CVE-2022-23607 Unsafe handling of user-specified cookies in treq

treq is an HTTP library inspired by requests but written on top of Twisted's Agents. Treq's request methods treq.get, treq.post, etc. and treq.client.HTTPClient constructor accept cookies as a dictionary. Such cookies are not bound to a single domain, and are therefore sent to every domain...

CVE-2022-23607

treq is an HTTP library inspired by requests but written on top of Twisted's Agents. Treq's request methods treq.get, treq.post, etc. and treq.client.HTTPClient constructor accept cookies as a dictionary. Such cookies are not bound to a single domain, and are therefore sent to every domain...

GHSA-FHPF-PP6P-55QC Unsafe handling of user-specified cookies in treq

Impact Treq's request methods treq.get, treq.post, HTTPClient.request, HTTPClient.get, etc. accept cookies as a dictionary, for example: py treq.get'https://example.com/', cookies='session': '1234' Such cookies are not bound to a single domain, and are therefore sent to every domain "supercookies...

PT-2022-16122 · Treq +1 · Treq +1

Name of the Vulnerable Software and Affected Versions: treq versions prior to 2021.1.0 Description: The treq library's request methods treq.get, treq.post, etc. and treq.client.HTTPClient constructor accept cookies as a dictionary. These cookies are not bound to a single domain and are sent to...

Cross-site Scripting (XSS)

remdex/livehelperchat is vulnerable to stored cross-site scripting. The vulnerability exists due to improper sanitization of the name field in embedcode.tpl.php which allows an attacker to steal user cookies and execute arbitrary scripts...

Cross-site Scripting (XSS)

calibreweb is vulnerable to cross-site scripting XSS attacks. The vulnerability exists due to improper sanitize input strings allowing attackers to steal cookies and inject arbitrary code into the victim's web browser...

GHSA-WPG7-2C88-R8XV Exposure of Sensitive Information in simple-get

In versions of simple-get prior to 4.0.1, 3.1.1, and 2.8.2, when fetching a remote url with a cookie location response, headers will be followed, potentially resulting in an exposure of the session cookie to a third party...

CVE-2022-22791

SYNEL - eharmony Authenticated Blind & Stored XSS. Inject JS code into the "comments" field could lead to potential stealing of cookies, loading of HTML tags and JS code onto the system...

CVE-2022-22791

SYNEL - eharmony Authenticated Blind & Stored XSS. Inject JS code into the "comments" field could lead to potential stealing of cookies, loading of HTML tags and JS code onto the system...

CVE-2022-22791 SYNEL - eharmony Authenticated Blind & Stored XSS

SYNEL - eharmony Authenticated Blind & Stored XSS. Inject JS code into the "comments" field could lead to potential stealing of cookies, loading of HTML tags and JS code onto the system...

CVE-2022-22791

The CVE-2022-22791 entry relates to Synel eharmony, describing an authenticated blind and stored cross-site scripting (XSS) vulnerability in the comments field. The root cause is injection of JavaScript through the comments field, with the potential impact noted as cookie theft and the embedding ...

What is Cross Site Request Forgery CSRF | Example and Methods of protection

Organizations aspiring for all-around resource security against the damage-causing cyber vulnerabilities must upgrade their knowledge and get acquainted with all the existing types. CSRF is what is covered sizably in the post. What is CSRF Attack? A counterpart of XSS, CSRF is one of the multiple...

Mageia: Security Advisory (MGASA-2015-0227)

The remote host is missing an update for the SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Mageia: Security Advisory (MGASA-2015-0179)

The remote host is missing an update for the SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Google Drops FLoC and Introduces Topics API to Replace Tracking Cookies for Ads

Google on Tuesday announced that it is abandoning its controversial plans for replacing third-party cookies in favor of a new Privacy Sandbox proposal called Topics, which categorizes users' browsing habits into approximately 350 topics. The new mechanism, which takes the place of FLoC short for...

GLPI htmLawed php command injection

This exploit takes advantage of a unauthenticated php command injection available from GLPI versions 10.0.2 and below to execute a command. Module Options msf use exploit/linux/http/glpi/htmlawedphpinjection msf undefinedhtmlawedphpinjection show actions ...actions... msf...

Exposure of Sensitive Information to an Unauthorized Actor in httpie/httpie

Description All cookies saved to session storage are supercookies. Proof of Concept in /etc/hosts 127.0.0.1 host1.example.com 127.0.0.1 host2.example.net headers-helper.rpy; run with twist web --resource-script= and it'll run on 8080 from pprint import pformat from twisted.web.resource import...

CVE-2020-4879

IBM Cognos Controller 10.4.0, 10.4.1, and 10.4.2 could allow a remote attacker to bypass security restrictions, caused by improper validation of authentication cookies. IBM X-Force ID: 190847...

Authentication flaw

IBM Cognos Controller 10.4.0, 10.4.1, and 10.4.2 could allow a remote attacker to bypass security restrictions, caused by improper validation of authentication cookies. IBM X-Force ID: 190847...

CVE-2020-4879

CVE-2020-4879 affects IBM Cognos Controller 10.4.0, 10.4.1, and 10.4.2, where improper validation of authentication cookies could allow a remote attacker to bypass security restrictions. Connected sources confirm the vulnerability is tied to cookie handling and describe the remediation: IBM Cogno...