CVE-2019-14826

CVE-2019-14826 affects FreeIPA 4.5.0 and later. The vulnerability arises because session cookies are retained in the cache after logout, allowing an attacker who obtains previously valid cookies to gain access to a session. This is described in the NVD entry and Red Hat advisory context, with CVS...

CVE-2019-14826

A flaw was found in FreeIPA versions 4.5.0 and later. Session cookies were retained in the cache after logout. An attacker could abuse this flaw if they obtain previously valid session cookies and can use this to gain access to the session...

PT-2019-16947 · Ibm · Ibm Cognos Controller

Name of the Vulnerable Software and Affected Versions: IBM Cognos Controller versions 10.3.0 through 10.4.1 Description: The issue allows an attacker to obtain sensitive information using man-in-the-middle techniques because it does not set the secure attribute on authorization tokens or session...

Malware called InnfiRAT is creeping into cryptocurrency wallets

By Sudais Dubbed InnfiRAT; the malware can also steal browser cookies resulting in a compromise of sensitive data such as usernames and passwords. This is a post from HackRead.com Read the original post: Malware called InnfiRAT is creeping into cryptocurrency wallets...

XSS Vulnerability in Guojiz URL Navigation System (CNVD-2019-35037)

Guojiz website navigation system is a navigation website source code system developed by PHP+MySQL. Guojiz navigation system XSS vulnerability, an attacker can exploit the vulnerability to obtain background user cookie information...

YouTube ordered to cough up $170M settlement over COPPA infraction

Last week, the Federal Trade Commission FTC announced that it has required Google and YouTube to pay a settlement fee totaling $170 million after its video-sharing platform was found violating the Children’s Online Privacy Protection Act COPPA. The complaint was filed by the FTC and the New York...

CVE-2019-11495

In Couchbase Server 5.1.1, the cookie used for intra-node communication was not generated securely. Couchbase Server uses erlang:now to seed the PRNG which results in a small search space for potential random seeds that could then be used to brute force the cookie and execute code against a remot...

XSS Vulnerability in Personal Information Page of E-commerce System of Kunming Aoyuan Technology Co.

Kunming Aoyuan Technology Co., Ltd. is a high-tech enterprise engaged in system development, website construction and other Internet businesses. There is an XSS vulnerability in the personal information page of the e-commerce system of Kunming Aoyuan Technology Co. Ltd, which can be exploited by...

XSS Vulnerability in Receiving Address Field of E-commerce System of Kunming Aoyuan Technology Co.

Kunming Aoyuan Technology Co., Ltd. is a high-tech enterprise engaged in system development, website construction and other Internet businesses. There is an XSS vulnerability in the receiving address field of the e-commerce system of Kunming Aoyuan Technology Co. Ltd, which can be exploited by...

Ubuntu 16.04 LTS / 18.04 LTS : Python vulnerabilities (USN-4127-1)

The remote Ubuntu 16.04 LTS / 18.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-4127-1 advisory. It was discovered that Python incorrectly handled certain pickle files. An attacker could possibly use this issue to consume memory, leading ...

PsiXBot Adds PornModule, Google DNS Service to Its Arsenal

The PsiXBot malware has made a few changes in recent weeks, including implementing Google’s DNS over HTTPS DoH and adding the blackmail-ready “PornModule” to its bag of tricks. PsiXBot is a multi-use Windows malware that has a range of capabilities, including keylogging, stealing passwords and...

Exploit for Path Traversal in Ivanti Connect_Secure

pwn-pulse.sh Exploit for Pulse Connect Secure SSL VPN arbitr...

XSS Vulnerability in Mobile Mall of Henan NetZhong.com Computer Technology Co.(CNVD-2019-33303)

Henan net in the net computer technology limited company is a micro letter public platform application and development of science and technology-based technology company. There is an XSS vulnerability in the mobile mall of Henan NetZhong.com Computer Science and Technology Co. Ltd, which can be...

XSS vulnerability in a component of the HadSky Light Forum system

HadSky Light Forum is a newborn original PHP MySQL open source system , the main goal is to achieve light , fast , simple , full , 100% original open source system . HadSky Light Forum system somewhere in the component there is an XSS vulnerability , attackers can exploit the vulnerability to...

Firefox 69 Now Blocks 3rd-Party Tracking Cookies and Cryptominers By Default

Mozilla has finally enabled the "Enhanced Tracking Protection" feature for all of its web browser users worldwide by default with the official launch of Firefox 69 for Windows, Mac, Linux, and Android. The company enabled the "Enhanced Tracking Protection" setting by default for its browser in Ju...

Firefox 69 Now Blocks 3rd-Party Tracking Cookies and Cryptominers By Default

Mozilla has finally enabled the "Enhanced Tracking Protection" feature for all of its web browser users worldwide by default with the official launch of Firefox 69 for Windows, Mac, Linux, and Android. The company enabled the "Enhanced Tracking Protection" setting by default for its browser in Ju...

Firefox 69 Release Kills Default Tracking Cookies, Flash Support

Mozilla has released its latest Firefox browser iteration, Firefox 69, which by default blocks third-party cookies and cryptominers; it also disables default support for Adobe Flash Player. In addition, the browser has squashed several critical and high-severity vulnerabilities. Mozilla has long...

XSS Vulnerability in Mall System of Shenzhen Xinpu Software Development Co.

Xinpu Software is an innovative enterprise with e-commerce system development as the core, providing fully integrated e-commerce solutions and services for enterprises. Shenzhen Xinpu Software Development Co., Ltd. mall system there is an XSS vulnerability, attackers can use the vulnerability to...

PT-2019-5369

Name of the Vulnerable Software and Affected Versions FreeIPA versions 4.5.0 and later Description The issue is related to incorrect session expiration. An attacker could exploit this to gain access to a session if they obtain previously valid session cookies. Recommendations For FreeIPA versions...

Vanilla: XSS through chat messages

vulnerability name: cross site scripting through chat messages vulnerability description: cross site scripting is a vulnerability that allows an attacker to send malicious codeusually in javascript form to another user Because a browser cannot know if the script should be trusted or not, it will...