CVE-2014-8684

CVE-2014-8684 affects CodeIgniter before 3.0 and Kohana 3.2.3 and earlier, and 3.3.x through 3.3.2. The issue arises from using standard string comparison operators to compare cryptographic hashes, which enables remote attackers to spoof session cookies and conduct PHP object injection attacks. E...

CVE-2014-8684

CodeIgniter before 3.0 and Kohana 3.2.3 and earlier and 3.3.x through 3.3.2 make it easier for remote attackers to spoof session cookies and consequently conduct PHP object injection attacks by leveraging use of standard string comparison operators to compare cryptographic hashes...

CVE-2014-8686

CodeIgniter before 2.2.0 makes it easier for attackers to decode session cookies by leveraging fallback to a custom XOR-based encryption scheme when the Mcrypt extension for PHP is not available...

CVE-2014-8686

CodeIgniter vulnerability CVE-2014-8686 (CodeIgniter before 2.2.0) allows attackers to decode and manipulate the ci_session cookie by falling back to a custom XOR-based scheme when the PHP Mcrypt extension is unavailable. Public references describe exploitation via extracting the encryption key, ...

Stored Cross-Site Scripting Vulnerability in Hulu 3 Floor App

Hulu Man 3F APP is a player exchange community platform launched by Guangzhou Manju Network Technology Co. A stored cross-site scripting vulnerability exists in the "Feedback" section of Hulu Man 3F APP. An attacker can insert malicious js code into the page to obtain user cookies and other...

Reflected Cross-Site Scripting Vulnerability in YiDaCMS Yidacms.html.asp Page

YidaCMS website management system is a simple, practical and efficient website builder. A reflective cross-site scripting vulnerability exists in the YiDaCMS Yidacms.html.asp page. An attacker can construct an XSS statement and perform a pop-up box operation to obtain user cookies and other...

D-Link DIR-850L REV.A Cross-Site Scripting Vulnerability

The D-Link DIR-850L REV.A is a wireless router from AUO D-Link. A cross-site scripting vulnerability exists in the D-Link DIR-850L REV.A using firmware version FW114WWb07h2abbeta1 and earlier. A remote attacker can exploit the vulnerability to steal authentication cookies by sending the 'action'...

Apache Tomcat CloudBees Jenkins Security Bypass Vulnerability

Apache Tomcat is the United States Apache Apache Software Foundation under the Jakarta project of a lightweight Web application server , it is mainly used for the development and debugging of JSP programs for small and medium-sized systems. CloudBees Jenkins is one of the set of U.S. CloudBees,...

Trend Micro Control Manager - ImportFile Directory Traversal RCE Exploit

Exploit for windows platform in category remote exploits require 'msf/core' require 'msf/core/exploit/phpexe' class MetasploitModule 'Trend Micro Control Manager importFile Directory Traversal RCE', 'Description' = %q This module exploits a directory traversal vulnerability found in Trend Micro...

CVE-2014-9634

Jenkins before 1.586 does not set the secure flag on session cookies when run on Tomcat 7.0.41 or later, which makes it easier for remote attackers to capture cookies by intercepting their transmission within an HTTP session...

CVE-2014-9635

Jenkins before 1.586 does not set the HttpOnly flag in a Set-Cookie header for session cookies when run on Tomcat 7.0.41 or later, which makes it easier for remote attackers to obtain potentially sensitive information via script access to cookies...

Session fixation

Jenkins before 1.586 does not set the secure flag on session cookies when run on Tomcat 7.0.41 or later, which makes it easier for remote attackers to capture cookies by intercepting their transmission within an HTTP session...

CVE-2014-9634

Jenkins before 1.586 does not set the secure flag on session cookies when run on Tomcat 7.0.41 or later, which makes it easier for remote attackers to capture cookies by intercepting their transmission within an HTTP session...

CVE-2014-9634

Jenkins before 1.586 does not set the secure flag on session cookies when run on Tomcat 7.0.41 or later, which makes it easier for remote attackers to capture cookies by intercepting their transmission within an HTTP session...

CVE-2014-9634

CVE-2014-9634 affects Jenkins prior to 1.586 when run on Tomcat 7.0.41+. The issue is that session cookies are not marked Secure, enabling potential interception of HTTP session cookies by remote attackers. The vulnerability is tied to Jenkins’ handling of cookies in Tomcat, with impact described...

CVE-2014-9635

Jenkins before 1.586 does not set the HttpOnly flag in a Set-Cookie header for session cookies when run on Tomcat 7.0.41 or later, which makes it easier for remote attackers to obtain potentially sensitive information via script access to cookies...

Palo Alto PAN-OS cross-site scripting vulnerability (CNVD-2017-31599)

Palo Alto Networks PAN-OS is an operating system developed by Palo Alto Networks, Inc. for its firewall appliances. Palo Alto Networks PAN-OS suffers from a cross-site scripting vulnerability that stems from a failure to adequately validate user input. An attacker could use this vulnerability to...

Regular Expression Denial Of Service (ReDoS) Via Parsing Cookies

tough-cookie is vulnerable to regular expression denial of service ReDoS attack. The vulnerability exists because the COOKIEPAIR regular expression used to parse the cookies causes unlimited repetitions when matching input characters. By using a large cookie string, attackers can make the process...

Cross-Site Scripting (XSS)

anchorcms/anchor-cms is vulnerable to cross-site scripting XSS attacks. The attacks exists because write function in system/cookie.php does not enforce the HttpOnly header when creating cookies...

Design/Logic Flaw

NetApp OnCommand Unified Manager for Clustered Data ONTAP before 7.2P1 does not set the secure flag for an unspecified cookie in an HTTPS session, which makes it easier for remote attackers to capture this cookie by intercepting its transmission within an HTTP session...