Input validation

A weakness was discovered where an attacker can inject arbitrary values in to the browser cookies. This is a re-issue of an incomplete fix from PMASA-2016-18...

Security update for xorg-x11-server (important)

This update for xorg-x11-server fixes the following issues: - CVE-2017-10971: Fix endianess handling of GenericEvent to prevent a stack overflow by clients. bnc1035283 - Make sure the type of all events to be sent by ProcXSendExtensionEvent are in the allowed range. - CVE-2017-10972: Initialize t...

Legal Robot: Intercom chat session information persists after logout

Hi team, While testing i look for session related issues but It seems that The Site is Will protected For such problems But a little Issue related to that i wanted to mention here... When A user Sign-In to his account he can see a Little chat button on Bottom right corner of the page After...

SQL injection vulnerability in cookies of Semcms foreign trade website management system V2.2

SemCms is an open source foreign trade enterprise website management system, mainly used for foreign trade enterprises, compatible with IE, Firefox and other mainstream browsers. Semcms foreign trade website management system version V2.2 SQL injection vulnerability , because the system fails to...

CVE-2017-1000016

Summary (from provided sources): CVE-2017-1000016 describes a cookie attribute injection weakness in phpMyAdmin, allowing an attacker to inject arbitrary values into browser cookies. The CVE is described as a re-issue of an incomplete fix from PMASA-2016-18. Connected advisories reference phpMyAd...

CVE-2017-1000016

A weakness was discovered where an attacker can inject arbitrary values in to the browser cookies. This is a re-issue of an incomplete fix from PMASA-2016-18...

CVE-2017-1000046

CVE-2017-1000046 affects Mautic 2.6.1 and earlier, where session cookies are not set with proper flags. Multiple sources (NVD entry and related advisories) confirm the issue center on Mautic’s cookie handling; no explicit remediation or affected versions beyond the stated 2.6.1 and earlier are pr...

CVE-2017-1000046

Mautic 2.6.1 and earlier fails to set flags on session cookies...

CVE-2017-1000016

A weakness was discovered where an attacker can inject arbitrary values in to the browser cookies. This is a re-issue of an incomplete fix from PMASA-2016-18...

Cross-Site Scripting Vulnerability in Accessible Assisted Browsing

Accessibility Aids is an accessibility aid for government websites that focuses on information technology construction, web content accessibility and internet accessibility. Accessibility Assisted Browsing has a cross-site scripting vulnerability, as the program fails to filter the event...

F5 Networks BIG-IP : iControl REST vulnerability (K22317030)

iControl REST includes a service to convert authorization BIGIPAuthCookie cookies to X-F5-Auth-Token tokens. This service does not properly re-validate cookies when making that conversion, allowing once-valid but now expired cookies to be converted to valid tokens.CVE-2017-6145 C Tenable Network...

Cross-site scripting vulnerability in Axublog art.php

Axublog is a PHP personal blog system. A cross-site scripting vulnerability exists in Axublog art.php due to the system failing to filter incoming parameters. An attacker can exploit this vulnerability to plant cross-site code and obtain sensitive information such as administrator cookies...

SUSE-SU-2017:1848-1 Security update for xorg-x11-libICE

This update for xorg-x11-libICE fixes the following issues: - CVE-2017-2626: Creation of the ICE auth session cookies used insufficient randomness, making these cookies predictable. A more random generation method has been implemented. boo1025068...

Uber Patches Authentication Bypass Vulnerability on Custom SSO Solution

Uber has addressed a vulnerability that allowed attackers to steal session tokens and hijack accounts. Researcher Arne Swinnen disclosed details Monday after confirming late last week that the issue had been resolved; he earned $5,000 in bounties from Uber. Swinnen said that if exploited at a lar...

SUSE SLED12 / SLES12 Security Update : libICE (SUSE-SU-2017:1835-1)

This update for libICE fixes the following issues : - CVE-2017-2626: Creation of the ICE auth session cookies used insufficient randomness, making these cookies predictable. A more random generation method has been implemented. boo1025068 Note that Tenable Network Security has extracted the...

DNN (DotNetNuke) 5.2.0 < 9.1.1 Multiple Vulnerabilities

The version of DNN Platform formerly DotNetNuke running on the remote host is 5.2.0 or later but prior to 9.1.1. It is, therefore, affected by multiple vulnerabilities : - A remote code execution vulnerability exists due to insecure use of web cookies to identify users. An unauthenticated, remote...

Joomla com_akobook component cross-site scripting vulnerability

Joomla is an open source, cross-platform content management system CMS developed using PHP and MySQL. A cross-site scripting vulnerability exists in the Joomla comakobook component. It allows attackers to construct XSS statements, perform pop-up box operations, and obtain information such as user...

Cross-Site Scripting Vulnerability in the PESCMS TEAM Task Management System

PESCMS TEAM is a task management system open-sourced under the GPLv2 license. A cross-site scripting vulnerability exists in PESCMS TEAM Task Management System v2.1.0, which allows an attacker to construct a malicious payload to be sent to a user to obtain sensitive information such as...

XSS Vulnerability in OTCMSV2.56

OTCMS is a website article management system. OTCMSV2.56 suffers from an XSS vulnerability. An attacker can exploit this vulnerability to obtain sensitive information such as administrator cookies...

XYCMS message board PHP version of the processing message function has XSS vulnerabilities

XYCMS message board is a php+MySQL php message board source code, the software for the ordinary message board can be widely used in corporate websites and other sites that require message boards for use. XYCMS message board PHP version to deal with the message function there are XSS...