Web Application Cookies Are Expired

The remote web application sets various cookies throughout a user's unauthenticated and authenticated session. However, Nessus has detected that one or more of the cookies have an 'Expires' attribute that is set with a past date or time, meaning that these cookies will be removed by the browser. ...

The vulnerability of the client in the OpenSSH cryptographic protection mechanism allows a hacker to gain privileged access when interacting with an X11 server.

The vulnerability of the OpenSSH cryptographic protection tool relates to security configuration errors. Exploiting this vulnerability allows a malicious actor, operating remotely, to gain privileged access when interacting with an X11 server due to incorrect cookies generated for the unencrypted...

Weblate: Improper Cookie expiration | Cookies Expiration Set to Future

Hi Team, I have found at many instances or places from signup till getting logged into application in domain "demo.weblate.org" that session maintaining cookies such as csrf token and session id's expiration dates are set to future date. As part of secure session management one should prohibit or...

Stored Cross-Site Scripting Vulnerability in Medical Attendant App

Apply for Medical Care is an online unified registration platform that provides online reservation and registration for domestic hospitals. There is a stored cross-site scripting vulnerability in the App, the vulnerability arises because the Contact Customer Service function module fails to...

Stored Cross-Site Scripting Vulnerability in Seeding.com App

The Sowing the Seed App is a pregnancy preparation knowledge platform designed to answer the questions of moms who are preparing for pregnancy and getting pregnant. Sowseed.com App suffers from a stored cross-site scripting vulnerability due to the program's failure to filter user-submitted data...

Stored Cross-Site Scripting Vulnerability in Opposite App

Opposite App is is an entertaining dating app with a dating theme. Opposite App has a stored cross-site scripting vulnerability, the vulnerability arises because the feedback function module fails to effectively filter the data submitted by the user, an attacker can use the vulnerability to impla...

Stored Cross-Site Scripting Vulnerability in FitTime App

FitTime is a mobile fitness app with its own copyrighted fitness videos taught by real people throughout. FitTime App suffers from a stored cross-site scripting vulnerability due to the program failing to adequately filter user-supplied input. An attacker can exploit the vulnerability to plant...

Forrest Gump Running App Has Stored Cross-Site Scripting Vulnerability

Forrest Gump Running App is a running app that will live stream. Forrest Gump Running App suffers from a stored cross-site scripting attack vulnerability due to the program's failure to filter user-submitted data. An attacker can exploit the vulnerability to plant cross-site code and obtain...

Cross-site scripting vulnerability in FineCMS latest version 2.1.5

FineCMS is a content management system based on PHP+MySql. The latest version of FineCMS version 2.1.5 has a cross-site scripting vulnerability, the vulnerability stems from the front-end avatar uploads are not sufficiently filtered user-submitted inputs, an attacker can exploit the vulnerability...

XSS Vulnerability in Chengdu Firefox Technology Website Building System

Chengdu Firefox Technology Website Building System is a website building system. An XSS vulnerability exists in Chengdu Firefox Technology Website Builder. An attacker can use this vulnerability to inject arbitrary Web script or HTML to obtain sensitive information such as administrator cookies...

The vulnerability of the URLConnection class in the Android operating system allows a hacker to inject arbitrary scripts or set arbitrary values in cookies.

The vulnerability of the HTTP header of the URLConnection class in the Android operating system exists due to the lack of measures to neutralize special elements. Exploiting this vulnerability allows a malicious actor to inject arbitrary scripts or set arbitrary values in cookies remotely...

CVE-2017-4011

Embedding Script XSS in HTTP Headers vulnerability in the server in McAfee Network Data Loss Prevention NDLP 9.3.x allows remote attackers to get session/cookie information via modification of the HTTP request...

Stored Cross-site Scripting Vulnerability in DM Enterprise Website System Message Function

DM enterprise building system is developed by php + mysql a set of specialized in small and medium-sized enterprise website construction of open source cms. DM enterprise website building system message function there is a stored cross-site scripting vulnerability , the vulnerability due to the...

Reflected Cross-Site Scripting Vulnerability in the usbkey_Serial Parameter of the Enterprise Intelligence Network Management System

Enterprise Intelligence products are intranet management expert services. A reflective cross-site scripting vulnerability exists in the usbkeySerial parameter of the Enterprise Intelligence network management system. It allows an attacker to construct an XSS statement to directly trigger a pop-up...

GetSimple CMS Elevation of Privilege Vulnerability

GetSimple is a content management system. An elevation of privilege vulnerability exists in admin/inc/templatefunctions.php in GetSimple CMS, which can be exploited by an attacker to elevate privileges to an arbitrary user or conduct a CSRF attack by counting session cookies or CSRF nonce...

CVE-2017-6137

In F5 BIG-IP LTM, AAM, AFM, Analytics, APM, ASM, DNS, Edge Gateway, GTM, Link Controller, PEM, PSM, WebAccelerator, and WebSafe 11.6.1 HF1, 12.0.0 HF3, 12.0.0 HF4, and 12.1.0 through 12.1.2, undisclosed traffic patterns received while software SYN cookie protection is engaged may cause a disrupti...

Cookie leakage, non-restricted cookie acceptance

Cookies of foo.bar.example.com are leaked to foo.bar. Additionally, any site can set cookies for any other site...

Insecure Cookies

github.com/sensu/uchiwa doesn't use correctly secured cookies for sensitive information. The SecureFlag is currently not being set in the AuthenticationToken and the XSRF-Token cookies. This allows attackers to observe the cookies as they are sent in plaintext...

EulerOS 2.0 SP1 : openssh (EulerOS-SA-2016-1008)

According to the versions of the openssh packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - It was discovered that the OpenSSH server did not sanitize data received in requests to enable X11 forwarding. An authenticated client with...

CVE-2017-8081

Poor cryptographic salt initialization in admin/inc/templatefunctions.php in GetSimple CMS 3.3.13 allows a network attacker to escalate privileges to an arbitrary user or conduct CSRF attacks via calculation of a session cookie or CSRF nonce...