CVE-2025-66850

Обнаружение В приложении «LibreNMS» мы обнаружили отражённую уязвимость межсайтового скриптинга XSS; эта уязвимость существует в параметре протокола protocol модуля маршрутизации, что позволяет злоумышленнику выполнить вредоносный JavaScript в браузере жертвы. Эта уязвимость затрагивает все верси...

MIPS-CVE-2014-9222

Отказ от ответственности Учебные материалы предназначены только для информационных и образовательных целей. Я считаю, что этичный хакинг, информационная безопасность и кибербезопасность должны быть знакомы каждому, кто использует цифровую информацию и компьютеры. Я считаю, что невозможно защитить...

CVE-2023-44813

CVE-2023-44813 Уязвимость отраженного межсайтового скриптинга XSS в параметре mode функции Invite Friend в mooSocial v3.1.8, которая позволяет злоумышленникам похищать сессионные cookie пользователей и выдавать себя за их учетную запись через специально созданный URL. Уязвимый параметр: mode...

CVE-2023-43325

mooSocial: XSS CVE-2023-43325 mooSocial v3.1.8의 사용자 로그인 기능에 있는 dataredirecturl 매개변수에 반사형 사이트 간 스크립팅XSS 취약점이 존재하며, 이를 통해 공격자는 조작된 URL로 사용자의 세션 쿠키를 탈취하고 계정을 가장할 수 있습니다. 취약한 매개변수: dataredirecturl 익스플로잇 - 개념 증명POC 반사형 사이트 간 스크립팅XSS Payload : test"test Payload Base64 encoded :...

CVE-2023-43326

mooSocial: XSS CVE-2023-43326 mooSocial v3.1.8의 여러 URL에 반사형 XSS 취약점이 존재합니다. 이 취약점을 통해 공격자는 조작된 URL을 사용하여 사용자의 세션 쿠키를 탈취하고 계정을 가장할 수 있습니다. 참고: 이러한 URL이 Referer 헤더에 사용될 때도 XSS가 작동합니다. 아래에 몇 가지 예가 있으며, 아래와 같은 URL 중 더 많은 취약점이 있을 수 있습니다. 익스플로잇 - 개념 증명 PoC 반사형 XSS Payload : ahrixia"ahrixia Payload Url...

kernel: sctp: purge outqueue on stale COOKIE-ECHO handling

A flaw was found in the Linux kernel's Stream Control Transmission Protocol SCTP implementation. This vulnerability, a use-after-free, occurs when the system processes a Stale Cookie ERROR during the setup or reconfiguration of an SCTP association. A remote attacker could exploit this by sending...

RLSA-2026:77369 Important: mod_auth_openidc:2.3 security update

The modauthopenidc is an OpenID Connect authentication module for Apache HTTP Server. It enables an Apache HTTP Server to operate as an OpenID Connect Relying Party and/or OAuth 2.0 Resource Server. Security Fixes: modauthopenidc: modauthopenidc: Denial of Service via malformed state cookie parsi...

mod_auth_openidc:2.3 security update

An update is available for cjose, modauthopenidc, module.modauthopenidc, module.cjose. This update affects Rocky Linux 8. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list The modauthopenidc is an...

CVE-2025-56771

Описание В ходе анализа веб-сайта ecodotempo.com.br была обнаружена уязвимость сохранённого межсайтового скриптинга Stored XSS. Эта уязвимость позволяет злоумышленнику внедрять вредоносные скрипты в поля, которые впоследствии отображаются другим пользователям без надлежащей очистки, в частности н...

Webmin < 1.920 - Authenticated Remote Code Execution

rpc.cgi in Webmin through 1.920 allows authenticated Remote Code Execution via a crafted object name because unserialisevariable makes an eval call. NOTE: the WebminServersIndex documentation states "RPC can be used to run any command or modify any file on a server, which is why access to it must...

Jenkins <=2.196 - Cookie Exposure

Jenkins through 2.196, LTS 2.176.3 and earlier prints the value of the cookie on the /whoAmI/ URL despite it being marked HttpOnly, thus making it possible to steal cookie-based authentication credentials if the URL is exposed or accessed via another cross-site scripting issue. id: CVE-2019-10405...

DotNetNuke 9.2 - 9.2.1 - Weak Encryption & Cookie Deserialization

DNN DotNetNuke versions 9.2 through 9.2.1 use a weak encryption algorithm to protect input parameters. This cryptographic weakness enables attackers to craft malicious DNNPersonalization cookies that can be deserialized, leading to remote code execution. id: CVE-2018-15811 info: name: DotNetNuke...

DotNetNuke 9.2 - 9.2.2 - Weak Encryption & Cookie Deserialization

DNN DotNetNuke versions 9.2 through 9.2.2 use a weak encryption algorithm to protect input parameters because of an incomplete fix for CVE-2018-15811. This cryptographic weakness enables attackers to craft malicious DNNPersonalization cookies that can be deserialized, leading to remote code...

TBK DVR4104/DVR4216 Devices - Authentication Bypass

TBK DVR4104 and DVR4216 devices, as well as Novo, CeNova, QSee, Pulnix, XVR 5 in 1, Securus, Night OWL, DVR Login, HVR Login, and MDVR Login, which run re-branded versions of the original TBK DVR4104 and DVR4216 series, allow remote attackers to bypass authentication via a "Cookie: uid=admin"...

Wing FTP Server <= 7.4.3 - Path Disclosure via Overlong UID Cookie

Wing FTP Server versions prior to 7.4.4 are vulnerable to an authenticated information disclosure vulnerability CVE-2025-47813. The vulnerability occurs due to improper validation of the 'UID' session cookie in the /loginok.html endpoint. Supplying an overlong UID value causes the server to respo...

cve-2020-10977-read-and-execute

CVE-2020-10977 읽기 및 실행 CVE-2020-10977 정보 HackerOne 보고서: https://hackerone.com/reports/827052 Exploit-DB: https://www.exploit-db.com/exploits/48431 실행 부분 수동 재현 방법: 읽기에서 실행까지 이 저장소 정보 getsecret.py - 주요 스크립트입니다. 먼저 thewhiteh4t의 코드를 사용하여 cve-2020-10977을 악용하고 주어진 저장소에서 secretkeybase를 추출합니다. 그런 다음...

CLEANSTART-2026-RE18150 undici's setCookie function does not fully sanitize cookie attributes

CVE-2026-16729 affects multiple packages. undici's setCookie function does not fully sanitize cookie attributes. See references for individual vulnerability details...

CLEANSTART-2026-VO74481 undici's cache interceptor does not handle the Set-Cookie response header anywhere in its cache path, so it neither refuses to store nor strips that header

CVE-2026-84933 affects multiple packages. undici's cache interceptor does not handle the Set-Cookie response header anywhere in its cache path, so it neither refuses to store nor strips that header. See references for individual vulnerability details...

RockyLinux 8 : mod_auth_openidc:2.3 (RLSA-2026:77369)

The remote RockyLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:77369 advisory. modauthopenidc: modauthopenidc: Denial of Service via malformed state cookie parsing CVE-2026-54789 cjose: cjose: Heap buffer overflow in AES Key Wrap...

CVE-2026-107228

The AsyncHttpClient AHC library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. From 2.1.0 until 3.0.14, the enabled-by-default cookie store replaces a Cookie header explicitly supplied through setHeader or addHeader whenever the store contribut...