HCL BigFix Platform 安全漏洞

HCL Technologies HCL BigFix Platform is a suite of endpoint security management platform from HCL Technologies, India. The platform supports automated discovery, management and remediation of endpoint security issues. A security vulnerability exists in HCL BigFix Platform that stems from a cookie...

CVE-2022-27962

Bluecms 1.6 has a SQL injection vulnerability at cooike...

Design/Logic Flaw

Insecure direct object reference in SUNNY TRIPOWER 5.0 Firmware version 3.10.16.R leads to unauthorized user groups accessing due to insecure cookie handling...

CVE-2021-45900

Vivoh Webinar Manager before 3.6.3.0 has improper API authentication. When a user logs in to the administration configuration web portlet, a VIVOHAUTH cookie is assigned so that they can be uniquely identified. Certain APIs can be successfully executed without proper authentication. This can let ...

Gradle 信息泄露漏洞

Gradle is a set of JVM-based project building tools from Gradle, Inc. that supports maven, Ivy repositories, and more. Gradle Enterprise suffers from a security vulnerability that stems from the fact that during the login process, Keycloak sets a browser cookie that effectively provides remember-...

PT-2022-4804 · Apple +7 · Apple Macos +8

Name of the Vulnerable Software and Affected Versions: macOS versions prior to Big Sur 11.6.5 Security Update 2022-003 Catalina Description: A cookie management issue was addressed with improved state management. Processing maliciously crafted web content may disclose sensitive user information...

CVE-2021-43687

chamilo-lms v1.11.14 is affected by a Cross Site Scripting XSS vulnerability in /plugin/jcapture/applet.php if an attacker passes a message hex2bin in the cookie...

Code injection

The affected product is vulnerable to cookie information being transmitted as cleartext over HTTP. An attacker can capture network traffic, obtain the user’s cookie and take over the account...

CVE-2021-42699

CVE-2021-42699 affects DAQFactory, where cookie information can be transmitted in cleartext over HTTP. This enables an attacker who can capture network traffic to obtain a user’s cookie and potentially hijack the session. Connected sources indicate affected product is DAQFactory (all versions up ...

CVE-2020-19960

A SQL injection vulnerability has been discovered in zz cms version 2019 which allows attackers to retrieve sensitive data via the dlid parameter in the /dl/dlsendsms.php page cookie...

CVE-2021-3882 Sensitive Cookie in HTTPS Session Without 'Secure' Attribute in ledgersmb/ledgersmb

LedgerSMB does not set the 'Secure' attribute on the session authorization cookie when the client uses HTTPS and the LedgerSMB server is behind a reverse proxy. By tricking a user to use an unencrypted connection HTTP, an attacker may be able to obtain the authentication data by capturing network...

PT-2021-20548 · Pepperl+Fuchs · Wirelesshart Gateway

Name of the Vulnerable Software and Affected Versions: PEPPERL+FUCHS WirelessHART-Gateway versions 3.0.8 through 3.0.9 Description: The issue concerns the absence of the HttpOnly attribute on a cookie, allowing its value to be accessed or modified by client-side JavaScript. This could potentially...

Pepperl Fuchs WirelessHART-Gateway安全漏洞

Pepperl Fuchs WirelessHART-Gateway is a gateway device from Pepperl Fuchs, Germany. A security vulnerability exists in Pepperl Fuchs WirelessHART-Gateway versions 3.0.8 and 3.0.9 that stems from the HttpOnly attribute not being set on a cookie. An attacker can exploit the vulnerability to read or...

NetModule Router Software 授权问题漏洞

NetModule Router Software is a router from NetModule. A security vulnerability exists in NetModule Router Software that originates from the use of an arbitrary session token cookie value on the web interface, where if a session token with an arbitrary value is available, the device will not creat...

Unspecified Vulnerability in PHP-Fusion

PHP-Fusion is a Malaysian company PHP-Fusion open source lightweight content management system based on MySql and PHP . The system contains modules such as news, articles and forums. PHP-Fusion suffers from a security vulnerability that stems from a session cookie not being deleted when a user lo...

Google Chrome Cookie Permission License and Access Control Issues Vulnerability

Chrome is a simple and efficiently designed web browsing tool developed by Google that is characterized by its simplicity and speed. A privilege permission and access control issue vulnerability exists in versions prior to Google Chrome Cookie 91.0.4472.77, which can be exploited by remote...

CVE-2021-29248

BTCPay Server (versions up to 1.0.7.0) is affected by an information disclosure vulnerability caused by not setting the Secure flag on a cookie, enabling a remote attacker to obtain sensitive information. The exact vulnerable component/file is the cookie handling, and the available documents do n...

CVE-2021-27522

CVE-2021-27522 affects Learnsite 1.2.5.0. A remote privilege-escalation vulnerability exists in /Manager/index.aspx via the JudgIsAdmin() function. By modifying the first letter of a user cookie key, an attacker can obtain the administrator cookie key, enabling elevated access. The connected docu...

CVE-2021-29012

DMA Softlab Radius Manager 4.4.0 assigns the same session cookie to every admin session. The cookie is valid when the admin is logged in, but is invalid temporarily during times when the admin is logged out. In other words, the cookie is functionally equivalent to a static password, and thus...

CVE-2009-20001

CVE-2009-20001 affects MantisBT prior to 2.24.5. The issue is that a unique cookie string assigned per user is not reset on logout, so a stolen/compromised cookie may keep the session valid and allow an attacker to log in as the victim. The description and connected records consistently state thi...