Cross-site Scripting Vulnerability in Tonglian Da3 Collaboration Office Platform

Tonglian Da3 cooperative office platform is a series of Da3 management software products provided by Tonglian for governmental units at all levels, focusing on "mobile government office". There is a cross-site scripting vulnerability in the Da3 collaborative office platform, which can be exploite...

Reflected Cross-Site Scripting Vulnerability in Axublog go/index.php Page

Axublog is a PHP personal blog system. A reflective cross-site scripting vulnerability exists in the Axublog go/index.php page. An attacker can construct XSS statements and perform pop-up box operations to obtain user cookies and other information...

[SECURITY] Fedora 26 Update: curl-7.53.1-12.fc26

curl is a command line tool for transferring data with URL syntax, supporti ng FTP, FTPS, HTTP, HTTPS, SCP, SFTP, TFTP, TELNET, DICT, LDAP, LDAPS, FILE, I MAP, SMTP, POP3 and RTSP. curl supports SSL certificates, HTTP POST, HTTP PUT, FTP uploading, HTTP form based upload, proxies, cookies,...

Authentication Bypass Vulnerability in S-CMS Backend

S-CMS is a corporate website building system developed by Zibo Shining Network Technology Co. There is an authentication bypass vulnerability in the S-CMS backend and two sensitive files. The vulnerability is caused by the system's failure to accurately verify cookie information, and an attacker...

IBM BigFix Platform Web Report Component Information Disclosure Vulnerability (CNVD-2017-32864)

IBM BigFix Platform formerly IBM Tivoli Endpoint Manager is a system management software. An information disclosure vulnerability exists in IBM BigFix Platform 9.2 and 9.5. The vulnerability arises due to a failure to properly enable the secure cookie attribute. An attacker could exploit the...

CVE-2017-7090

An issue was discovered in certain Apple products. iOS before 11 is affected. Safari before 11 is affected. iCloud before 7.0 on Windows is affected. iTunes before 12.7 on Windows is affected. tvOS before 11 is affected. The issue involves the "WebKit" component. It allows remote attackers to...

CVE-2017-6145

iControl REST in F5 BIG-IP LTM, AAM, AFM, Analytics, APM, ASM, DNS, Link Controller, PEM, and WebSafe 12.0.0 through 12.1.2 and 13.0.0 includes a service to convert authorization BIGIPAuthCookie cookies to X-F5-Auth-Token tokens. This service does not properly re-validate cookies when making that...

CVE-2017-6145

CVE-2017-6145 affects F5 BIG-IP products with iControl REST. The issue arises in the service that converts BIGIPAuthCookie cookies to X-F5-Auth-Token tokens, failing to re-validate cookies during conversion. This allows an expired, previously valid cookie to be converted into a valid token, enabl...

Cross-Site Request Forgery (CSRF)

keycloak-services is vulnerable to cross-site request forgery CSRF attacks. The library does not include CSRF protection mechanisms, allowing attackers with valid session cookies to perform CSRF attacks...

Moderate: Red Hat Security Advisory: rh-nodejs6-nodejs-tough-cookie security update

An update for rh-nodejs6-nodejs-tough-cookie is now available for Red Hat Software Collections. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for...

Moderate: Red Hat Security Advisory: rh-nodejs4-nodejs-tough-cookie security update

An update for rh-nodejs4-nodejs-tough-cookie is now available for Red Hat Software Collections. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for...

CVE-2015-2156

Netty before 3.9.8.Final, 3.10.x before 3.10.3.Final, 4.0.x before 4.0.28.Final, and 4.1.x before 4.1.0.Beta5 and Play Framework 2.x before 2.3.9 might allow remote attackers to bypass the httpOnly flag on cookies and obtain sensitive information by leveraging improper validation of cookie name a...

DEBIAN-CVE-2015-2156

Netty before 3.9.8.Final, 3.10.x before 3.10.3.Final, 4.0.x before 4.0.28.Final, and 4.1.x before 4.1.0.Beta5 and Play Framework 2.x before 2.3.9 might allow remote attackers to bypass the httpOnly flag on cookies and obtain sensitive information by leveraging improper validation of cookie name a...

CVE-2015-2156

Netty before 3.9.8.Final, 3.10.x before 3.10.3.Final, 4.0.x before 4.0.28.Final, and 4.1.x before 4.1.0.Beta5 and Play Framework 2.x before 2.3.9 might allow remote attackers to bypass the httpOnly flag on cookies and obtain sensitive information by leveraging improper validation of cookie name a...

Webtrekk Pixel Tracking Cross Site Scripting Vulnerability

Webtrekk Pixel Track versions 3.24 to 3.40, 4.00 to 4.40, and 5.00 to 5.04 suffer from a cross site scripting vulnerability. ======================================================================= title: Cross site scripting product: Webtrekk Pixel tracking vulnerable version: v3.24 to v3.40, v4....

keycloak: CSRF token fixation

It was found that the cookie used for CSRF prevention in Keycloak was not unique to each session. An attacker could use this flaw to gain access to an authenticated user session, leading to possible information disclosure or further attacks...

Webtrekk Pixel Tracking Cross Site Scripting

SEC Consult Vulnerability Lab Security Advisory ======================================================================= title: Cross site scripting product: Webtrekk Pixel tracking vulnerable version: v3.24 to v3.40, v4.00 to v4.40, v5.00 to v5.04 fixed version: v3.41, v4.41, v5.05 impact: Medium...

Stored Cross-Site Scripting Vulnerability in Little Lord App

Little Lord App is a software focused on women's great aunt menstrual period management. Little Master App suffers from a stored cross-site scripting vulnerability, which can be exploited by attackers to insert malicious cross-site code and obtain sensitive information such as administrator cooki...

Stored Cross-Site Scripting Vulnerability in Tom Tom's App

Tongcun Village App is a cell phone taxi software that focuses on serving the rural grassroots. Tongcun Village App has a stored cross-site scripting vulnerability, which can be exploited by attackers to insert XSS code and obtain sensitive information such as administrator cookies...

OSXAuditor - Free Mac OS X Computer Forensics Tool

OS X Auditor is a free Mac OS X computer forensics tool. OS X Auditor parses and hashes the following artifacts on the running system or a copy of a system you want to analyze: the kernel extensions the system agents and daemons the third party's agents and daemons the old and deprecated system a...