Security Bulletin: Missing Cookie Attribute Vulnerability Affects IBM Secure Proxy

Summary IBM Secure Proxy has corrected the missing secure attribute in encrypted session SSL cookies from the impacted session. Vulnerability Details Third Party Entry: PSIRT-ADV0022033 DESCRIPTION: Created from Advisory: ADV0022033 CVSS Base score: 4.3 CVSS Vector:...

IBM Publishing Engine Information Disclosure Vulnerability

IBM Publishing Engine is a tool for generating documents from data stored in other software tools. An information disclosure vulnerability exists in IBM Publishing Engine 6.0.6, 6.0.6.1, and 7.0, which stems from the product not setting security attributes on authorization tokens or session...

Newsportal 3 SQL Injection

Exploit Title: Newsportal v3 - 'uname' - SQL Injection Date: 2020-07-24 Exploit Author: gh1mau Team Members: Capt'N,muzzo,chaos689 | https://h0fclanmalaysia.wordpress.com/ Vendor Homepage: https://phpgurukul.com/news-portal-project-in-php-and-mysql/ Software Link:...

Security Bulletin: IBM MQ Appliance is affected by an information disclosure vulnerability (CVE-2018-20852)

Summary IBM MQ Appliance has resolved an information disclosure vulnerability. Vulnerability Details CVEID: CVE-2018-20852 DESCRIPTION: Python could allow a remote attacker to obtain sensitive information, caused by the failure to correctly validate the domain by...

Cisco Network Security Flaw Leaks Sensitive Data

A high-severity vulnerability in Cisco’s network security software could lay bare sensitive data – such as WebVPN configurations and web cookies – to remote, unauthenticated attackers. The flaw exists in the web services interface of Cisco’s Firepower Threat Defense FTD software, which is part of...

XSS Vulnerability in PbootCMS of Hunan Aoyun Network Technology Company Limited (CNVD-2020-48981)

PbootCMS is a new core and permanent open source free PHP enterprise website development and construction management system , is a set of efficient , simple , strong and free commercial PHP CMS source code , to meet the needs of various types of enterprise website development and construction...

XSS Vulnerability in 158net Website Building System of Guangxi Sense IOT Technology Co.

158net is the station building system of Guangxi Perception IOT Technology Co. Ltd. 158net station building system XSS vulnerability, attackers can use the vulnerability to obtain sensitive information such as user cookies...

Unspecified Vulnerability in SAP Disclosure Management

SAP Disclosure Management is an automated financial disclosure management system from SAP. The system provides a collaborative financial disclosure process across teams, geographies, systems and data sources. A security vulnerability exists in SAP Disclosure Management version 10.1 that stems fro...

XSS Vulnerability in EyouCms of Hainan Zanzan Network Technology Co.

Hainan Zanzan Network Technology Co., Ltd. station-building system EyouCms is based on the TP5.0 framework for the core development of free + open source enterprise content management system, focusing on enterprise station-building user needs, to provide a large number of templates in various...

Improper access control

The WOPI API integration for Vereign Collabora CODE through 4.2.2 does not properly restrict delivery of JavaScript to a victim's browser, and lacks proper MIME type access control, which could lead to XSS that steals account credentials via cookies or local storage. The attacker must first obtai...

XSS Vulnerability in ZTE Servers

Shenzhen ZTE Mobile Communications Co., Ltd. was founded in 2002, headquartered in Shenzhen High-tech Industrial Park, for the national high-tech enterprises. An XSS vulnerability exists in the ZTE server, which can be exploited by attackers to obtain user cookie information...

IBM Planning Analytics Licensing Issues Vulnerabilities

IBM Planning Analytics is a suite of business planning and analytics solutions from IBM USA. The solution supports automated execution of processes such as business planning, budgeting and analysis. A security vulnerability exists in IBM Planning Analytics version 2.0, which stems from the...

XSS Vulnerability in ZZCMS (CNVD-2020-49061 )

ZZCMS is a free website builder developed in asp language. ZZCMS has an XSS vulnerability that can be exploited by attackers to obtain sensitive information such as user cookies...

CVE-2020-4316

IBM Publishing Engine 6.0.6, 6.0.6.1, and 7.0 does not set the secure attribute on authorization tokens or session cookies. Attackers may be able to get the cookie values by sending a http:// link to a user or by planting this link in a site the user goes to. The cookie will be sent to the insecu...

CVE-2020-4316

IBM Publishing Engine 6.0.6, 6.0.6.1, and 7.0 does not set the secure attribute on authorization tokens or session cookies. Attackers may be able to get the cookie values by sending a http:// link to a user or by planting this link in a site the user goes to. The cookie will be sent to the insecu...

Authorization

IBM Publishing Engine 6.0.6, 6.0.6.1, and 7.0 does not set the secure attribute on authorization tokens or session cookies. Attackers may be able to get the cookie values by sending a http:// link to a user or by planting this link in a site the user goes to. The cookie will be sent to the insecu...

CVE-2020-4316

IBM Publishing Engine 6.0.6, 6.0.6.1, and 7.0 does not set the secure attribute on authorization tokens or session cookies. Attackers may be able to get the cookie values by sending a http:// link to a user or by planting this link in a site the user goes to. The cookie will be sent to the insecu...

CVE-2020-4316

IBM Publishing Engine is affected by CVE-2020-4316 due to not setting the secure attribute on authorization tokens and session cookies. Impact: cookies may be exposed when a user visits an http link or a site embedding it, allowing eavesdropping of cookie values. Affected versions: IBM Publishing...

Stored Cross-Site Scripting Vulnerability in jeecms

jeecms is Jiangxi Jinlei Technology Development Co., Ltd. developed a support for WeChat small program, WeChat public number / service number, column model, content model cross-customization, as well as with payment and financial settlement of the content of the e-commerce as one of the content...

Siemens Opcenter Execution Core Cross-Site Scripting Vulnerability

Opcenter Execution Core formerly known as Camstar Enterprise Platform is a general purpose Manufacturing Execution System MES. A cross-site scripting vulnerability exists in Siemens Opcenter Execution Core. An attacker could exploit the vulnerability to obtain a session cookie from a legitimate...