134 matches found
CVE-2026-29086
In IBM advisories, CVE-2026-29086 affects the Hono web framework used by IBM App Connect Enterprise containers. Prior to 4.12.4, setCookie() did not validate semicolons, carriage returns, or newlines in domain and path when constructing Set-Cookie, enabling potential cookie-attribute injection. T...
CVE-2026-29086 Hono: Cookie Attribute Injection via Unsanitized domain and path in setCookie()
Hono is a Web application framework that provides support for any JavaScript runtime. Prior to version 4.12.4, the setCookie utility did not validate semicolons ;, carriage returns \r, or newline characters \n in the domain and path options when constructing the Set-Cookie header. Because cookie...
CVE-2026-29086 Hono: Cookie Attribute Injection via Unsanitized domain and path in setCookie()
Hono is a Web application framework that provides support for any JavaScript runtime. Prior to version 4.12.4, the setCookie utility did not validate semicolons ;, carriage returns \r, or newline characters \n in the domain and path options when constructing the Set-Cookie header. Because cookie...
EUVD-2026-9508
Hono Vulnerable to Cookie Attribute Injection via Unsanitized domain and path in setCookie...
GHSA-5PQ2-9X2X-5P6W Hono Vulnerable to Cookie Attribute Injection via Unsanitized domain and path in setCookie()
Summary The setCookie utility did not validate semicolons ;, carriage returns \r, or newline characters \n in the domain and path options when constructing the Set-Cookie header. Because cookie attributes are delimited by semicolons, this could allow injection of additional cookie attributes if...
CVE-2025-36134
IBM Sterling B2B Integrator and IBM Sterling File Gateway 6.0.0.0 through 6.1.2.7 and 6.2.0.0 through 6.2.0.5 and 6.2.1.1 could disclose sensitive information due to a missing or insecure SameSite attribute for a sensitive cookie...
CVE-2025-6670
Summary: CVE-2025-6670 describes a CSRF vulnerability in multiple WSO2 products due to using HTTP GET for state-changing admin service operations in the Carbon console event processor. Despite SameSite=Lax mitigation, the cookie attribute is ineffective for cross-origin top-level navigations, all...
EUVD-2017-10244
Malware in sbrugna...
EUVD-2021-27114
Malware in sbrugna...
EUVD-2022-27639
Malicious code in bioql PyPI...
EUVD-2025-22558
Malicious code in bioql PyPI...
CVE-2025-0253
HCL IEM is affected by a cookie attribute not set vulnerability due to inconsistency of certain security-related configurations which could increase exposure to potential vulnerabilities...
CVE-2025-0253
HCL IEM is affected by a cookie attribute not set vulnerability due to inconsistency of certain security-related configurations which could increase exposure to potential vulnerabilities...
CVE-2025-0253
HCL IEM is affected by a cookie attribute not set vulnerability due to inconsistency of certain security-related configurations which could increase exposure to potential vulnerabilities...
CVE-2025-0253 HCL IEM is affected by a cookie attribute not set vulnerability
HCL IEM is affected by a cookie attribute not set vulnerability due to inconsistency of certain security-related configurations which could increase exposure to potential vulnerabilities...
CVE-2025-0253 HCL IEM is affected by a cookie attribute not set vulnerability
HCL IEM is affected by a cookie attribute not set vulnerability due to inconsistency of certain security-related configurations which could increase exposure to potential vulnerabilities...
CVE-2025-0253
CVE-2025-0253 affects HCL IEM and is described as a cookie attribute not set vulnerability caused by inconsistent security-related configurations, leading to potential information exposure. Affected software: HCL IEM (cookie handling/configuration). Underlying issue: cookie attributes not set, en...
PT-2025-30716 · Hcl · Hcl Iem
Name of the Vulnerable Software and Affected Versions: HCL IEM affected versions not specified Description: HCL IEM is affected by a cookie attribute not set vulnerability resulting from inconsistent security-related configurations. This issue could increase exposure to potential vulnerabilities...
CVE-2021-43807
Opencast is an Open Source Lecture Capture & Video Management for Education. Opencast versions prior to 9.10 allow HTTP method spoofing, allowing to change the assumed HTTP method via URL parameter. This allows attackers to turn HTTP GET requests into PUT requests or an HTTP form to send DELETE...
CVE-2020-15574
SolarWinds Serv-U File Server before 15.2.1 mishandles the Same-Site cookie attribute, aka Case Number 00331893...