PT-2024-35452 · Xid +1 · Xid +1

Name of the Vulnerable Software and Affected Versions: sftpgo versions prior to v2.6.4 Description: The OpenID Connect implementation in sftpgo allows authenticated users to brute force session cookies, gaining access to other users' data. This is because the cookies are generated predictably usi...

GHSA-PXG6-PF52-XH8X cookie accepts cookie name, path, and domain with out of bounds characters

Impact The cookie name could be used to set other fields of the cookie, resulting in an unexpected cookie value. For example, serialize"userName=alert'XSS3'; Max-Age=2592000; a", value would result in "userName=alert'XSS3'; Max-Age=2592000; a=test", setting userName cookie to and ignoring value. ...

PT-2024-11664 · Ibm · Ibm Aspera Console

Name of the Vulnerable Software and Affected Versions: IBM Aspera Console versions 3.4.0 through 3.4.4 Description: The issue is caused by the failure to set the HTTPOnly flag, allowing a remote attacker to obtain sensitive information from the cookie. This could be exploited by a remote attacker...

PT-2024-31190 · Rely-Pcie · Rely-Pcie

Name of the Vulnerable Software and Affected Versions: RELY-PCIe versions 22.2.1 through 23.1.0 Description: The issue is related to the failure of setting the Secure attribute for sensitive cookies in HTTPS sessions. This could cause the user agent to send those cookies in cleartext over an HTTP...

Relyum RELY-PCIe 安全漏洞

Relyum RELY-PCIe is a smart pluggable board from Relyum Spain. A security vulnerability exists in the Relyum RELY-PCIe versions v22.2.1 through v23.1.0 that stems from not setting the security attributes of sensitive cookies in an HTTPS session, which could result in a user agent sending these...

CVE-2024-36511

An improperly implemented security check for standard vulnerability CWE-358 in FortiADC Web Application Firewall WAF 7.4.0 through 7.4.4, 7.2 all versions, 7.1 all versions, 7.0 all versions, 6.2 all versions, 6.1 all versions, 6.0 all versions when cookie security policy is enabled may allow an...

CVE-2024-36511

An improperly implemented security check for standard vulnerability CWE-358 in FortiADC Web Application Firewall WAF 7.4.0 through 7.4.4, 7.2 all versions, 7.1 all versions, 7.0 all versions, 6.2 all versions, 6.1 all versions, 6.0 all versions when cookie security policy is enabled may allow an...

CVE-2024-36511

FortiADC Web Application Firewall (WAF) is affected by CVE-2024-36511. The issue stems from an improperly implemented security check (CWE-358) in FortiADC WAF versions 6.0–7.4.4 when the cookie security policy is enabled, potentially allowing an attacker to retrieve the initial encrypted and sign...

CVE-2024-36511: Improperly Implemented Security Check for Standard

An improperly implemented security check for standard vulnerability CWE-358 in FortiADC Web Application Firewall WAF 7.4.0 through 7.4.4, 7.2 all versions, 7.1 all versions, 7.0 all versions, 6.2 all versions, 6.1 all versions, 6.0 all versions when cookie security policy is enabled may allow an...

OESA-2024-2062 php security update

PHP is an HTML-embedded scripting language. PHP attempts to make it easy for developers to write dynamically generated web pages. PHP also offers built-in database integration for several commercial and non-commercial database management systems, so writing a database-enabled webpage with PHP is...

Taipy has a Session Cookie without Secure and HTTPOnly flags

Summary Session cookie is without Secure and HTTPOnly flags. Details Please take a look at this part of code PoC screenshot or check code directly provided in Occurrences section below Occurrences: https://github.com/Avaiga/taipy/blob/develop/frontend/taipy-gui/src/components/Taipy/Navigate.tsxL6...

PT-2024-29504 · Syrotech · Sy-Gpon-1110-Wdont Router

Name of the Vulnerable Software and Affected Versions: SyroTech SY-GPON-1110-WDONT Router affected versions not specified Description: The issue arises from a missing secure flag for session cookies associated with the router's web management interface. An attacker with remote access could exploi...

CVE-2024-39734

IBM Datacap Navigator 9.1.5, 9.1.6, 9.1.7, 9.1.8, and 9.1.9 does not set the secure attribute on authorization tokens or session cookies. Attackers may be able to get the cookie values by sending a http:// link to a user or by planting this link in a site the user goes to. The cookie will be sent...

CVE-2024-39734

IBM Datacap Navigator 9.1.5, 9.1.6, 9.1.7, 9.1.8, and 9.1.9 does not set the secure attribute on authorization tokens or session cookies. Attackers may be able to get the cookie values by sending a http:// link to a user or by planting this link in a site the user goes to. The cookie will be sent...

CVE-2024-39734

IBM Datacap Navigator (Datacap Navigator 9.1.5–9.1.9) does not set the secure attribute on authorization tokens or session cookies, enabling potential cookie disclosure when users click http:// links or visit pages with such links. The cited entry from IBM states the impact as cookie values being...

CVE-2023-33860

IBM Security QRadar EDR 3.12 does not set the secure attribute on authorization tokens or session cookies. Attackers may be able to get the cookie values by sending a http:// link to a user or by planting this link in a site the user goes to. The cookie will be sent to the insecure link and the...

PT-2024-12447 · Ibm · Ibm Security Qradar Edr

Name of the Vulnerable Software and Affected Versions: IBM Security QRadar EDR version 3.12 Description: The issue concerns the failure to set the secure attribute on authorization tokens or session cookies. This allows attackers to obtain cookie values by sending a user a link to an insecure sit...

GO-2024-2531 1Panel set-cookie is missing the Secure keyword in github.com/1Panel-dev/1Panel

1Panel set-cookie is missing the Secure keyword in github.com/1Panel-dev/1Panel...

SUSE-SU-2024:2037-1 Security update for php7

This update for php7 fixes the following issues: - CVE-2024-2756: Fixed bypass of security fix applied for CVE-2022-31629 that lead PHP to consider not secure cookies as secure bsc1222857 - CVE-2024-3096: Fixed bypass on null byte leading passwords checked via passwordverify bsc1222858 -...

CVE-2024-36788

Netgear WNR614 JNR1010V2 N300-V1.1.0.541.0.1 does not properly set the HTTPOnly flag for cookies. This allows attackers to possibly intercept and access sensitive communications between the router and connected devices...