 and its previous versions have a cross-site scripting vulnerability, which can be exploited by...
PT-2022-19495 · Guzzle · Guzzle
Name of the Vulnerable Software and Affected Versions: Guzzle versions prior to 6.5.6 and 7.4.3 Description: The issue is related to the cookie middleware in Guzzle, a PHP HTTP client. It does not check if the cookie domain equals the domain of the server that sets the cookie via the Set-Cookie...
GHSA-47WC-P5CP-W7PW Exposure of Sensitive Information to an Unauthorized Actor in Jenkins
Jenkins 2.196 and earlier, LTS 2.176.3 and earlier printed the value of the "Cookie" HTTP request header on the /whoAmI/ URL, allowing attackers exploiting another XSS vulnerability to obtain the HTTP session cookie despite it being marked HttpOnly...
Smashing Cross-site Scripting vulnerability
Smashing 1.3.4 is vulnerable to Cross Site Scripting XSS. A URL for a widget can be crafted and used to execute JavaScript on the victim's computer. The JavaScript code can then steal data available in the session/cookies depending on the user environment e.g. if re-using internal URL's for...
GHSA-254J-MMC5-QHPX Smashing Cross-site Scripting vulnerability
Smashing 1.3.4 is vulnerable to Cross Site Scripting XSS. A URL for a widget can be crafted and used to execute JavaScript on the victim's computer. The JavaScript code can then steal data available in the session/cookies depending on the user environment e.g. if re-using internal URL's for...
Magento DOM-based Cross-Site Scripting vulnerability on mage-messages cookies
Magento versions 2.4.2 and earlier, 2.4.1-p1 and earlier and 2.3.6-p1 and earlier are affected by a DOM-based Cross-Site Scripting vulnerability on mage-messages cookies. Successful exploitation could lead to arbitrary JavaScript execution by an unauthenticated attacker. User interaction is...
GHSA-39CH-RG26-GMQ5 Magento DOM-based Cross-Site Scripting vulnerability on mage-messages cookies
Magento versions 2.4.2 and earlier, 2.4.1-p1 and earlier and 2.3.6-p1 and earlier are affected by a DOM-based Cross-Site Scripting vulnerability on mage-messages cookies. Successful exploitation could lead to arbitrary JavaScript execution by an unauthenticated attacker. User interaction is...