UBUNTU-CVE-2023-45725

Design document functions which receive a user http request object may expose authorization or session cookie headers of the user who accesses the document. These design document functions are: list show rewrite update An attacker can leak the session component using an HTML-like output,...

CVE-2023-45725

CVE-2023-45725 is a vulnerability affecting IBM Planning Analytics Local (IBM Planning Analytics Workspace) 2.1 and 2.0. It concerns design document functions that receive a user HTTP request object, which may expose authorization or session cookie headers. The attack, as described, requires the ...

Oracle Linux 8 : tomcat (ELSA-2023-7065)

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2023-7065 advisory. - Resolves: 2210630 CVE-2023-28709 tomcat - Resolves: 2181448 CVE-2023-28708 tomcat: not including the secure attribute causes information disclosure...

CVE-2023-48240

XWiki Platform is a generic wiki platform. The rendered diff in XWiki embeds images to be able to compare the contents and not display a difference for an actually unchanged image. For this, XWiki requests all embedded images on the server side. These requests are also sent for images from other...

Oracle Linux 9 : tomcat (ELSA-2023-6570)

The remote Oracle Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2023-6570 advisory. - Resolves: 2210632 CVE-2023-28709 tomcat - Resolves: 2181461 CVE-2023-28708 tomcat: not including the secure attribute causes information - Resolves:...

The vulnerability of Moxa PT-G503 Ethernet switches’ microprogramming software lies in the absence of a “secure” flag in session cookies, allowing attackers to gain unauthorized access to protected information.

The vulnerability of Moxa PT-G503 Ethernet switches’ microprogramming software is related to the absence of a “secure” flag in the session cookie files. Exploiting this vulnerability can allow an attacker operating remotely to gain unauthorized access to protected information...

CVE-2023-47628

CVE-2023-47628 describes a session-management flaw in DataHub Frontend where Play Framework default settings create a stateless cookie without expiration. The root cause is a cookie policy that does not set an expiration time, compounded by use of LegacyCookiesModule, making a leaked session cook...

PT-2023-30330 · Typo3 · Typo3

Name of the Vulnerable Software and Affected Versions: TYPO3 versions prior to 8.7.55 TYPO3 versions prior to 9.5.44 TYPO3 versions prior to 10.4.41 TYPO3 versions prior to 11.5.33 TYPO3 versions prior to 12.4.8 Description: The issue affects TYPO3 installations with at least two different sites,...

CVE-2023-38363

IBM CICS TX Advanced 10.1 does not set the secure attribute on authorization tokens or session cookies. Attackers may be able to get the cookie values by sending a http:// link to a user or by planting this link in a site the user goes to. The cookie will be sent to the insecure link and the...

Authorization

IBM CICS TX Advanced 10.1 does not set the secure attribute on authorization tokens or session cookies. Attackers may be able to get the cookie values by sending a http:// link to a user or by planting this link in a site the user goes to. The cookie will be sent to the insecure link and the...

CVE-2023-38363 IBM CICS TX information disclosure

IBM CICS TX Advanced 10.1 does not set the secure attribute on authorization tokens or session cookies. Attackers may be able to get the cookie values by sending a http:// link to a user or by planting this link in a site the user goes to. The cookie will be sent to the insecure link and the...

CVE-2023-38363 IBM CICS TX information disclosure

IBM CICS TX Advanced 10.1 does not set the secure attribute on authorization tokens or session cookies. Attackers may be able to get the cookie values by sending a http:// link to a user or by planting this link in a site the user goes to. The cookie will be sent to the insecure link and the...

PT-2023-26386 · Ibm · Ibm Cics Tx Advanced

Name of the Vulnerable Software and Affected Versions: IBM CICS TX Advanced version 10.1 Description: The issue arises because IBM CICS TX Advanced does not set the secure attribute on authorization tokens or session cookies. This allows attackers to potentially obtain cookie values by sending a...

Threat Actors Leverage File-Sharing Service and Reverse Proxies for Credential Harvesting

We analyzed a phishing campaign involving malicious emails containing a link to a file-sharing solution, which further leads to a PDF document with a secondary link designed to steal login info and session cookies...

tomcat: not including the secure attribute causes information disclosure

When using the RemoteIpFilter with requests received from a reverse proxy via HTTP that include the X-Forwarded-Proto header set to https, session cookies created by Apache Tomcat 11.0.0-M1 to 11.0.0.-M2, 10.1.0-M1 to 10.1.5, 9.0.0-M1 to 9.0.71 and 8.5.0 to 8.5.85 did not include the secure...

RHEL 9 : tomcat (RHSA-2023:6570)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2023:6570 advisory. Apache Tomcat is a servlet container for the Java Servlet and JavaServer Pages JSP technologies. Security Fixes: Apache Commons FileUpload:...

CVE-2023-4217

A vulnerability has been identified in PT-G503 Series versions prior to v5.2, where the session cookies attribute is not set properly in the affected application. The vulnerability may lead to security risks, potentially exposing user session data to unauthorized access and manipulation...

Information disclosure

A vulnerability has been identified in PT-G503 Series versions prior to v5.2, where the session cookies attribute is not set properly in the affected application. The vulnerability may lead to security risks, potentially exposing user session data to unauthorized access and manipulation...

CVE-2023-4217 Session cookies attribute not set properly

A vulnerability has been identified in PT-G503 Series versions prior to v5.2, where the session cookies attribute is not set properly in the affected application. The vulnerability may lead to security risks, potentially exposing user session data to unauthorized access and manipulation...

CVE-2023-4217 Session cookies attribute not set properly

A vulnerability has been identified in PT-G503 Series versions prior to v5.2, where the session cookies attribute is not set properly in the affected application. The vulnerability may lead to security risks, potentially exposing user session data to unauthorized access and manipulation...