CVE-2024-24814 Denial of service when manipulating mod_auth_openidc_session_chunks cookie in mod_auth_openidc

modauthopenidc is an OpenID Certified™ authentication and authorization module for the Apache 2.x HTTP server that implements the OpenID Connect Relying Party functionality. In affected versions missing input validation on modauthopenidcsessionchunks cookie value makes the server vulnerable to a...

CVE-2024-24768 1Panel set-cookie is missing the Secure keyword

1Panel is an open source Linux server operation and maintenance management panel. The HTTPS cookie that comes with the panel does not have the Secure keyword, which may cause the cookie to be sent in plain text if accessed using HTTP. This issue has been patched in version 1.9.6...

WordPress Plugin Estatik Real Estate Plugin Security Vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A security vulnerability previously existed...

CVE-2024-0349 SourceCodester Engineers Online Portal missing secure attribute

A vulnerability was found in SourceCodester Engineers Online Portal 1.0. It has been declared as problematic. Affected by this vulnerability is an unknown functionality. The manipulation leads to sensitive cookie without secure attribute. The attack can be launched remotely. The complexity of an...

PrestaShop SQL Injection Vulnerability

PrestaShop is an open source e-commerce solution from PrestaShop, Inc. in the United States. The solution provides multiple payment methods, SMS alerts, and product image zooming. A SQL injection vulnerability exists in PrestaShow Google Integrator versions prior to 2.1.4, which originates from...

Exploit for SQL Injection in Wpfastestcache Wp_Fastest_Cache

CVE-2023-6063 PoC Reference - Unauthenticated SQL Inject...

CVE-2023-47628 Session Expiration Misconfiguration in datahub

DataHub is an open-source metadata platform. DataHub Frontend's sessions are configured using Play Framework's default settings for stateless session which do not set an expiration time for a cookie. Due to this, if a session cookie were ever leaked, it would be valid forever. DataHub uses a...

F5 Networks BIG-IP : Multi-blade VIPRION Configuration utility session cookie vulnerability (K29141800)

The version of F5 Networks BIG-IP installed on the remote host is prior to 15.1.9 / 16.1.4 / 17.1.0. It is, therefore, affected by a vulnerability as referenced in the K29141800 advisory. - An authenticated user's session cookie may remain valid for a limited time after logging out from the BIG- ...

SUSE CVE-2023-5723

An attacker with temporary script access to a site could have set a cookie containing invalid characters using document.cookie that could have led to unknown errors. This vulnerability affects Firefox 119...

CVE-2023-0897

Sielco PolyEco1000 is vulnerable to a session hijack vulnerability due to the cookie being vulnerable to a brute force attack, lack of SSL, and the session being visible in requests...

Session fixation

Sielco PolyEco1000 is vulnerable to a session hijack vulnerability due to the cookie being vulnerable to a brute force attack, lack of SSL, and the session being visible in requests...

CVE-2023-0897 Session FIxation in Sielco PolyEco1000

Sielco PolyEco1000 is vulnerable to a session hijack vulnerability due to the cookie being vulnerable to a brute force attack, lack of SSL, and the session being visible in requests...

CVE-2023-0897 Session FIxation in Sielco PolyEco1000

Sielco PolyEco1000 is vulnerable to a session hijack vulnerability due to the cookie being vulnerable to a brute force attack, lack of SSL, and the session being visible in requests...

CVE-2023-0897

CVE-2023-0897 affects Sielco PolyEco1000 family (PolyEco1000 CPU:2.0.6/1.9.4/1.9.3; PolyEco500 1.7.0; PolyEco300 2.0.2/2.0.0) with a session hijack/session fixation risk due to cookies susceptible to brute-force, no SSL, and visible session data in requests. NVD CVSSv3.1 base score 9.8 (CRITICAL)...

CVE-2023-5723

An attacker with temporary script access to a site could have set a cookie containing invalid characters using document.cookie that could have led to unknown errors. This vulnerability affects Firefox 119...

CVE-2023-26153

Versions of the package geokit-rails before 2.5.0 are vulnerable to Command Injection due to unsafe deserialisation of YAML within the 'geolocation' cookie. This issue can be exploited remotely via a malicious cookie value. Note: An attacker can use this vulnerability to execute commands on the...

CVE-2023-26153

Versions of the package geokit-rails before 2.5.0 are vulnerable to Command Injection due to unsafe deserialisation of YAML within the 'geolocation' cookie. This issue can be exploited remotely via a malicious cookie value. Note: An attacker can use this vulnerability to execute commands on the...

CVE-2023-41055 LibreY Server-Side Request Forgery (SSRF) vulnerability via wikipedia_language cookie

LibreY is a fork of LibreX, a framework-less and javascript-free privacy respecting meta search engine. LibreY is subject to a Server-Side Request Forgery SSRF vulnerability in the engines/google/text.php and engines/duckduckgo/text.php files in versions before commit...

The vulnerability of the web server of the programmable logical controller ioLogik arises from the use of cookies to store confidential information without the HttpOnly flag. This allows a violator to gain unauthorized access to the protected information.

The vulnerability of the web server of the programmable logical controller ioLogik relates to the use of cookies for storing confidential information without the HttpOnly flag. Exploiting this vulnerability may allow an attacker, operating remotely, to gain unauthorized access to the protected...

IBM Sterling Connect:Express for UNIX 安全漏洞

IBM Sterling Connect:Express for UNIX is a file transfer solution from International Business Machines IBM for the UNIX platform. A security vulnerability exists in IBM Sterling Connect:Express for UNIX version 1.5, which stems from the vulnerability of the browser UI to cookies...