DEBIAN-CVE-2020-7070

In PHP versions 7.2.x below 7.2.34, 7.3.x below 7.3.23 and 7.4.x below 7.4.11, when PHP is processing incoming HTTP cookie values, the cookie names are url-decoded. This may lead to cookies with prefixes like Host confused with cookies that decode to such prefix, thus leading to an attacker being...

CVE-2020-24876

CVE-2020-24876 affects Pancake prior to version 4.13.29, where a hard-coded cryptographic key can be used to forge session cookies. According to multiple sources (NVD entry and Red Hat advisory), this enables remote privilege escalation by forging authenticated sessions. The vulnerability stems f...

CVE-2020-8184

A reliance on cookies without validation/integrity check security vulnerability exists in rack 2.2.3, rack 2.1.4 that makes it is possible for an attacker to forge a secure or host-only cookie prefix...

Yinchuan Xunlei Network Technology Co., Ltd. website building system has overstepped the right to access vulnerabilities

Yinchuan Xunlei Network Technology Co., Ltd. is one of the Internet application service providers in Ningxia. There is an access vulnerability in the website building system of Yinchuan Xunlei Network Technology Co. Attackers can take advantage of the vulnerability to access the background and...

ANCMS has a design flaw vulnerability

Anan Web Content Management System ANCMS is a web content management system. A design flaw vulnerability exists in ANCMS. The vulnerability is caused due to the relatively fixed settings of the database field names, which can be used by an attacker to forge cookie information, log in to the...

Xionghai CMS v1.0 Backend Login Bypass Vulnerability

XIONGHAI CMS is developed by XIONGHAI a set of applications for personal blogs, personal websites, corporate websites, a set of integrated website management system. XIONGHAI CMS v1.0 there is a backend privilege bypass vulnerability, attackers can forge COOKIE bypass login detection, successfull...

Yahoo Reveals 32 Million Accounts Were Hacked Using 'Cookie Forging Attack'

Yahoo has just revealed that around 32 million user accounts were accessed by hackers in the last two years using a sophisticated cookie forging attack without any password. These compromised accounts are in addition to the Yahoo accounts affected by the two massive data breaches that the company...

AWCM 2.2 Access Bypass

Vulnerability Report AWCM 2.2 CVE-Candidate-ID: CVE-2012-2437, CVE-2012-2438 Issue: Access Control Bug in AWCM 2.2, Anyone can build the cookie and inserts DB records. Author: Sooel Son sonpostman at gmail dot com Source Code: http://sourceforge.net/projects/awcm/ 1. Details: CVE-2012-2437 Withou...