BIT-RAILS-2024-26144 Possible Sensitive Session Information Leak in Active Storage

Rails is a web-application framework. Starting with version 5.2.0, there is a possible sensitive session information leak in Active Storage. By default, Active Storage sends a Set-Cookie header along with the user's session cookie when serving blobs. It also sets Cache-Control to public. Certain...

K000148969: Python vulnerability CVE-2024-7592

Security Advisory Description There is a LOW severity vulnerability affecting CPython, specifically the 'http.cookies' standard library module. When parsing cookies that contained backslashes for quoted characters in the cookie value, the parser would use an algorithm with quadratic complexity,...

CVE-2024-12312 Print Science Designer <= 1.3.152 - Unauthenticated PHP Object Injection

The Print Science Designer plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.3.152 via deserialization of untrusted input through the 'designer-saved-projects' cookie. This makes it possible for unauthenticated attackers to inject a PHP Object. No...

Apple iOS和Apple iPadOS 安全漏洞

Apple iOS and Apple iPadOS are products of Apple Inc.Apple iOS is an operating system developed for mobile devices.Apple iPadOS is an operating system for the iPad tablet computer. A security vulnerability exists in Apple iOS prior to 18.1 and iPadOS prior to 18.1, which arises from the possibili...

php: host/secure cookie bypass due to partial CVE-2022-31629 fix

An improper input validation vulnerability was found in PHP. Due to an incomplete fix to CVE-2022-31629, network and same-site attackers can set a standard insecure cookie in the victim's browser...

GHSA-H63V-HW6G-X8HP Bit flip attack vulnerability in cookie-encrypter

due to a weakness in the encryption method used in cookie-encrypter an attack can use the world visible IV to edit encrypted cookies without decrypting the cookie itself. This is known as an AES CBC bit flipping attack...

CVE-2024-28038

The web interface of the affected devices processes a cookie value improperly, leading to a stack buffer overflow. More precisely, giving too long character string to MFPSESSIONID parameter results in a stack buffer overflow. As for the details of affected product names, model numbers, and...

Google Firebase Js Sdk 安全漏洞

Google Firebase Js Sdk is a client-side codebase for connecting to Firebase back-end services from Google, Inc USA. A security vulnerability exists in Google Firebase Js Sdk that stems from the use of a cookie named FIREBASEDEFAULTS to store configuration data, which allows an attacker to capture...

CVE-2024-30142

HCL BigFix Compliance is affected by a missing secure flag on a cookie, enabling cookie theft via XSS and potentially unauthorized access or cookies transmitted over unencrypted channels. The CVE refers to vulnerability in product HCL BigFix Compliance (reported as 2024-30142) and is corroborated...

CVE-2024-43177

IBM Concert 1.0.0 and 1.0.1 vulnerable to attacks that rely on the use of cookies without the SameSite attribute...

WordPress plugin WP 2FA with Telegram 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a set of blogging platforms developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security...

Cookie Poisoning

cookie is vulnerable to Cookie Poisoning. The vulnerability is due to improper input validation for the cookie name, path, and domain fields, allowing these fields to be manipulated and alter other cookie attributes...

AZL-50067 CVE-2024-47764 affecting package nodejs-nodemon 2.0.3-5

cookie is a basic HTTP cookie parser and serializer for HTTP servers. The cookie name could be used to set other fields of the cookie, resulting in an unexpected cookie value. A similar escape can be used for path and domain, which could be abused to alter other fields of the cookie. Upgrade to...

CVE-2023-26770

TaskCafe 0.3.2 lacks validation in the Cookie value. Any unauthenticated attacker who knows a registered UserID can change the password of that user...

CVE-2024-47764

CVE-2024-47764 affects a Node.js cookie parsing/serialization package. The vulnerability arises because the cookie name can be used to influence other cookie fields, potentially yielding an unexpected cookie value; a similar escape can affect path and domain to alter other fields. Public advisori...

cookie 安全漏洞

cookie is an HTTP server cookie parsing and serialization library open-sourced by jshttp. A security vulnerability exists in versions prior to cookie 0.7.0, which stems from a vulnerability that allows an attacker to set other fields of a cookie by manipulating the cookie name, resulting in...

PT-2024-29349 · Unknown · Flatpress Cms

Name of the Vulnerable Software and Affected Versions: FlatPress CMS versions 1.3.1 through 1.3 Description: The issue concerns the use of insecure methods to store authentication data via the cookie's component. This could potentially lead to unauthorized access. No information is provided about...

Advantech ADAM-5630 Access Control Error Vulnerability

Advantech ADAM-5630 is an edge intelligent data acquisition controller from Advantech, China. The Advantech ADAM-5630 suffers from an Access Control Error vulnerability that originates from an authenticated user's cookie being retained as a valid cookie even after the session is closed. An attack...

CVE-2024-8644

Cleartext Storage of Sensitive Information in a Cookie vulnerability in Oceanic Software ValeApp allows Protocol Manipulation, : JSON Hijacking aka JavaScript Hijacking. This issue affects ValeApp: before v2.0.0...

CVE-2024-8644 Cleartext Storage of Sensitive Information in Oceanic Software's ValeApp

Cleartext Storage of Sensitive Information in a Cookie vulnerability in Oceanic Software ValeApp allows Protocol Manipulation, : JSON Hijacking aka JavaScript Hijacking. This issue affects ValeApp: before v2.0.0...