Apache Tomcat 11.0.0.M1 < 11.0.0.M3 multiple vulnerabilities

The version of Tomcat installed on the remote host is prior to 11.0.0.M3. It is, therefore, affected by multiple vulnerabilities as referenced in the fixedinapachetomcat11.0.0-m3security-11 advisory. - When using the RemoteIpFilter with requests received from a reverse proxy via HTTP that include...

CVE-2021-43074

An improper verification of cryptographic signature vulnerability CWE-347 in FortiWeb 6.4 all versions, 6.3.16 and below, 6.2 all versions, 6.1 all versions, 6.0 all versions; FortiOS 7.0.3 and below, 6.4.8 and below, 6.2 all versions, 6.0 all versions; FortiSwitch 7.0.3 and below, 6.4.10 and...

SUSE CVE-2008-3663

Squirrelmail 1.4.15 does not set the secure flag for the session cookie in an https session, which can cause the cookie to be sent in http requests and make it easier for remote attackers to capture this cookie...

SUSE CVE-2012-2144

Session fixation vulnerability in OpenStack Dashboard Horizon folsom-1 and 2012.1 allows remote attackers to hijack web sessions via the sessionid cookie...

SUSE CVE-2022-0959

A malicious, but authorised and authenticated user can construct an HTTP request using their existing CSRF token and session cookie to manually upload files to any location that the operating system user account under which pgAdmin is running has permission to write...

SA45653 - Cross-site Request Forgery in Login Form

Last Modified Date 23.08.2026 23:31:03...

CVE-2023-25562 Failure to Invalidate Session on Logout in DataHub

DataHub is an open-source metadata platform. In versions of DataHub prior to 0.8.45 Session cookies are only cleared on new sign-in events and not on logout events. Any authentication checks using the AuthUtils.hasValidSessionCookie method could be bypassed by using a cookie from a logged out...

CVE-2023-25562 Failure to Invalidate Session on Logout in DataHub

DataHub is an open-source metadata platform. In versions of DataHub prior to 0.8.45 Session cookies are only cleared on new sign-in events and not on logout events. Any authentication checks using the AuthUtils.hasValidSessionCookie method could be bypassed by using a cookie from a logged out...

CVE-2022-3083

All versions of Landis+Gyr E850 ZMQ200 are vulnerable to CWE-784: Reliance on Cookies Without Validation and Integrity. The device's web application navigation depends on the value of the session cookie. The web application could become inaccessible for the user if an attacker changes the cookie...

PT-2023-13020 · Landis+Gyr · Landis+Gyr E850

Name of the Vulnerable Software and Affected Versions: Landis+Gyr E850 ZMQ200 versions all Description: The device's web application navigation depends on the value of the session cookie. If an attacker changes the session cookie values, the web application could become inaccessible for the user...

CVE-2022-3083: Reliance on Cookies without Validation and Integrity Checking in a Security Decision

All versions of Landis+Gyr E850 ZMQ200 are vulnerable to CWE-784: Reliance on Cookies Without Validation and Integrity. The device's web application navigation depends on the value of the session cookie. The web application could become inaccessible for the user if an attacker changes the cookie...

School-Management-System 跨站脚本漏洞

School-Management-System is a school management system by the individual developer Lahiru Danushka. A security vulnerability exists in School-Management-System version v3.0.1, which stems from the presence of cross-site scripting XSS, which allows a normal user to steal an administrator user's...

CVE-2022-46087

CloudSchool v3.0.1 is affected by Cross-Site Scripting (XSS) via admin notifications, allowing a normal user to steal admin session cookies. The issue is documented with a PoC and public advisories; exploitation exists in reported PoCs. Remediation: upgrade to a version that includes a fix for th...

Landis+Gyr E850 安全漏洞

The Landis+Gyr E850 is a high-precision meter from Landis+Gyr designed for use in power plants, photovoltaic power generation, onshore and offshore wind farms, transmission networks, substations, railroad infrastructures, and grid-connected commercial and industrial consumers. A security...

PT-2023-9596

Name of the Vulnerable Software and Affected Versions Sentry SDK versions prior to 1.14.0 Description The issue is related to the leakage of sensitive cookie values, including session cookies, to Sentry when using the Django integration of the Sentry SDK in a specific configuration. This can occu...

CVE-2023-22732

Shopware is an open source commerce platform based on Symfony Framework and Vue js. The Administration session expiration was set to one week, when an attacker has stolen the session cookie they could use it for a long period of time. In version 6.4.18.1 an automatic logout into the Administratio...

CVE-2023-22732

Shopware administration session expiration was set to one week, enabling reuse of a stolen session cookie. The issue is documented across multiple sources (CVE-2023-22732) and is mitigated by updating to version 6.4.18.1, which adds automatic logout after inactivity. The vulnerability affects the...

CVE-2023-22732 Insufficient Session Expiration in Administration in shopware

Shopware is an open source commerce platform based on Symfony Framework and Vue js. The Administration session expiration was set to one week, when an attacker has stolen the session cookie they could use it for a long period of time. In version 6.4.18.1 an automatic logout into the Administratio...

PT-2023-18674 · Shopware · Shopware

Name of the Vulnerable Software and Affected Versions: Shopware versions prior to 6.4.18.1 Description: The Administration session expiration was set to one week, allowing an attacker who has stolen the session cookie to use it for a long period. An automatic logout into the Administration sessio...

CVE-2023-0044

A flaw was found in Quarkus. If the Quarkus Form Authentication session cookie Path attribute is set to /, then a cross-site attack may be initiated, which might lead to information disclosure. Mitigation This attack can be prevented with the Quarkus CSRF Prevention feature...