CVE-2019-19736

MFScripts YetiShare 3.5.2 through 4.5.3 does not set the HttpOnly flag on session cookies, allowing the cookie to be read by script, which can potentially be used by attackers to obtain the cookie via cross-site scripting...

CVE-2019-14849

A vulnerability was found in 3scale before version 2.6, did not set the HTTPOnly attribute on the user session cookie. An attacker could use this to conduct cross site scripting attacks and gain access to unauthorized information...

CVE-2019-14849

A vulnerability was found in 3scale before version 2.6, did not set the HTTPOnly attribute on the user session cookie. An attacker could use this to conduct cross site scripting attacks and gain access to unauthorized information...

Cross site scripting

A vulnerability was found in 3scale before version 2.6, did not set the HTTPOnly attribute on the user session cookie. An attacker could use this to conduct cross site scripting attacks and gain access to unauthorized information...

CVE-2019-14849

The CVE-2019-14849 entries describe a vulnerability in Red Hat 3scale API Management (before version 2.6) where the user session cookie was not tagged HttpOnly. This omission enables cross-site scripting and potential exposure of unauthorized information. Affected component: 3scale session cookie...

CVE-2019-14849

A vulnerability was found in 3scale before version 2.6, did not set the HTTPOnly attribute on the user session cookie. An attacker could use this to conduct cross site scripting attacks and gain access to unauthorized information...

PT-2019-13856 · Red Hat · 3Scale

Name of the Vulnerable Software and Affected Versions: 3scale versions prior to 2.6 Description: A vulnerability was found that did not set the HTTPOnly attribute on the user session cookie, allowing an attacker to conduct cross-site scripting attacks and gain access to unauthorized information...

CVE-2019-14849

A flaw was found where 3scale did not set the HTTPOnly attribute on the user session cookie. An attacker could abuse this flaw to conduct Cross-site Scripting attacks and gain access to unauthorized information...

Red Hat 3scale Cross-Site Scripting Vulnerability

Red Hat 3scale is a suite of API Application Programming Interface lifecycle management software from Red Hat. A cross-site scripting vulnerability exists in Red Hat 3scale, which stems from a user session cookie that fails to set HTTPOnly, and can be exploited by an attacker to conduct cross-sit...

httpd: mod_session_cookie does not respect expiry time

In Apache HTTP Server 2.4 release 2.4.37 and prior, modsession checks the session expiry time before decoding the session. This causes session expiry time to be ignored for modsessioncookie sessions since the expiry time is loaded when the session is decoded...

HackerOne Breach Leads to $20,000 Bounty Reward

HackerOne has paid out $20,000 after a high-severity vulnerability was discovered in the bug-bounty platform. The flaw allowed an outside bounty hunter to access customers’ reports and other sensitive information. Disclosed this week in a HackerOne report, the security incident stemmed from a...

openSUSE Security Update : phpMyAdmin (openSUSE-2019-2599)

This update for phpMyAdmin fixes the following issues : phpMyAdmin was updated to 4.9.2 : - CVE-2019-18622: SQL injection in Designer feature boo1157614 - Fixes for 'Failed to set session cookie' error - Advisor with MySQL 8.0.3 and newer - Fix PHP deprecation errors - Fix a situation where...

Fedora 30 : phpMyAdmin (2019-8f55b515f1)

Upstream announcement : phpMyAdmin 4.9.2 is released 2019-11-22 Welcome to phpMyAdmin 4.9.2, a bugfix release that also contains a security fix. This security fix is part of an ongoing effort to improve the security of the Designer feature and is designated PMASA-2019-5. There is also an...

OPENSUSE-SU-2019:2599-1 Security update for phpMyAdmin

This update for phpMyAdmin fixes the following issues: phpMyAdmin was updated to 4.9.2: CVE-2019-18622: SQL injection in Designer feature boo1157614 Fixes for 'Failed to set session cookie' error Advisor with MySQL 8.0.3 and newer Fix PHP deprecation errors Fix a situation where exporting users...

HackerOne: Account takeover via leaked session cookie

Summary: You are disclose for me you session Description: you are gevi me your session on last report I am can use your sessionsorry ███ ████████ █████████ Impact HackerOneStaff Access, i can read all reports @security and more program...

Important: Red Hat Security Advisory: Red Hat JBoss Core Services Apache HTTP Server 2.4.37 Security Release on RHEL 7

An update is now available for JBoss Core Services on RHEL 7. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE...

httpd: mod_session_cookie does not respect expiry time

In Apache HTTP Server 2.4 release 2.4.37 and prior, modsession checks the session expiry time before decoding the session. This causes session expiry time to be ignored for modsessioncookie sessions since the expiry time is loaded when the session is decoded...

httpd: mod_session_cookie does not respect expiry time

In Apache HTTP Server 2.4 release 2.4.37 and prior, modsession checks the session expiry time before decoding the session. This causes session expiry time to be ignored for modsessioncookie sessions since the expiry time is loaded when the session is decoded...

Adive Framework 2.0.7 - Privilege Escalation

Adive Framework 2.0.7 - Privilege Escalation Exploit Title: Adive Framework 2.0.7 - Privilege Escalation Date: 2019-08-02 Exploit Author: Pablo Santiago Vendor Homepage: https://www.adive.es/ Software Link: https://github.com/ferdinandmartin/adive-php7 Version: 2.0.7 Tested on: Windows 10 CVE :...

U.S. Dept Of Defense: [HTAF4-213] [Pre-submission] HTTPOnly session cookie exposure on the /csstest endpoint

The HTAF4-213 vulnerability involved the exposure of an HTTPOnly session cookie on the /csstest endpoint. The sensitive cookie information was reflected in the page's content, which should not have been accessible in the DOM...