SUSE CVE-2016-9078

Redirection from an HTTP connection to a "data:" URL assigns the referring site's origin to the "data:" URL in some circumstances. This can result in same-origin violations against a domain if it loads resources from malicious sites. Cross-origin setting of cookies has been demonstrated without t...

CVE-2023-25562 Failure to Invalidate Session on Logout in DataHub

DataHub is an open-source metadata platform. In versions of DataHub prior to 0.8.45 Session cookies are only cleared on new sign-in events and not on logout events. Any authentication checks using the AuthUtils.hasValidSessionCookie method could be bypassed by using a cookie from a logged out...

CVE-2022-45538

EyouCMS = 1.6.0 was discovered a reflected-XSS in the article publish component in cookie "ENVGOBACKURL"...

The vulnerabilities of the Firefox browser, Firefox ESR, and the Thunderbird email client allow attackers to bypass the secure context for cookies with prefixes __Host and __Secure, and re-record these cookies.

The vulnerability of Firefox browsers, Firefox ESR, and the email client Thunderbird lies in the use of cookies with prefixes Host and Secure, without validation or verification of their integrity. Exploiting this vulnerability allows an attacker to bypass the security restrictions for cookies wi...

CVE-2021-40649

In Connx Version 6.2.0.1269 20210623, a cookie can be issued by the application and not have the HttpOnly flag set...

CVE-2021-30118

An attacker can upload files with the privilege of the Web Server process for Kaseya VSA Unified Remote Monitoring & Management RMM 9.5.4.2149 and subsequently use these files to execute asp commands The api /SystemTab/uploader.aspx is vulnerable to an unauthenticated arbitrary file upload leadin...

USN-4994-2 apache2 vulnerabilities

USN-4994-1 fixed several vulnerabilities in Apache. This update provides the corresponding update for Ubuntu 14.04 ESM and Ubuntu 16.04 ESM. Original advisory details: Antonio Morales discovered that the Apache modauthdigest module incorrectly handled certain Digest nonces. A remote attacker coul...

SUSE-SU-2020:2896-1 Security update for php74

This update for php74 fixes the following issues: - CVE-2020-7069: Fixed an issue when AES-CCM mode was used with opensslencrypt function with 12 bytes IV, only first 7 bytes of the IV was used bsc1177351. - CVE-2020-7070: Fixed an issue where percent-encoded cookies could have been used to...

CVE-2019-11018

ThinkAdmin V4.0 contains a vulnerability in the file application/admin/controller/User.php where administrator cookie-based credentials remain valid after a password change. The affected software/version is ThinkAdmin 4.0; root cause is improper invalidation of existing login cookies upon passwor...

Cuvva: Session cookie without secure flag on https://underwriter.partner.cuvva.com

Issue detail The following cookie was issued by the application and does not have the secure flag set: csrf=SPncw9jJEynL2b4TYJqybsdc; Path=/; Session; HostOnly; The cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of...

APPLE-SA-2015-09-30-3 OS X El Capitan 10.11

APPLE-SA-2015-09-30-3 OS X El Capitan 10.11 OS X El Capitan 10.11 is now available and addresses the following: Address Book Available for: Mac OS X v10.6.8 and later Impact: A local attacker may be able to inject arbitrary code to processes loading the Address Book framework Description: An issu...

CVE-2013-1803

Multiple SQL injection vulnerabilities in PHP-Fusion before 7.02.06 allow remote attackers to execute arbitrary SQL commands via the 1 orderby parameter to downloads.php; or remote authenticated users with certain permissions to execute arbitrary SQL commands via a 2 parameter name starting with...

Important: Red Hat Security Advisory: katello security update

Updated katello packages that fix one security issue are now available for Red Hat CloudForms. The Red Hat Security Response Team has rated this update as having important security impact. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available...

Fix the seraph.os.cookie from failing on Tomcat by upgrading atlassian-seraph

Once SER-117 has been fixed, incorporate the changes into JIRA see the linked issue for a full description of the problem. Note that this only affects Tomcat users; Resin and Orion do not appear to be affected. User Symptoms: Users have checked the "Remember my login on this computer" checkbox al...

CVE-2007-4752

ssh in OpenSSH before 4.7 does not properly handle when an untrusted cookie cannot be created and uses a trusted X11 cookie instead, which allows attackers to violate intended policy and gain privileges by causing an X client to be treated as trusted...

CVE-2002-0518

The SYN cache syncache and SYN cookie syncookie mechanism in FreeBSD 4.5 and earlier allows remote attackers to cause a denial of service crash 1 via a SYN packet that is accepted using syncookies that causes a null pointer to be referenced for the socket's TCP options, or 2 by killing and...

CVE-2001-0919

Internet Explorer 5.50.4134.0100 on Windows ME with "Prompt to allow cookies to be stored on your machine" enabled does not warn a user when a cookie is set using Javascript...

BluePanda Vulnerability Announcement: WFTPD/WFTPD Pro 2.41 RC12

================================================================ BluePanda Vulnerability Announcement: WFTPD/WFTPD Pro 2.41 RC12 05/09/2000 dd/mm/yyyy [email protected] http://bluepanda.box.sk/ ================================================================ Problem: "Magic cookie" C devulge...