Linux Distros Unpatched Vulnerability : CVE-2020-7070

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In PHP versions 7.2.x below 7.2.34, 7.3.x below 7.3.23 and 7.4.x below 7.4.11, when PHP is processing incoming HTTP cookie values, the cookie names are...

Linux Distros Unpatched Vulnerability : CVE-2024-58134

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Mojolicious versions from 0.999922 for Perl uses a hard coded string, or the application's class name, as an HMAC session cookie secret by default. These...

CVE-2025-34060

CVE-2025-34060 describes a PHP object/objection injection in Monero Project’s Laravel-based forum software via the /get/image/ endpoint. The app passes a user-supplied link parameter directly to file_get_contents() without validation; MIME-type checks via finfo can be bypassed with crafted stream...

CVE-2025-34060 Monero Forum Remote Code Execution via Arbitrary File Read and Cookie Forgery

A PHP objection injection vulnerability exists in the Monero Project’s Laravel-based forum software due to unsafe handling of untrusted input in the /get/image/ endpoint. The application passes a user-supplied link parameter directly to filegetcontents without validation. MIME type checks using...

CVE-2025-34060 Monero Forum Remote Code Execution via Arbitrary File Read and Cookie Forgery

A PHP objection injection vulnerability exists in the Monero Project’s Laravel-based forum software due to unsafe handling of untrusted input in the /get/image/ endpoint. The application passes a user-supplied link parameter directly to filegetcontents without validation. MIME type checks using...

CVE-2024-58134

Mojolicious versions from 0.999922 for Perl uses a hard coded string, or the application's class name, as an HMAC session cookie secret by default. These predictable default secrets can be exploited by an attacker to forge session cookies. An attacker who knows or guesses the secret could compute...

CVE-2024-58134

Mojolicious versions from 0.999922 for Perl uses a hard coded string, or the application's class name, as an HMAC session cookie secret by default. These predictable default secrets can be exploited by an attacker to forge session cookies. An attacker who knows or guesses the secret could compute...

CVE-2024-58134

Mojolicious versions from 0.999922 for Perl uses a hard coded string, or the application's class name, as an HMAC session cookie secret by default. These predictable default secrets can be exploited by an attacker to forge session cookies. An attacker who knows or guesses the secret could compute...

CVE-2024-58134

CVE-2024-58134 (Mojolicious on Perl): Affected versions are Mojolicious 0.999922 and later up to 9.39, where the HMAC session cookie secret is derived from a hard-coded string or the app class name by default. This predictable secret enables an attacker who learns or guesses the secret to forge v...

PT-2025-18947 · Unknown +1 · Mojolicious +1

Name of the Vulnerable Software and Affected Versions: Mojolicious versions 0.999922 through 9.39 Description: The issue concerns the use of a hard-coded string or the application's class name as a HMAC session secret by default in Mojolicious for Perl. This predictable default secret can be...

CVE-2024-3408

man-group/dtale version 3.10.0 is vulnerable to an authentication bypass and remote code execution RCE due to improper input validation. The vulnerability arises from a hardcoded SECRETKEY in the flask configuration, allowing attackers to forge a session cookie if authentication is enabled...

The vulnerability of the SSO authentication mechanism of the universal monitoring system Zabbix allows attackers to circumvent existing security restrictions and enhance their privileges.

The vulnerability of the Single Sign-On SSO authentication mechanism of the universal monitoring system Zabbix relates to the ability to bypass authentication through spoofing. Exploiting this vulnerability allows a malicious actor to circumvent existing security restrictions and enhance their...

SUSE CVE-2024-36466

A bug in the code allows an attacker to sign a forged zbxsession cookie, which then allows them to sign in with admin permissions...

DEBIAN-CVE-2024-36466

A bug in the code allows an attacker to sign a forged zbxsession cookie, which then allows them to sign in with admin permissions...

CVE-2024-36466

A bug in the code allows an attacker to sign a forged zbxsession cookie, which then allows them to sign in with admin permissions...

UBUNTU-CVE-2024-36466

A bug in the code allows an attacker to sign a forged zbxsession cookie, which then allows them to sign in with admin permissions...

D-Tale Input Validation Error Vulnerability

Man Group D-Tale is a pandas data structure visualization tool from Man Group, Inc. An input validation error vulnerability exists in D-Tale, which stems from a hard-coded SECRETKEY in the flask configuration, which allows an attacker to forge a session cookie if authentication is enabled...

PT-2024-3608 · Cacti · Cacti

Name of the Vulnerable Software and Affected Versions: Cacti versions 1.3.x Description: A reflected cross-site scripting issue in Cacti allows attackers to obtain cookies of administrator and other users and fake their login using obtained cookies. This is related to the lack of measures to...

Apache Superset Signed Cookie RCE

Apache Superset versions use exploit/linux/http/apache/supersetcookiesigrce msf undefinedsupersetcookiesigrce show actions ...actions... msf undefinedsupersetcookiesigrce set ACTION msf undefinedsupersetcookiesigrce show options ...show and set options... msf undefinedsupersetcookiesigrce run Thi...

SUSE CVE-2020-7070

In PHP versions 7.2.x below 7.2.34, 7.3.x below 7.3.23 and 7.4.x below 7.4.11, when PHP is processing incoming HTTP cookie values, the cookie names are url-decoded. This may lead to cookies with prefixes like Host confused with cookies that decode to such prefix, thus leading to an attacker being...