CVE-2020-4173

IBM Guardium Activity Insights 10.6 and 11.0 does not set the secure attribute on authorization tokens or session cookies. Attackers may be able to get the cookie values by sending a http:// link to a user or by planting this link in a site the user goes to. The cookie will be sent to the insecur...

Automattic: Stored XSS on app.crowdsignal.com + your-subdomain.survey.fm via Embed Media

Hello there, I found a stored xss vulnerability. Steps: 1. Go to https://app.crowdsignal.com/dashboard 2. Create a quiz. 3. Go to https://app.crowdsignal.com/quizzes/your-quiz-id/question 4. Add Multiple Choice 5. Put a name to answer 1. 6. Click Add media button. F901543 7. Select Embed Media 8...

Visma Public: HTTP Request Smuggling at app.workbox.dk

The researcher was able to find a HTTP request CL.TE smuggling vulnerability at app.workbox.dk. The likely consequences would have result in interfering with normal user traffic, leak 'Session Cookies, leak PII info...

NiterForum is vulnerable to XSS

NiterForum is a forum program. NiterForum suffers from an XSS vulnerability that can be exploited by attackers to obtain sensitive information such as user cookies...

XSS vulnerability in Swordfish Forum

Swordfish Forum is a bbs forum system officially and publicly released by Catfish CMS. Swordfish Forum has an XSS vulnerability that can be exploited by attackers to obtain sensitive information such as user cookies...

XSS Vulnerability in DOSSM of Guangzhou Askway Information Technology Co.

Ltd. is a company that provides the travel and hospitality industry with a total solution of "technology", "people" and "process" necessary for marketing in the digital era. A XSS vulnerability exists in DOSSM, which can be exploited by attackers to obtain sensitive information such as user cooki...

XSS Vulnerability in Seven Bears Library CMS of Beijing Milwell Technology Co.

Seven Bears Library CMS is a document sharing and selling library CMS system. Seven Bears CMS has an XSS vulnerability that can be exploited by attackers to obtain sensitive information such as administrator cookies...

Security Vulnerabilities fixed in Firefox for Android 68.10.1 — Mozilla

A Content Provider in Firefox for Android allowed local files accessible by the browser to be read by a remote webpage, leading to sensitive data disclosure, including cookies for other origins...

Spoofable Cookies

Microsoft asp.net has caused spoofable cookies. It does not properly encode the data string parsed to cookie name value, allowing an attacker who can perform a secondary exploit such as an XSS vulnerability in the web site to inject the spoofed cookies if the prefixes are used...

CVE-2020-8176

A cross-site scripting vulnerability exists in koa-shopify-auth v3.1.61-v3.1.62 that allows an attacker to inject JS payloads into the shop parameter on the /shopify/auth/enablecookies endpoint...

CVE-2019-4704

IBM Security Identity Manager Virtual Appliance 7.0.2 does not set the secure attribute on authorization tokens or session cookies. Attackers may be able to get the cookie values by sending a http:// link to a user or by planting this link in a site the user goes to. The cookie will be sent to th...

CVE-2019-4704

IBM Security Identity Manager Virtual Appliance 7.0.2 does not set the secure attribute on authorization tokens or session cookies. Attackers may be able to get the cookie values by sending a http:// link to a user or by planting this link in a site the user goes to. The cookie will be sent to th...

Design/Logic Flaw

IBM Security Identity Manager Virtual Appliance 7.0.2 does not set the secure attribute on authorization tokens or session cookies. Attackers may be able to get the cookie values by sending a http:// link to a user or by planting this link in a site the user goes to. The cookie will be sent to th...

CVE-2019-4704

IBM Security Identity Manager Virtual Appliance 7.0.2 does not set the secure attribute on authorization tokens or session cookies. Attackers may be able to get the cookie values by sending a http:// link to a user or by planting this link in a site the user goes to. The cookie will be sent to th...

SMTP2GO: Stored XSS at https://app.smtp2go.com/settings/users/

Vulnerability : A. Type:- Cross Site Scripting Stored B. Description:- Stored XSS, also known as persistent XSS, is the more damaging than non-persistent XSS. It occurs when a malicious script is injected directly into a vulnerable web application. Summary : When you will create a particular user...

Fedora: Security Advisory for curl (FEDORA-2020-6af1dd2936)

The remote host is missing an update for the Copyright C 2020 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

Rack allows Percent-encoded cookies to overwrite existing prefixed cookie names

A reliance on cookies without validation/integrity check security vulnerability exists in rack 2.2.3, rack 2.1.4 that makes it possible for an attacker to forge a secure or host-only cookie prefix...

Hmmcookies - Grab Cookies From Firefox, Chrome, Opera Using A Shortcut File (Bypass UAC)

Grab cookies from Firefox, Chrome, Opera using a shortcut file bypass UAC Legal disclaimer: Usage of HMMCOOKIES for attacking targets without prior mutual consent is illegal. It's the end user's responsibility to obey all applicable local, state and federal laws. Developers assume no liability an...

WebPort 1.19.1 - Cross Site Scripting

WebPort version 1.19.1 suffers from multiple reflective cross site scripting vulnerabilities. Exploit Title: WebPort 1.19.1 - Reflected Cross-Site Scripting Date: 2019-05-30 Exploit Author: Emre ÖVÜNÇ Vendor Homepage: https://webport.se/ Software Link: https://webport.se/nedladdningar/ Version:...

XSS Vulnerability in HulaCWMS

HulaCWMS is developed on ThinkPHP5 framework and includes all the features of ThinkPHP5. HulaCWMS has an XSS vulnerability that can be exploited by an attacker to obtain sensitive information such as user cookies...