9509 matches found
Same-Origin Policy Bypass
thunderbird is vulnerable to same-origin policy bypass. A flaw was found in the way Thunderbird handled the "location.hostname" value during certain browser domain checks. This flaw could allow a malicious HTML mail message to set domain cookies for an arbitrary site, or possibly perform an XSS...
[SECURITY] Fedora 32 Update: haproxy-2.1.4-1.fc32
HAProxy is a TCP/HTTP reverse proxy which is particularly suited for high availability environments. Indeed, it can: - route HTTP requests depending on statically assigned cookies - spread load among several servers while assuring server persistence through the use of HTTP cookies - switch to...
CVE-2019-1003003
An improper authorization vulnerability exists in Jenkins 2.158 and earlier, LTS 2.150.1 and earlier in core/src/main/java/hudson/security/TokenBasedRememberMeServices2.java that allows attackers with Overall/RunScripts permission to craft Remember Me cookies that would never expire, allowing e.g...
CVE-2020-1987
An information exposure vulnerability in the logging component of Palo Alto Networks Global Protect Agent allows a local authenticated user to read VPN cookie information when the troubleshooting logging level is set to "Dump". This issue affects Palo Alto Networks Global Protect Agent 5.0 versio...
Django 3.0 - Cross-Site Request Forgery Token Bypass Exploit
Exploit for php platform in category web applications Exploit Title: Django 3.0 - Cross-Site Request Forgery Token Bypass Exploit Author: Spad Security Group Vendor Homepage: https://www.djangoproject.com/ Software Link: https://pypi.org/project/Django/ Version: 3.0 = Tested on: windows 10...
Security Bulletin: IBM Security Information Queue does not set the HttpOnly flag in session cookies (CVE-2020-4289)
Summary IBM Security Information Queue ISIQ does not sufficiently protect session cookies by setting the HttpOnly flag. Consequently, a client-side script could obtain sensitive information from an ISIQ cookie. As of v1.0.6, ISIQ sets the HttpOnly flag. Vulnerability Details CVEID: CVE-2020-4289...
curl security and bug fix update
7.29.0-57.0.1 - Fix TFTP small blocksize heap buffer overflow https://curl.haxx.se/docs/CVE-2019-5482.htmlCVE-2019-5482Orabug: 30568724 - Security Fixes OraBug: 28939992 - CVE-2016-8615 cookie injection for other servers https://curl.haxx.se/docs/CVE-2016-8615.html - CVE-2016-8616 case insensitiv...
115CMS suffers from XSS vulnerability
115CMS is a content management system developed with ThinkPHP framework. 115CMS suffers from an XSS vulnerability that can be exploited by attackers to execute malicious scripts and obtain administrator cookies...
CVE-2019-14826
A flaw was found in FreeIPA versions 4.5.0 and later. Session cookies were retained in the cache after logout. An attacker could abuse this flaw if they obtain previously valid session cookies and can use this to gain access to the session...
Mail.ru: Http Response Splitting on thumb.cloud.mail.ru
Limited CRLF injection at thumb.cloud.mail.ru allowed to manipulate cookies...
WeiPHP has an XSS vulnerability
WeiPHP is an open source WeChat public platform development framework, can easily build a personal WeChat public account operation platform. WeiPHP has an XSS vulnerability. An attacker can exploit this vulnerability to execute malicious scripts and obtain administrator cookies...
XSS Vulnerability in Website Building System of Yuege Network Technology Co.
Foshan Yuege Network Technology Co., Ltd. focuses on the development of small and medium-sized enterprise website construction and services, is committed to the domestic enterprise marketing website building service brand. Currently serves more than 3200 enterprises. Yuege Networks Technology Co....
Coupon Pusher CMS suffers from XSS vulnerability (CNVD-2020-26263)
Push Couponer CMS is a PHP Taobao coupon website system developed by PHP+MySQL. Push Coupon CMS has an XSS vulnerability that can be exploited by attackers to execute malicious scripts and obtain administrator cookies...
XSS Vulnerability in Extreme CMS Beta 1.6.7
Extreme CMS Beta is a php+mysql an open source CMS system. Extreme CMS Beta 1.6.7 suffers from an XSS vulnerability, which can be exploited by attackers to execute malicious code and obtain administrator cookies...
XSS Vulnerability in DedeCMS 5.7SP2
DedeCMS is a collection of simple, robust, flexible, open source several characteristics of open source content management system. DedeCMS 5.7SP2 exists XSS vulnerability, attackers can exploit the vulnerability to obtain sensitive information such as user cookies...
XSS Vulnerability in Swordfish Forum v1.5.0
Swordfish Forum is a bbs forum system officially and publicly released by Catfish CMS. Swordfish Forum v1.5.0 has an XSS vulnerability, which can be exploited by attackers to obtain sensitive information such as user cookies...
Apple Safari Blocks Ad-Targeting Cookie Support
Apple has released an update to its Safari browser that blocks third-party cookies, following an announcement by Google that it would do the same for its Chrome browser. Through the release of Safari 13.1 on Tuesday, alongside some changes to Apple’s Intelligent Tracking Prevention ITP in iOS and...
Fedora 31 : webkit2gtk3 (2020-f25793aac4)
Update to WebKitGTK 2.28.0. - Add API to enable Process Swap on Cross-site Navigation. - Add user messages API for the communication with the web extension. - Add support for same-site cookies. - Service workers are enabled by default. - Add support for Pointer Lock API. - Add flatpak sandbox...
Wordpress Plugin WPForms 1.5.8.2 - Persistent Cross-Site Scripting
Wordpress Plugin WPForms 1.5.8.2 - Persistent Cross-Site Scripting Exploit Title: Wordpress Plugin WPForms 1.5.8.2 - Persistent Cross-Site Scripting Date: 2020-02-18 Vendor Homepage: https://wpforms.com Vendor Changelog: https://wordpress.org/plugins/wpforms-lite/developers Exploit Author: Jinson...