CVE-2024-43180

IBM Concert 1.0 does not set the secure attribute on authorization tokens or session cookies. Attackers may be able to get the cookie values by sending a http:// link to a user or by planting this link in a site the user goes to. The cookie will be sent to the insecure link and the attacker can...

CVE-2024-43180

IBM Concert Software 1.0 is affected by CVE-2024-43180 due to not setting the Secure attribute on authorization tokens or session cookies, enabling potential session hijacking when a user clicks an HTTP link. Affected product/version: IBM Concert Software 1.0. Root cause: cookies not marked secur...

CVE-2024-43180 IBM Concert information disclosure

IBM Concert 1.0 does not set the secure attribute on authorization tokens or session cookies. Attackers may be able to get the cookie values by sending a http:// link to a user or by planting this link in a site the user goes to. The cookie will be sent to the insecure link and the attacker can...

CVE-2024-5789: Improper Neutralization of Input During Web Page Generation

The Triton Lite theme for WordPress is vulnerable to Stored Cross-Site Scripting via the 'url' attribute within the theme's Button shortcode in all versions up to, and including, 1.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, wi...

CVE-2024-43180: Sensitive Cookie in HTTPS Session Without 'Secure' Attribute

IBM Concert 1.0 does not set the secure attribute on authorization tokens or session cookies. Attackers may be able to get the cookie values by sending a http:// link to a user or by planting this link in a site the user goes to. The cookie will be sent to the insecure link and the attacker can...

PT-2024-37155 · WordPress · Triton Lite

Name of the Vulnerable Software and Affected Versions: Triton Lite theme for WordPress versions up to, and including, 1.3 Description: The issue is related to Stored Cross-Site Scripting via the url attribute within the theme's Button shortcode due to insufficient input sanitization and output...

PT-2024-37412

Name of the Vulnerable Software and Affected Versions: BT: Classic affected versions not specified Description: The issue concerns an SDP OOB access vulnerability in the get att search list function of BT Classic. Recommendations: At the moment, there is no information about a newer version that...

CVE-2024-6018 Music Request Manager <= 1.3 - Reflected XSS

The Music Request Manager WordPress plugin through 1.3 does not escape the $SERVER'REQUESTURI' parameter before outputting it back in an attribute, which could lead to Reflected Cross-Site Scripting in old web browsers...

PT-2024-30361

Name of the Vulnerable Software and Affected Versions IBM Concert version 1.0 Description The issue concerns the exposure of sensitive cookie information due to the missing secure attribute on authorization tokens or session cookies. Attackers can exploit this by sending a user a http:// link or ...

CVE-2024-44575

RELY-PCIe v22.2.1 to v23.1.0 does not set the Secure attribute for sensitive cookies in HTTPS sessions, which could cause the user agent to send those cookies in cleartext over an HTTP session...

CVE-2024-44575

RELY-PCIe v22.2.1 to v23.1.0 does not set the Secure attribute for sensitive cookies in HTTPS sessions, which could cause the user agent to send those cookies in cleartext over an HTTP session...

CVE-2024-44575

The RELY-PCIe smart pluggable board, specifically versions v22.2.1 through v23.1.0 , fails to set the Secure attribute for sensitive cookies during HTTPS sessions. This missing attribute can cause user agents to transmit these sensitive cookies in cleartext over an unencrypted HTTP session. To mi...

CVE-2024-44575: Incorrect Permission Assignment for Critical Resource

RELY-PCIe v22.2.1 to v23.1.0 does not set the Secure attribute for sensitive cookies in HTTPS sessions, which could cause the user agent to send those cookies in cleartext over an HTTP session...

PT-2024-31190 · Rely-Pcie · Rely-Pcie

Name of the Vulnerable Software and Affected Versions: RELY-PCIe versions 22.2.1 through 23.1.0 Description: The issue is related to the failure of setting the Secure attribute for sensitive cookies in HTTPS sessions. This could cause the user agent to send those cookies in cleartext over an HTTP...

CVE-2024-44575

RELY-PCIe v22.2.1 to v23.1.0 does not set the Secure attribute for sensitive cookies in HTTPS sessions, which could cause the user agent to send those cookies in cleartext over an HTTP session...

CVE-2024-44575

RELY-PCIe v22.2.1 to v23.1.0 does not set the Secure attribute for sensitive cookies in HTTPS sessions, which could cause the user agent to send those cookies in cleartext over an HTTP session...

Keycloak Denial of Service vulnerability

A denial of service vulnerability was found in keycloak where the amount of attributes per object is not limited, an attacker by sending repeated HTTP requests could cause a resource exhaustion when the application send back rows with long attribute values. The issue is fixed in Keycloak 24 with...

com.charlyghislain.keycloak:keycloak-importexport (>=11.0.1, <=11.0.2), com.manydesigns:demo-tt (>=5.2.0, <=5.2.1) +82 more potentially affected by CVE-2023-6841 via org.keycloak:keycloak-core (11.0.2)

org.keycloak:keycloak-core MAVEN version 11.0.2 is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-core and may be impacted: - com.charlyghislain.keycloak:keycloak-importexport =11.0.1, =5.2.0, =5.2.0, =1.1.0, =0.1.0, =0.0.3, =0.49,...

Content Spoofing

angular is vulnerable to Content Spoofing. The vulnerability is caused due to improper sanitization of the value of the srcset attribute in HTML elements. This allows attackers to bypass common image source restrictions, which can lead to a form of Content Spoofing...

WordPress Nova Blocks by Pixelgrade plugin <= 2.1.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via align Attribute vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting via align Attribute vulnerability discovered by Francesco Carlucci in WordPress Plugin Nova Blocks versions = 2.1.7...