9510 matches found
PT-2020-6880 · Abb · Esoms
Name of the Vulnerable Software and Affected Versions: ABB eSOMS versions 4.0 through 6.0.2 Description: The issue is related to the absence of the HttpOnly flag in session cookies, which can allow JavaScript to access the cookie contents. This might enable Cross Site Scripting XSS attacks, where...
Design/Logic Flaw
Codologic Codoforum through 4.8.4 allows a DOM-based XSS. While creating a new topic as a normal user, it is possible to add a poll that is automatically loaded in the DOM once the thread/topic is opened. Because session cookies lack the HttpOnly flag, it is possible to steal authentication cooki...
CVE-2020-7050
Codologic Codoforum through 4.8.4 allows a DOM-based XSS. While creating a new topic as a normal user, it is possible to add a poll that is automatically loaded in the DOM once the thread/topic is opened. Because session cookies lack the HttpOnly flag, it is possible to steal authentication cooki...
CVE-2020-7050
Codoforum (Codologic) up to version 4.8.4 is affected by a DOM-based XSS vulnerability. The issue arises when a normal user creates a new topic and adds a poll, which is then automatically loaded in the DOM when the thread is opened. The description notes that session cookies lack the HttpOnly fl...
5iSNS content payment system has XSS vulnerability
5iSNS content payment system is a home-grown , small , stable , support in large amounts of data still maintain a high load capacity of the SNS open source system , the system supports unlimited module expansion , plug-in expansion . 5iSNS content payment system XSS vulnerability , attackers can...
Security Bulletin: IBM FileNet Content Manager and Case Foundation security vulnerability in Administration Console for Content Platform Engine (ACCE)
Summary IBM FileNet Content Manager and Case Foundation have multiple security vulnerabilities in Administration Console for Content Platform Engine ACCE. Vulnerability Details CVEID: CVE-2019-4642 DESCRIPTION: IBM FileNet Content Manager allows web pages to be stored locally which can be read by...
Node.js third-party modules: [dy-server2] - stored Cross-Site Scripting
I would like to report Stored XSS in dy-server2 It allows to steal session cookies, deface web , execute anything code javascript Module module name: dy-server2 version: dy-server2 npm page: https://www.npmjs.com/package/dy-server2 Module Description 这是一款轻量级http服务器，可用于文件传输，前端项目预览。 Module Stats...
XSS Vulnerability in Qibo cms
Qibo CMS system, the original PHP168 whole station system is a more comprehensive product in the domestic open source CMS system, providing a variety of modules including articles, pictures, downloads, shopping malls, built-in features, orders, exams and so on. Qibo cms XSS vulnerability , an...
XSS Vulnerability in Zhongqing Naboo Education Cloud Platform System
Beijing Zhongqing Nabo Information Technology Co., Ltd. mainly includes technology development, technology transfer, technology consulting, technology service and technology promotion. There is an XSS vulnerability in Zhongqing Nabo's education cloud platform system, which can be exploited by...
Unspecified Vulnerability in Codologic Codoforum
Codoforum is a set of PHP and MySQL based forum software. A security vulnerability exists in Codologic Codoforum version 4.8.4. An attacker can exploit this vulnerability to steal authentication cookies and take control of an account...
XSS Vulnerability in Shipping 100 Virtual Goods Autoship System
Shipping 100 Virtual Goods Autoship System is a virtual goods autoship system/article pay to read system. Shipping 100 Virtual Goods Autoship System has an XSS vulnerability that can be exploited by attackers to obtain administrator cookie information...
CVE-2020-7051
Codologic Codoforum through 4.8.4 allows stored XSS in the login area. This is relevant in conjunction with CVE-2020-5842 because session cookies lack the HttpOnly flag. The impact is account takeover...
CVE-2020-7051
Codologic Codoforum through 4.8.4 allows stored XSS in the login area. This is relevant in conjunction with CVE-2020-5842 because session cookies lack the HttpOnly flag. The impact is account takeover...
Cross site scripting
Codologic Codoforum through 4.8.4 allows stored XSS in the login area. This is relevant in conjunction with CVE-2020-5842 because session cookies lack the HttpOnly flag. The impact is account takeover...
Security Bulletin: IBM Sterling B2B Integrator's session or sensitive cookies do not have the secure attribute enabled (CVE-2012-5936)
Summary IBM Sterling B2B Integrator's session or sensitive cookies do not have the secure attribute enabled. As a result, customers who use HTTP could be vulnerable to cookie hijacking attacks. Vulnerability Details CVE ID: CVE-2012-5936 DESCRIPTION: IBM Sterling B2B Integrator does not set the...
Conservative News Sites Track You Lots More Than Left-Leaning Ones
One analysis of news outlets found that the median popular right-wing site planted 73 percent more cookies than its left-wing counterpart...
CVE-2020-3935
TAIWAN SECOM CO., LTD., a Door Access Control and Personnel Attendance Management system, stores users’ information by cleartext in the cookie, which divulges password to attackers...
HackerOne: 404-response contains debug-information with all headers
Summary: When requesting a page that does not exist under www.hackerone.com the page returns a hidden HTML-element debugData that reflects all headers in the GET-request, including http-only cookies. Description: This in itself is not a serious vulnerablity, but as the program description mention...