235 matches found
UBUNTU-CVE-2021-46900
Sympa before 6.2.62 relies on a cookie parameter for certain security objectives, but does not ensure that this parameter exists and has an unpredictable value. Specifically, the cookie parameter is both a salt for stored passwords and an XSS protection mechanism...
CVE-2021-46900
Sympa before 6.2.62 relies on a cookie parameter for certain security objectives, but does not ensure that this parameter exists and has an unpredictable value. Specifically, the cookie parameter is both a salt for stored passwords and an XSS protection mechanism...
Cross site scripting
Sympa before 6.2.62 relies on a cookie parameter for certain security objectives, but does not ensure that this parameter exists and has an unpredictable value. Specifically, the cookie parameter is both a salt for stored passwords and an XSS protection mechanism...
CVE-2021-46900
Sympa before 6.2.62 relies on a cookie parameter for certain security objectives, but does not ensure that this parameter exists and has an unpredictable value. Specifically, the cookie parameter is both a salt for stored passwords and an XSS protection mechanism...
Sympa Security Vulnerabilities
Sympa is an open source email management list software from the Sympa community. The software supports email management, authentication and access control. A security vulnerability exists in versions prior to Sympa 6.2.62, which stems from improper use of the cookie parameter, resulting in a...
Poly CCX and Trio Security Vulnerabilities
Poly Trio is a Trio series business conference phone from Poly USA. A security vulnerability exists in Poly CCX and Trio that stems from a denial of service DOS vulnerability in the cookie parameter of the HTTP Header Handler component. Affected products and versions: Poly CCX version 400, CCX...
CVE-2020-21120
SQL Injection vulnerability in file home\controls\cart.class.php in UQCMS 2.1.3, allows attackers execute arbitrary commands via the cookiecart parameter to /index.php/cart/num...
Sql injection
SQL Injection vulnerability in file home\controls\cart.class.php in UQCMS 2.1.3, allows attackers execute arbitrary commands via the cookiecart parameter to /index.php/cart/num...
SUSE CVE-2010-2092
SQL injection vulnerability in graph.php in Cacti 0.8.7e and earlier allows remote attackers to execute arbitrary SQL commands via a crafted rraid parameter in a GET request in conjunction with a valid rraid value in a POST request or a cookie, which causes the POST or cookie value to bypass the...
CVE-2020-21120
SQL Injection vulnerability in file home\controls\cart.class.php in UQCMS 2.1.3, allows attackers execute arbitrary commands via the cookiecart parameter to /index.php/cart/num...
Glassdoor: Web Cache Poisoning leads to XSS and DoS
@nokline and @bombon were able to utilize URL parser confusion in combination with reflected XSS under https://glassdoor.com/Job/ and https://glassdoor.com/mz-survey/interview/collectQuestionsinput.htm/ by caching XSS payloads via cookie and header params into a stored XSS for URLs /Award/ and...
CVE-2022-24121
SQL Injection vulnerability discovered in Unified Office Total Connect Now that would allow an attacker to extract sensitive information through a cookie parameter...
CVE-2022-24121
SQL Injection vulnerability discovered in Unified Office Total Connect Now that would allow an attacker to extract sensitive information through a cookie parameter...
Sql injection
SQL Injection vulnerability discovered in Unified Office Total Connect Now that would allow an attacker to extract sensitive information through a cookie parameter...
CVE-2022-24121
SQL Injection vulnerability discovered in Unified Office Total Connect Now that would allow an attacker to extract sensitive information through a cookie parameter...
CVE-2022-24121: Improper Neutralization of Special Elements used in an SQL Command
SQL Injection vulnerability discovered in Unified Office Total Connect Now that would allow an attacker to extract sensitive information through a cookie parameter...
Unified Office Total Connect Now℠ Cookie Parameter SQL Injection
1. Advisory Information Title: Unified Office Total Connect Now℠ Cookie Parameter SQL Injection Advisory ID: CORE-2022-0001 Advisory URL:https://www.coresecurity.com/core-labs/advisories/unified-office-total-connect-sql-injection Date published: 2022-02-01 Date of last update: 2022-02-01 Vendors...
MGASA-2022-0036 Updated phpmyadmin packages fix security vulnerability
A flaw was identified in how phpMyAdmin processes two factor authentication; a user could potentially manipulate their account to bypass two factor authentication in subsequent authentication sessions PMASA-2022-1. A series of weaknesses was identified allowing a malicious user to submit maliciou...
Authentication flaw
Carinal Tien Hospital Health Report System’s login page has improper authentication, a remote attacker can acquire another general user’s privilege by modifying the cookie parameter without authentication. The attacker can then perform limited operations on the system or modify data, making the...
CVE-2021-44160
The CVE refers to Carinal Tien Hospital Health Report System, whose login page authenticates improperly. A remote attacker can modify the cookie parameter to bypass authentication and gain another general user’s privileges, enabling limited system operations or data modification and making the se...