CVE-2020-8510

An issue was discovered in phpABook 0.9 Intermediate. On the login page, if one sets a userInfo cookie with the value of admin+1+en user+perms+lang, one can login as any user without a password...

Liberapay: Full Path disclosure on 500 error

On manipulating cookie + parameter: gitHub 500 error returned with path disclosing of Python Files. Error Below: Traceback most recent call last: File "/opt/python/run/venv/local/lib/python3.6/site-packages/statechain.py", line 328, in loop newstate = functiondeps.askwargs File...

PT-2019-13493 · Comsenz · Discuz!Ml

Name of the Vulnerable Software and Affected Versions: Discuz!ML versions 3.2 through 3.4 Description: The issue allows remote attackers to execute arbitrary PHP code via a modified language cookie. This can be achieved by altering the cookie value, for example, changing 4gH4 0df5 language=en to...

Grammarly: Account takeover through the combination of cookie manipulation and XSS

Summary: A cookie based XSS on www.grammarly.com exists due to reflection of a cookie called gnarcontainerId in DOM without any sanitization. Normally, gnarcontainerId is being set by the server however a vulnerable endpoint at gnar.grammarly.com called "/cookies" allows us to manipulate cookies...

CVE-2019-10842

CVE-2019-10842 describes an arbitrary code execution backdoor in bootstrap-sass 3.2.0.3 when downloaded from rubygems.org. An unauthenticated attacker can craft the ___cfduid cookie value with base64-encoded code to be executed via eval(), enabling remote code execution on the target system. The ...

Magento Community Edition 2.0.x < 2.0.16 Multiple Vulnerabilities

Binary data 700416.prm...

Python Flask Cookie Signer

This is a generic module which can manipulate Python Flask-based application cookies. The Retrieve action will connect to a web server, grab the cookie, and decode it. The Resign action will do the same as above, but after decoding it, it will replace the contents with that in NEWCOOKIECONTENT,...

CVE-2018-17777

An issue was discovered on D-Link DVA-5592 A1WI20180823 devices. If the PIN of the page "/ui/cbpc/login" is the default Parental Control PIN 0000, it is possible to bypass the login form by editing the path of the cookie "sid" generated by the page. The attacker will have access to the router...

Design/Logic Flaw

An issue was discovered on D-Link DVA-5592 A1WI20180823 devices. If the PIN of the page "/ui/cbpc/login" is the default Parental Control PIN 0000, it is possible to bypass the login form by editing the path of the cookie "sid" generated by the page. The attacker will have access to the router...

The vulnerability of the components menu_pxc.cgi and index.cgi of the microprogramming system for controlled switches from FL SWITCH by Phoenix Contact allows a hacker to execute arbitrary code or cause malfunctions during maintenance.

The vulnerability of the components menupxc.cgi and index.cgi of the microprogramming software for controlled switches from FL SWITCH Phoenix Contact arises from operations that go beyond the buffer boundaries in memory. Exploiting this vulnerability could allow an attacker to execute arbitrary...

Security Bulletin: A vulnerability in Ceph affects PowerKVM (CVE-2015-5245)

Summary PowerKVM is affected by a vulnerability in Ceph. IBM has now addressed this vulnerability. Vulnerability Details CVEID: CVE-2015-5245 DESCRIPTION: Ceph Object Gateway is vulnerable to CRLF injection, caused by improper validation of user-supplied input. By using a specially-crafted bucket...

Security Bulletin: Multiple Security Vulnerabilities in Certain GUI Components of IBM Algo Credit Limits.

Summary Abstract: Multiple security vulnerabilities exist in certain GUI components of IBM Algo Credit Limits, namely ACLM Web GUI, PDS Blotter Web GUI, and ACLM Win GUI. Details of each vulnerability and the affected components are set out below. Vulnerability Details DESCRIPTION: Customers who...

Eclipse Vert.x 3.5.1 HTTP Header Injection

COMPASS SECURITY ADVISORY https://www.compass-security.com/research/advisories/ Product: Vert.x 1 CSNC ID: CSNC-2018-021 Subject: HTTP Header Injection Risk: Medium Effect: Remotely exploitable Author: Lukasz D. [email protected] Date: 12.06.2018 Introduction: ------------- Eclipse...

CVE-2018-10966

An issue was discovered in GamerPolls 0.4.6, related to config/environments/all.js and config/initializers/02passport.js. An attacker can edit the Passport.js contents of the session cookie to contain the ID number of the account they wish to take over, and re-sign it using the hard coded secret...

CVE-2018-10966

CVE-2018-10966 affects GamerPolls 0.4.6. The issue arises from how the app uses Passport.js to sign the session cookie; an attacker can edit the Passport.js data in the session cookie and include the target account ID, then re-sign it with a hard-coded secret. This enables session/identity impers...

Design/Logic Flaw

plugins/box/users/users.plugin.php in Monstra CMS 3.0.4 allows Login Rate Limiting Bypass via manipulation of the loginattempts cookie...

CVE-2018-11678

plugins/box/users/users.plugin.php in Monstra CMS 3.0.4 allows Login Rate Limiting Bypass via manipulation of the loginattempts cookie...

CVE-2018-11678

plugins/box/users/users.plugin.php in Monstra CMS 3.0.4 allows Login Rate Limiting Bypass via manipulation of the loginattempts cookie...

CVE-2018-11678

plugins/box/users/users.plugin.php in Monstra CMS 3.0.4 allows Login Rate Limiting Bypass via manipulation of the loginattempts cookie...

CVE-2018-10990

On Arris Touchstone Telephony Gateway TG1682G 9.1.103J6 devices, a logout action does not immediately destroy all state on the device related to the validity of the "credential" cookie, which might make it easier for attackers to obtain access at a later time e.g., "at least for a few minutes"...