2188 matches found
CVE-2025-2611 ICTBroadcast <= 7.4 Unauthenticated Session Cookie RCE
The ICTBroadcast application unsafely passes session cookie data to shell processing, allowing an attacker to inject shell commands into a session cookie that get executed on the server. This results in unauthenticated remote code execution in the session handling. Versions 7.4 and below are know...
CVE-2025-2611
ICTBroadcast
PT-2025-31997 · Unknown · Concrete Cms
Name of the Vulnerable Software and Affected Versions: Concrete CMS versions 9.0.0 through 9.4.2 Concrete CMS versions prior to 8.5.21 Description: The software is vulnerable to Reflected Cross-Site Scripting XSS in the Conversation Messages Dashboard Page. Unsanitized input could lead to session...
CVE-2025-40980
A Stored Cross Site Scripting vulnerability has been found in UltimatePOS by UltimateFosters. This vulnerability is due to the lack of proper validation of user inputs via ‘/products//edit’, affecting to ‘name’ parameter via POST. The vulnerability could allow a remote attacker to send a speciall...
CVE-2025-40980
Summary: CVE-2025-40980 is a Stored XSS in UltimatePOS by UltimateFosters. An unsanitized value in the name field of POST requests to /products//edit can be reflected in pages (e.g., Reports/Activity Log), enabling an authenticated attacker to execute arbitrary JavaScript in an admin/user browser...
CVE-2025-40980 ddd
A Stored Cross Site Scripting vulnerability has been found in UltimatePOS by UltimateFosters. This vulnerability is due to the lack of proper validation of user inputs via ‘/products//edit’, affecting to ‘name’ parameter via POST. The vulnerability could allow a remote attacker to send a speciall...
Google Launches DBSC Open Beta in Chrome and Enhances Patch Transparency via Project Zero
Google has announced that it's making a security feature called Device Bound Session Credentials DBSC in open beta to ensure that users are safeguarded against session cookie theft attacks. DBSC, first introduced as a prototype in April 2024, is designed to bind authentication sessions to a devic...
The vulnerability of the Wing FTP server, related to improper checking of the value of the session cookie file UID, allows a hacker to disclose protected information.
The vulnerability of the Wing FTP server is related to improper checking of the value of the session cookie file UID at the /loginok.html endpoint. Exploiting this vulnerability can allow an attacker, operating remotely, to disclose sensitive information...
CVE-2025-53757
This vulnerability exists in Digisol DG-GR6821AC Router due to misconfiguration of both Secure and HttpOnly flags on session cookies associated with the router web interface. A remote attacker could exploit this vulnerability by capturing the session cookies transmitted over an unsecure HTTP...
CVE-2024-27779
An insufficient session expiration vulnerability CWE-613 in FortiSandbox FortiSandbox version 4.4.4 and below, version 4.2.6 and below, 4.0 all versions, 3.2 all versions and FortiIsolator version 2.4 and below, 2.3 all versions, 2.2 all versions, 2.1 all versions, 2.0 all versions, 1.2 all...
CVE-2024-27779
An insufficient session expiration vulnerability CWE-613 in FortiSandbox FortiSandbox version 4.4.4 and below, version 4.2.6 and below, 4.0 all versions, 3.2 all versions and FortiIsolator version 2.4 and below, 2.3 all versions, 2.2 all versions, 2.1 all versions, 2.0 all versions, 1.2 all...
CVE-2024-27779
CVE-2024-27779 concerns an insufficient session expiration (CWE-613) in Fortinet FortiSandbox and FortiIsolator. Affected: FortiSandbox versions before 4.4.5 (and 4.0–4.2.6) and FortiIsolator versions before 2.4 (and 1.2–2.3). Impact: a remote attacker with a valid admin session cookie can contin...
CVE-2024-27779
An insufficient session expiration vulnerability CWE-613 in FortiSandbox FortiSandbox version 4.4.4 and below, version 4.2.6 and below, 4.0 all versions, 3.2 all versions and FortiIsolator version 2.4 and below, 2.3 all versions, 2.2 all versions, 2.1 all versions, 2.0 all versions, 1.2 all...
CVE-2024-27779
An insufficient session expiration vulnerability CWE-613 in FortiSandbox FortiSandbox version 4.4.4 and below, version 4.2.6 and below, 4.0 all versions, 3.2 all versions and FortiIsolator version 2.4 and below, 2.3 all versions, 2.2 all versions, 2.1 all versions, 2.0 all versions, 1.2 all...
Digisol DG-GR6821AC Router 安全漏洞
Digisol DG-GR6821AC Router is a WiFi router from Digisol India. A security vulnerability exists in the Digisol DG-GR6821AC Router, which stems from the session cookie not being configured with the Secure and HttpOnly flags, which could lead to a remote attacker obtaining sensitive information...
PT-2025-29820 · Digisol · Digisol Dg-Gr6821Ac Router
Name of the Vulnerable Software and Affected Versions: Digisol DG-GR6821AC Router affected versions not specified Description: The Digisol DG-GR6821AC Router is susceptible to a misconfiguration regarding the Secure and HttpOnly flags on session cookies associated with the router web interface. A...
The vulnerability of the Session Cookie Handler component in the microprogramming-based Ethernet modules WISE-4010LAN, WISE-4050LAN, and WISE-4060LAN allows a hacker to obtain user passwords by force.
The vulnerability of the Session Cookie Handler component in the microprogramming-based Ethernet modules WISE-4010LAN, WISE-4050LAN, and WISE-4060LAN relates to the ability to retrieve user credentials. Exploiting this vulnerability could allow a malicious actor to obtain user passwords through...
CVE-2025-27453
The HttpOnly flag is set to false on the PHPSESSION cookie. Therefore, the cookie can be accessed by other sources such as JavaScript...
CVE-2025-27450
The Secure attribute is missing on multiple cookies provided by the MEAC300-FNADE4. An attacker can trick a user to establish an unencrypted HTTP connection to the server and intercept the request containing the PHPSESSID cookie...