Linux Distros Unpatched Vulnerability : CVE-2023-30861

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Flask is a lightweight WSGI web application framework. When all of the following conditions are met, a response containing data intended for one client may be...

Linux Distros Unpatched Vulnerability : CVE-2023-32725

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - The website configured in the URL widget will receive a session cookie when testing or executing scheduled reports. The received session cookie can then be used...

PT-2025-9801

Name of the Vulnerable Software and Affected Versions Foreseer Reporting Software FRS versions prior to 1.5.100 Description The issue arises from the secure flag not being set and the SameSite attribute being set to Lax in the Foreseer Reporting Software. This could lead to the session cookie bei...

Security Bulletin: Vulnerability in Flask affects IBM Cloud Pak for Data System 2.0 (CPDS 2.0) [ CVE-2023-30861]

Summary The Flask package is used by IBM Cloud Pak for Data System 2.0 . IBM Cloud Pak for Data System 2.0 has addressed the applicable CVE CVE-2023-30861 Vulnerability Details CVEID:CVE-2023-30861 DESCRIPTION: Pallets Flask could allow a remote attacker to obtain sensitive information, caused by...

CVE-2025-1776 Cross-Site Scripting (XSS) vulnerability in Soteshop

Cross-Site Scripting XSS vulnerability in Soteshop, versions prior to 8.3.4, which could allow remote attackers to execute arbitrary code via the ‘query’ parameter in /app-google-custom-search/searchResults. This vulnerability can be exploited to steal sensitive user data, such as session cookies...

CVE-2025-1230

CVE-2025-1230 : A Stored XSS in Prestashop 8.1.7 allows an attacker to abuse insufficient validation of the link parameter sent to the admin index.php. The root cause is lack of proper input validation, enabling a crafted query to an authenticated user that could lead to cookie session leakage. D...

CVE-2024-57427

PHPJabbers Cinema Booking System v2.0 is vulnerable to reflected cross-site scripting XSS. Multiple endpoints improperly handle user input, allowing malicious scripts to execute in a victim’s browser. Attackers can craft malicious links to steal session cookies or conduct phishing attacks...

CVE-2022-43398

A vulnerability has been identified in POWER METER SICAM Q100 All versions V2.50, POWER METER SICAM Q100 All versions V2.50, POWER METER SICAM Q100 All versions V2.50, POWER METER SICAM Q100 All versions V2.50. Affected devices do not renew the session cookie after login/logout and also accept us...

CVE-2024-57427

PHPJabbers Cinema Booking System v2.0 is vulnerable to reflected cross-site scripting (XSS) due to improper handling of user input across multiple endpoints. An attacker can craft malicious links to execute arbitrary JavaScript in a victim's browser, potentially leading to session cookie theft or...

CVE-2024-3408

man-group/dtale version 3.10.0 is vulnerable to an authentication bypass and remote code execution RCE due to improper input validation. The vulnerability arises from a hardcoded SECRETKEY in the flask configuration, allowing attackers to forge a session cookie if authentication is enabled...

CVE-2024-27917

Shopware is an open commerce platform based on Symfony Framework and Vue. The Symfony Session Handler pops the Session Cookie and assigns it to the Response. Since Shopware 6.5.8.0, the 404 pages are cached to improve the performance of 404 pages. So the cached Response which contains a Session...

CVE-2024-28771: Sensitive Cookie in HTTPS Session Without 'Secure' Attribute

IBM Security Directory Integrator 7.2.0 and IBM Security Verify Directory Integrator 10.0.0 does not set the secure attribute on authorization tokens or session cookies. Attackers may be able to get the cookie values by sending a http:// link to a user or by planting this link in a site the user...

Cross-Site Scripting (XSS) vulnerability in generateNavigation() function in PhpSpreadsheet

Summary The researcher discovered zero-day vulnerability Cross-Site Scripting XSS vulnerability in the code which translates the XLSX file into a HTML representation and displays it in the response. Details When generating the HTML from an xlsx file containing multiple sheets, a navigation menu i...

Cross-site Request Forgery (CSRF)

Overview codechecker is an analyzer tooling, defect database and viewer extension Affected versions of this package are vulnerable to Cross-site Request Forgery CSRF due to missing security attributes from the session cookie. Remediation Upgrade codechecker to version 6.25.0 or higher. References...

Cross-Site Request Forgery in CodeChecker API

Summary Cross-site request forgery allows an unauthenticated attacker to hijack the authentication of a logged in user, and use the web API with the same permissions. Details Security attributes like HttpOnly and SameSite are missing from the session cookie, allowing its use from XHR requests and...

GHSA-F8C8-4PM7-W885 Cross-Site Request Forgery in CodeChecker API

Summary Cross-site request forgery allows an unauthenticated attacker to hijack the authentication of a logged in user, and use the web API with the same permissions. Details Security attributes like HttpOnly and SameSite are missing from the session cookie, allowing its use from XHR requests and...

CVE-2024-55556

A vulnerability in Crater Invoice allows an unauthenticated attacker with knowledge of the APPKEY to achieve remote command execution on the server by manipulating the laravelsession cookie, exploiting arbitrary deserialization through the encrypted session data. The exploitation vector of this...

CVE-2024-55556

The Crater Invoice application (also associated with InvoiceShelf ) is vulnerable to Remote Code Execution (RCE) via unauthenticated PHP deserialization . The flaw exists when the SESSION_DRIVER=cookie option is enabled in the .env file, as session data is stored as a ciphered value within a cook...

CVE-2024-56733

Password Pusher is an open source application to communicate sensitive information over the web. A vulnerability has been reported in versions 1.50.3 and prior where an attacker can copy the session cookie before a user logs out, potentially allowing session hijacking. Although the session token ...

CVE-2024-56733

Password Pusher is an open source application to communicate sensitive information over the web. A vulnerability has been reported in versions 1.50.3 and prior where an attacker can copy the session cookie before a user logs out, potentially allowing session hijacking. Although the session token ...