CVE-2021-41101

CVE-2021-41101 affects wire-server prior to 2.106.0, where the CORS Access-Control-Allow-Origin header configured by nginz was too permissive, applying to all subdomains of wire.com. This enables a potential attacker to abuse any subdomain with an XSS vector to talk to the Wire API using the user...

Sensitive Cookie Without 'HttpOnly' Flag in filegator/filegator

Description HTTPOnly attribute is not set for session cookies in the application. Proof of Concept https://ibb.co/R950Vxj Impact When a cookie doesn’t have an HttpOnly flag, it can be accessed through JavaScript, which means that an XSS could lead to cookies being stolen. These include session...

Sensitive Cookie in HTTPS Session Without 'Secure' Attribute in khodakhah/nodcms

Description Implement both Secure flag and httponly flag in the application. Proof of Concept Impact The secure flag is an option that can be set by the application server when sending a new cookie to the user within an HTTP Response. The purpose of the secure flag is to prevent cookies from bein...

Sensitive Cookie in HTTPS Session Without 'Secure' Attribute in kcal-app/kcal

Description Implement both Secure flag and httponly flag in the application. Proof of Concept Impact The secure flag is an option that can be set by the application server when sending a new cookie to the user within an HTTP Response. The purpose of the secure flag is to prevent cookies from bein...

Sensitive Cookie in HTTPS Session Without 'Secure' Attribute in ledgersmb/ledgersmb

Description Secure flag is not implemented on the application Proof of Concept https://drive.google.com/file/d/1ESnBKwFef8D42A2VD3W59vXMLdWhCxS9/view?usp=sharing Impact The secure flag is an option that can be set by the application server when sending a new cookie to the user within an HTTP...

CVE-2021-3706

adminlte is vulnerable to Sensitive Cookie Without 'HttpOnly' Flag...

Sensitive Cookie Without 'HttpOnly' Flag in pi-hole/adminlte

✍️ Description Please enter a description of the vulnerability. The cookie persistentlogin is set without httponly flag 🕵️‍♂️ Proof of Concept Enable remember me during Login POST /admin/index.php?login HTTP/1.1 Host: 192.168.159.138 Content-Length: 30 Cache-Control: max-age=0...

Design/Logic Flaw

In PEPPERL+FUCHS WirelessHART-Gateway 3.0.8 and 3.0.9 the HttpOnly attribute is not set on a cookie. This allows the cookie's value to be read or set by client-side JavaScript...

Sensitive Cookie in HTTPS Session Without 'Secure' Attribute in azuracast/azuracast

✍️ Description The secure flag is not set for appsession cookie in the application. 🕵️‍♂️ Proof of Concept PoC Image: https://i.ibb.co/v1y0Fdv/cookie-flag.png 💥 Impact If the secure flag is set on a cookie, then browsers will not submit the cookie in any requests that use an unencrypted HTTP...

Sensitive Cookie Without 'HttpOnly' Flag in froxlor/froxlor

✍️ Description HTTPOnly attribute is not set for session cookies in the application. 🕵️‍♂️ Proof of Concept 💥 Impact When a cookie doesn’t have an HttpOnly flag, it can be accessed through JavaScript, which means that an XSS could lead to cookies being stolen. These include session cookies that can...

Cross-Site Request Forgery (CSRF) in namelessmc/nameless

✍️ Description Attacker able to disable any widget with CSRF attack. It does not matter at all that your application run in localhost or elsewhere, just it is enough to run on a browser and another low privilege user or attackers know the IP address or hostname of your application. In CSRF attacks...

Sensitive Cookie in HTTPS Session Without 'Secure' Attribute in slackero/phpwcms

✍️ Description The secure flag is not set for PHPSESSID session cookie in the application. 🕵️‍♂️ Proof of Concept 💥 Impact If the secure flag is set on a cookie, then browsers will not submit the cookie in any requests that use an unencrypted HTTP connection, thereby preventing the cookie from...

Sensitive Cookie Without 'HttpOnly' Flag in slackero/phpwcms

✍️ Description HTTPOnly attribute is not set for session cookies in the application. 🕵️‍♂️ Proof of Concept 💥 Impact When a cookie doesn’t have an HttpOnly flag, it can be accessed through JavaScript, which means that an XSS could lead to cookies being stolen. These include session cookies that can...

CVE-2021-34563

In PEPPERL+FUCHS WirelessHART-Gateway 3.0.8 and 3.0.9 the HttpOnly attribute is not set on a cookie. This allows the cookie's value to be read or set by client-side JavaScript...

Cross-Site Request Forgery (CSRF) in zhongshaofa/easyadmin

✍️ Description Attacker able to add any rule with CSRF attack. It does not matter at all that your application run in localhost or elsewhere, just it is enough to run on a browser and another low privilege user or attackers know the IP address or hostname of your application. In CSRF attacks it is...

Cross-Site Request Forgery (CSRF) in zhongshaofa/easyadmin

✍️ Description Attacker able to change any password and username with CSRF attack. It does not matter at all that your application run in localhost or elsewhere, just it is enough to run on a browser and another low privilege user or attackers know the IP address or hostname of your application. I...

CVE-2021-29769

IBM i2 Analyst's Notebook Premium IBM i2 Analyze 4.3.0, 4.3.1, and 4.3.2 does not set the secure attribute on authorization tokens or session cookies. Attackers may be able to get the cookie values by sending a http:// link to a user or by planting this link in a site the user goes to. The cookie...

in getgrav/grav

✍️ Description A cookie with an overly broad path can be accessed through other applications on the same domain. 🕵️‍♂️ Proof of Concept Application deployed at http://real.example.com/grav and the application sets a session ID cookie with path "/" when users log in to the forum. then below code is...

Atlassian Jira 8.6.x < 8.13.4 Cookie Without Secure Flag

According to its self-reported version number, the instance of Atlassian Jira hosted on the remote web server is prior to 8.5.12, 8.6.x 8.13.4 or 8.14.x 8.15.0. It is, therefore, affected by a missing cookie secure flag vulnerability in jira.editor.user.mode cookie when Jira is configured with...

Atlassian Jira < 8.5.12 Cookie Without Secure Flag

According to its self-reported version number, the instance of Atlassian Jira hosted on the remote web server is prior to 8.5.12, 8.6.x 8.13.4 or 8.14.x 8.15.0. It is, therefore, affected by a missing cookie secure flag vulnerability in jira.editor.user.mode cookie when Jira is configured with...