2894 matches found
Revive Adserver 5.1.0 Cross Site Scripting
======================================================================== Revive Adserver Security Advisory REVIVE-SA-2021-002 ------------------------------------------------------------------------ https://www.revive-adserver.com/security/revive-sa-2021-002...
Revive Adserver 5.0.5 Cross Site Scripting / Open Redirect
======================================================================== Revive Adserver Security Advisory REVIVE-SA-2021-001 ------------------------------------------------------------------------ https://www.revive-adserver.com/security/revive-sa-2021-001...
IBM BigFix Inventory Code Issue Vulnerability
IBM BigFix Inventory is a suite of solutions for software control and security risk mitigation from IBM USA. A security vulnerability exists in versions prior to IBM BigFix Inventory v10.0.2 that stems from a failure to set a security flag for a session cookie in an https session, which could...
CVE-2021-3113: Direct Request
Netsia SEBA+ through 0.16.1 build 70-e669dcd7 allows remote attackers to discover session cookies via a direct /session/list/allActiveSession request. For example, the attacker can discover the admin's cookie if the admin account happens to be logged in when the allActiveSession request occurs, a...
Session Information Disclosure Vulnerability
Session is a new type of encrypted private messenger open-sourced by Oxen. An information disclosure vulnerability exists in Netsia SEBA+ version 0.16.1 build 70-e669dcd7, which can be exploited by an attacker to discover a session cookie via a direct session list allActiveSession request...
Alumni Management System 1.0 - _Last Name field in Registration page_ Stored XSS
Exploit Title: Alumni Management System 1.0 - "Last Name field in Registration page" Stored XSS Exploit Author: Siva Rajendran Date: 2020-12-31 Vendor Homepage: https://www.sourcecodester.com/php/14524/alumni-management-system-using-phpmysql-source-code.html Software Link:...
CVE-2020-26732
SKYWORTH GN542VF Hardware Version 2.0 and Software Version 2.0.0.16 does not set the Secure flag for the session cookie in an HTTPS session, which makes it easier for remote attackers to capture this cookie by intercepting its transmission within an HTTP session...
CVE-2020-26732
SKYWORTH GN542VF Hardware Version 2.0 and Software Version 2.0.0.16 does not set the Secure flag for the session cookie in an HTTPS session, which makes it easier for remote attackers to capture this cookie by intercepting its transmission within an HTTP session...
CVE-2020-26732
The CVE affects SKYWORTH GN542VF devices: Hardware Version 2.0 and Software Version 2.0.0.16 have session cookies that do not set the Secure flag in HTTPS, enabling potential cookie capture over HTTP sessions. Related entries also mention Boa version 0.94.13. The impact is confidentiality loss if...
CVE-2020-26732: Missing Encryption of Sensitive Data
SKYWORTH GN542VF Hardware Version 2.0 and Software Version 2.0.0.16 does not set the Secure flag for the session cookie in an HTTPS session, which makes it easier for remote attackers to capture this cookie by intercepting its transmission within an HTTP session...
PT-2021-11266 · Skyworth · Skyworth Gn542Vf
Name of the Vulnerable Software and Affected Versions: SKYWORTH GN542VF Hardware Version 2.0 and Software Version 2.0.0.16 SKYWORTH GN542VF Boa version 0.94.13 Description: The issue is related to the session cookie in an HTTPS session not having the Secure flag set, making it easier for remote...
CVE-2020-26732
SKYWORTH GN542VF Hardware Version 2.0 and Software Version 2.0.0.16 does not set the Secure flag for the session cookie in an HTTPS session, which makes it easier for remote attackers to capture this cookie by intercepting its transmission within an HTTP session...
MK-AUTH Cross-Site Scripting Vulnerability
MK-AUTH is an access control system developed by Pedro Filho, an individual developer in Brazil. A cross-site scripting vulnerability exists in MK-AUTH through version 19.01 K4.9, which originates in the tipo parameter of the admin log ajax.php. An attacker can exploit the vulnerability to read t...
Online Learning Management System 1.0 Remote Command Execution
Exploit Title: Online Learning Management System 1.0 - RCE Authenticated Date: 01.01.2021 Exploit Author: Bedri Sertkaya Vendor Homepage: https://www.sourcecodester.com/php/7339/learning-management-system.html Software Link:...
CVE-2021-21494
MK-AUTH through 19.01 K4.9 allows XSS via the admin/logsajax.php tipo parameter. An attacker can leverage this to read the centralmka2 session token cookie, which is not set to HTTPOnly...
PT-2020-6687 · Apache · Apache Airflow
Name of the Vulnerable Software and Affected Versions: Apache Airflow versions prior to 1.10.14 Description: The issue is related to incorrect session validation in the Apache Airflow web server, caused by the use of a default configuration that includes a pre-set secret key. This allows a...
Security Bulletin: Datacap Taskmaster Capture is affected by vulnerable to using a cookie without the "secure" attribute
Summary AppScan found that an encrypted session SSL is using a cookie without the "secure" attribute and this can be fixed by adding a setting in web.config file Vulnerability Details Third Party Entry: PSIRT-ADV0026307 DESCRIPTION: Created from Advisory: ADV0026307 CVSS Base score: 4.3 CVSS...
CVE-2020-14248
BigFix Inventory up to v10.0.2 does not set the secure flag for the session cookie in an https session, which can cause the cookie to be sent in http requests and make it easier for remote attackers to capture this cookie...
CVE-2020-14248
BigFix Inventory up to v10.0.2 does not set the secure flag for the session cookie in an https session, which can cause the cookie to be sent in http requests and make it easier for remote attackers to capture this cookie...
Design/Logic Flaw
BigFix Inventory up to v10.0.2 does not set the secure flag for the session cookie in an https session, which can cause the cookie to be sent in http requests and make it easier for remote attackers to capture this cookie...