532 matches found
EUVD-2024-47776
Malicious code in bioql PyPI...
EUVD-2025-14012
Malicious code in bioql PyPI...
EUVD-2024-36214
Malicious code in bioql PyPI...
EUVD-2025-7079
Malicious code in bioql PyPI...
PT-2025-39857
Name of the Vulnerable Software and Affected Versions MyCourts version 3 Description A stored cross-site scripting XSS issue exists in the LTA number profile field of the MyCourts v3 application. An attacker can inject arbitrary JavaScript code into their profile. This code will then execute in t...
The vulnerability of the MEAC300-FNADE4 industrial digital gas analyzer’s microprogramming software lies in the absence of a “Secure” flag in the cookies of the HTTPS session. This allows a malicious actor to gain unauthorized access to protected information.
The vulnerability of the microprogrammed industrial digital gas analyzer MEAC300-FNADE4 is related to the absence of the “Secure” flag in the cookies of the HTTPS session. Exploiting this vulnerability can allow an attacker operating remotely to gain unauthorized access to protected information...
CVE-2025-4760
An authenticated stored cross-site scripting XSS vulnerability exists in multiple WSO2 products due to improper validation of user-supplied input during API document upload in the Publisher portal. A user with publisher privileges can upload a crafted API document containing malicious JavaScript,...
CVE-2025-36011
IBM Jazz for Service Management 1.1.3.0 through 1.1.3.24 does not set the secure attribute on authorization tokens or session cookies. Attackers may be able to get the cookie values by sending a http:// link to a user or by planting this link in a site the user goes to. The cookie will be sent to...
CVE-2025-36011
IBM Jazz for Service Management 1.1.3.0 through 1.1.3.24 does not set the secure attribute on authorization tokens or session cookies. Attackers may be able to get the cookie values by sending a http:// link to a user or by planting this link in a site the user goes to. The cookie will be sent to...
CVE-2025-36011 IBM Jazz for Service Management information disclosure
IBM Jazz for Service Management 1.1.3.0 through 1.1.3.24 does not set the secure attribute on authorization tokens or session cookies. Attackers may be able to get the cookie values by sending a http:// link to a user or by planting this link in a site the user goes to. The cookie will be sent to...
Security Bulletin: IBM Jazz for Service Management is vulnerable to "cookiesEnabled" cookie not sent over SSL
Summary IBM Jazz for Service Management is vulnerable to "cookiesEnabled" cookie not sent over SSL CVE-2025-36011. Vulnerability Details CVEID:CVE-2025-36011 DESCRIPTION: IBM Jazz for Service Management does not set the secure attribute on authorization tokens or session cookies. Attackers may be...
Linux Distros Unpatched Vulnerability : CVE-2018-1340
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Prior to 1.0.0, Apache Guacamole used a cookie for client-side storage of the user's session token. This cookie lacked the secure flag, which could allow an...
The vulnerability of the CE Phoenix e-commerce software (CE PhoenixCart) lies in the use of cookies to store confidential information without the HttpOnly flag. This allows attackers to perform cross-site scripting attacks.
The vulnerability of the CE Phoenix e-commerce software CE PhoenixCart is related to the use of cookies for storing confidential information without the HttpOnly flag. Exploiting this vulnerability could allow an attacker to perform cross-site scripting attacks remotely...
CVE-2025-0250 HCL IEM is affected by an authorization token sent in cookie vulnerability
HCL IEM is affected by an authorization token sent in cookie vulnerability. A token used for authentication and authorization is being handled in a manner that may increase its exposure to security risks...
CVE-2025-27450
The Secure attribute is missing on multiple cookies provided by the MEAC300-FNADE4. An attacker can trick a user to establish an unencrypted HTTP connection to the server and intercept the request containing the PHPSESSID cookie...
CVE-2025-27453
The HttpOnly flag is set to false on the PHPSESSION cookie. Therefore, the cookie can be accessed by other sources such as JavaScript...
CVE-2025-27450
The Secure attribute is missing on multiple cookies provided by the MEAC300-FNADE4. An attacker can trick a user to establish an unencrypted HTTP connection to the server and intercept the request containing the PHPSESSID cookie...
PT-2025-27779 · Unknown · Meac300-Fnade4
Name of the Vulnerable Software and Affected Versions: MEAC300-FNADE4 affected versions not specified Description: The issue concerns the absence of the Secure attribute on multiple cookies provided by the MEAC300-FNADE4. This allows an attacker to trick a user into establishing an unencrypted HT...
python-werkzeug: cookie prefixed with = can shadow unprefixed cookie
A flaw was found in python-werkzeug. Browsers may allow "nameless" cookies like =value instead of key=value. A vulnerable browser may allow a compromised application on an adjacent subdomain to exploit this to set a cookie for another subdomain. If a Werkzeug application is running next to a...
CVE-2025-49189 Cookie missing HttpOnly flag
The HttpOnlyflag of the session cookie "@@" is set to false. Since this flag helps preventing access to cookies via client-side scripts, setting the flag to false can lead to a higher possibility of Cross-Side-Scripting attacks which target the stored cookies...