52 matches found
CVE-2023-45857-Demo
Demo zur Überprüfung der axios-Schwachstelle CVE-2023-45857 1. Im dev container starten 2. Im app-Container npm run dev ausführen 3. http://app.localhost aufrufen 4. In den Browser-Entwicklertools prüfen, dass der Cookie XSRF-TOKEN gesetzt ist Der Wert ist CREDENTIALTOKEN HttpOnly ist false...
Astra Linux – Vulnerability in Ceph
A flaw was discovered in Red Hat Ceph Storage 4, within the Dashboard component. In response to CVE-2020-27839, the JWT token was moved from localStorage to an httpOnly cookie. However, token cookies are used in the body of the HTTP response for documentation purposes, which again exposes them to...
CVE-2026-33400 Wallos: Stored cross-site scripting (XSS) vulnerability in the payment method rename endpoint
Wallos is an open-source, self-hostable personal subscription tracker. Prior to version 4.7.0, a stored cross-site scripting XSS vulnerability in the payment method rename endpoint allows any authenticated user to inject arbitrary JavaScript that executes when any user visits the Settings,...
CVE-2026-22322 Stored Cross‑Site Scripting in Link Aggregation Name Handling
A stored cross‑site scripting XSS vulnerability in the Link Aggregation configuration interface allows an unauthenticated remote attacker to create a trunk entry containing malicious HTML/JavaScript code. When the affected page is viewed, the injected script executes in the context of the victim’...
CVE-2026-22322 Stored Cross‑Site Scripting in Link Aggregation Name Handling
A stored cross‑site scripting XSS vulnerability in the Link Aggregation configuration interface allows an unauthenticated remote attacker to create a trunk entry containing malicious HTML/JavaScript code. When the affected page is viewed, the injected script executes in the context of the victim’...
CVE-2026-27177 MajorDoMo Stored Cross-Site Scripting via Property Set Endpoint
MajorDoMo aka Major Domestic Module contains a stored cross-site scripting XSS vulnerability via the /objects/?op=set endpoint, which is intentionally unauthenticated for IoT device integration. User-supplied property values are stored raw in the database without sanitization. When an administrat...
CVE-2025-41748
An XSS vulnerability in pxcDot1xCfg.php can be used by an unauthenticated remote attacker to trick an authenticated user to click on the link provided by the attacker in order to change parameters available via web based management WBM. The vulnerability does not provide access to system-level...
CVE-2025-41750
An XSS vulnerability in pxcPortCfg.php can be used by an unauthenticated remote attacker to trick an authenticated user to click on the link provided by the attacker in order to change parameters available via web based management WBM. The vulnerability does not provide access to system-level...
CVE-2025-41746 Reflected XSS vulnerability in pxc_portSecCfg.php
An XSS vulnerability in pxcportSecCfg.php can be used by an unauthenticated remote attacker to trick an authenticated user to send a manipulated POST request to the device in order to change parameters available via web based management WBM. The vulnerability does not provide access to system-lev...
CVE-2025-41747 Reflected XSS vulnerability in pxc_vlanIntfCfg.php
An XSS vulnerability in pxcvlanIntfCfg.php can be used by an unauthenticated remote attacker to trick an authenticated user to send a manipulated POST request to the device in order to change parameters available via web based management WBM. The vulnerability does not provide access to...
EUVD-2013-3569
Malware in sbrugna...
EUVD-2021-26828
Malware in sbrugna...
EUVD-2023-1360
Malicious code in bioql PyPI...
CVE-2013-3636
ProjectPier 0.8.8 has a Remote Information Disclosure Weakness because of the lack of the HttpOnly cookie flag...
Cookie Poisoning
Quarkus-HTTP is vulnerable to Cookie Poisoning. The vulnerability is due to improper parsing of cookies with specific value-delimiting characters, allowing attackers to exfiltrate HttpOnly cookie values or spoof arbitrary additional cookie values...
CVE-2023-4639 Undertow: cookie smuggling/spoofing
A flaw was found in Undertow, which incorrectly parses cookies with certain value-delimiting characters in incoming requests. This issue could allow an attacker to construct a cookie value to exfiltrate HttpOnly cookie values or spoof arbitrary additional cookie values, leading to unauthorized da...
Openfind MailGates and Openfind MailAudit Security Vulnerabilities
Openfind MailGates and Openfind MailAudit are both products of China's Openfind Corporation.Openfind MailGates is an email security system. Openfind MailGates is an email security system that supports email filtering and APT attack defense, etc. Openfind MailAudit is a software for enterprise ema...
CVE-2023-4639
A flaw was found in Undertow, which incorrectly parses cookies with certain value-delimiting characters in incoming requests. This issue could allow an attacker to construct a cookie value to exfiltrate HttpOnly cookie values or spoof arbitrary additional cookie values, leading to unauthorized da...
