660 matches found
CVE-2021-27935
An issue was discovered in AdGuard before 0.105.2. An attacker able to get the user's cookie is able to bruteforce their password offline, because the hash of the password is stored in the cookie...
CVE-2021-27935
Affected software: AdGuard prior to 0.105.2. The issue is that the password hash is stored in the user cookie, enabling an attacker who can obtain a user cookie to offline-brute-force the password. This is a server-side authentication-credential exposure via cookies. Impact stated: offline passwo...
AdGuard 安全漏洞
Eugene AdGuard Home is an open source application from Eugene. It provides network-wide software for blocking ads and tracking. A security vulnerability exists in AdGuard before 0.105.2, which can be exploited by attackers to be able to brute-force their passwords offline, as the hash of the...
PT-2021-11642 · WordPress · Wp Hotel Booking
Name of the Vulnerable Software and Affected Versions: wp-hotel-booking plugin versions 1.10.2 and earlier Description: The issue allows remote attackers to execute arbitrary code because of an unserialize operation on the thimpress hotel booking 1 cookie in the includes/class-wphb-sessions.php...
CASAP Automated Enrollment System 1.0 Cross Site Scripting
Exploit Title: CASAP ENROLLMENT SYSTEM 1.0 | CROSS SITE SCRIPTING Exploit Author: Richard Jones Date: 2021-01/23 Vendor Homepage: https://www.sourcecodester.com/php/12210/casap-automated-enrollment-system.html Software Link:...
CVE-2020-28970
An issue was discovered on Western Digital My Cloud OS 5 devices before 5.06.115. A NAS Admin authentication bypass vulnerability could allow an unauthenticated user to execute privileged commands on the device via a cookie. In addition, an upload endpoint could then be used by an authenticated...
Western Digital Western Digital My Cloud Authorization Issues Vulnerability
Western Digital My Cloud is a personal cloud storage device from Western Digital. An authorization issue vulnerability exists in Western Digital My Cloud OS 5 devices prior to version 5.06.115, where due to insufficient validation of URI paths, a NAS management authentication bypass vulnerability...
Western Digital My Cloud OS Authorization Issues Vulnerability
Western Digital My Cloud is a personal cloud storage device from Western Digital. A security vulnerability exists in Western Digital My Cloud OS 5 devices prior to version 5.06.115, which stems from a NAS management authentication bypass vulnerability that could allow an unauthenticated user to...
Google Chrome cookies security bypass vulnerability
Google Chrome is a web browser from Google, an American company. A security vulnerability exists in versions prior to Google chrome 87.0.4280.66 that stems from an improper implementation in cookies. An attacker can exploit this vulnerability to bypass security restrictions...
Security Bulletin: Cookie Vulnerability Affects IBM Sterling File Gateway (CVE-2020-4763)
Summary IBM Sterling File Gateway has addressed a cookie vulnerability. Vulnerability Details CVEID: CVE-2020-4763 DESCRIPTION: IBM Sterling File Gateway does not set the secure attribute on authorization tokens or session cookies. Attackers may be able to get the cookie values by sending a http:...
Security Bulletin: Cookie Vulnerability Affects IBM Sterling File Gateway (CVE-2020-4665)
Summary IBM Sterling File Gateway has addressed a cookie vulnerability. Vulnerability Details CVEID: CVE-2020-4665 DESCRIPTION: IBM Sterling File Gateway does not set the secure attribute on authorization tokens or session cookies. Attackers may be able to get the cookie values by sending a http:...
Microsoft .NET Core and ASP.NET Core Security Feature Bypass Vulnerability
Microsoft .NET Core and Microsoft ASP.NET Core are both products of Microsoft Corporation USA. NET Core is a free open source development platform. NET Core is a free open source development platform with multi-language support and cross-platform features.Microsoft ASP.NET Core is a framework of...
CVE-2020-13376
SecurEnvoy SecurMail 9.3.503 allows attackers to upload executable files and achieve OS command execution via a crafted SecurEnvoyReply cookie...
Automattic: Captcha checker "pd-captcha_form_SURVEYID" cookie is accepting any value
Summary: Hi team, There is a Captcha protection feature on surveys and polls. If you captcha protection enabled survey, you will see this : F901789 When you solve captcha and click Submit Captcha, website sets a cookie like this : F901799 And if you delete this cookie and try access to survey, yo...
RubyGem Rack Input Validation Error Vulnerability
RubyGem Rack is a modular interface between web servers and web applications developed using the Ruby programming language. A security vulnerability exists in RubyGem Rack versions prior to 2.2.3 and prior to 2.1.4. An attacker can exploit the vulnerability to control cookies prefixed with secure...
Unspecified Vulnerability in IBM Sterling File Gateway
IBM Sterling File Gateway is a suite of file transfer software from IBM in the United States. The software integrates different centers of file transfer activity and facilitates the secure exchange of file-based data over the Internet. A security vulnerability exists in IBM Sterling File Gateway...
The vulnerability of Google Chrome’s cookie handling mechanism, related to the disclosure of information during data processing, allows a perpetrator to gain unauthorized access to confidential data.
The vulnerability of Google Chrome’s cookie handling mechanism is related to the disclosure of information during data processing. Exploiting this vulnerability can allow an attacker, operating remotely, to gain unauthorized access to confidential data through a created HTML page...
CVE-2019-19090 ABB eSOMS: Secure Flag not set
For ABB eSOMS versions 4.0 to 6.0.2, the Secure Flag is not set in the HTTP response header. Unencrypted connections might access the cookie information, thus making it susceptible to eavesdropping...
CVE-2020-9407
IBL Online Weather prior to version 4.3.5a contains an information-disclosure vulnerability that allows an attacker to read the IWEBSERVICE_JSONRPC_COOKIE cookie and obtain sensitive data. The issue affects the software’s web-facing components and is fixed by upgrading to version 4.3.5a or later....
