1280 matches found
CVE-2022-34760
A CWE-835: Loop with Unreachable Exit Condition 'Infinite Loop' vulnerability exists that could cause a denial of service of the webserver due to improper handling of the cookies. Affected Products: X80 advanced RTU Communication Module BMENOR2200H V1.0, OPC UA Modicon Communication Module...
curl 缓冲区错误漏洞
curl is a tool for transferring data from or to a server. A buffer error vulnerability exists in curl versions 7.16.4 and later, including 7.83.1, due to incorrect handling of certain cookies, which can be exploited by an attacker to perform a denial-of-service attack...
CVE-2022-31033
The Mechanize library is used for automating interaction with websites. Mechanize automatically stores and sends cookies, follows redirects, and can follow links and submit forms. In versions prior to 2.8.5 the Authorization header is leaked after a redirect to a different port on the same site...
DEBIAN-CVE-2022-27779
libcurl wrongly allows cookies to be set for Top Level Domains TLDs if thehost name is provided with a trailing dot.curl can be told to receive and send cookies. curl's "cookie engine" can bebuilt with or without Public Suffix Listawareness. If PSL support not provided, a more rudimentary check...
ALPINE-CVE-2022-27779
libcurl wrongly allows cookies to be set for Top Level Domains TLDs if thehost name is provided with a trailing dot.curl can be told to receive and send cookies. curl's "cookie engine" can bebuilt with or without Public Suffix Listawareness. If PSL support not provided, a more rudimentary check...
CVE-2022-27779
libcurl wrongly allows cookies to be set for Top Level Domains TLDs if thehost name is provided with a trailing dot.curl can be told to receive and send cookies. curl's "cookie engine" can bebuilt with or without Public Suffix Listawareness. If PSL support not provided, a more rudimentary check...
The vulnerability of the cURL command-line utility relates to an error in setting cookies for top-level domain names (TLDs). This allows a malicious actor to gain unauthorized access to protected information.
The vulnerability of the cURL command-line utility is related to an error in setting cookies for top-level domain names TLDs, where the ending point in the hostname is used. Exploiting this vulnerability can allow a remote attacker to gain unauthorized access to protected information using cookie...
PT-2022-4629
Name of the Vulnerable Software and Affected Versions .NET Core 3.1 versions prior to 3.1.25 .NET 5.0 versions prior to 5.0.17 .NET 6.0 versions prior to 6.0.5 Description The issue is related to a Denial of Service vulnerability in .NET and Visual Studio, where a malicious client can manipulate...
MGASA-2022-0162 Updated firefox packages fix security vulnerability
Documents in deeply-nested cross-origin browsing contexts could have obtained permissions granted to the top-level origin, bypassing the existing prompt and wrongfully inheriting the top-level permissions CVE-2022-29909. Firefox did not properly protect against top-level navigations for an iframe...
The vulnerability in Node.js’ follow-redirects module, related to cookie handling errors, allows attackers to gain unauthorized access to protected information.
The vulnerability in Node.js’ follow-redirect module is related to errors in cookie handling. Exploiting this vulnerability can allow an attacker to gain unauthorized access to protected information...
Mozilla: Reader mode bypassed SameSite cookies
A flaw was found in Mozilla. The Mozilla Foundation Security Advisory describes the issue of requests initiated through the reader mode did not properly omit cookies with a SameSite attribute...
CVE-2022-29912
A flaw was found in Mozilla. The Mozilla Foundation Security Advisory describes the issue of requests initiated through the reader mode did not properly omit cookies with a SameSite attribute...
Apache Tomcat Mishandles Character Sequence in Cookies
Apache Tomcat 6.0.0 to 6.0.13, 5.5.0 to 5.5.24, 5.0.0 to 5.0.30, 4.1.0 to 4.1.36, and 3.3 to 3.3.2 does not properly handle the " character sequence in a cookie value, which might cause sensitive information such as session IDs to be leaked to remote attackers and enable session hijacking attacks...
CVE-2021-46416
Insecure direct object reference in SUNNY TRIPOWER 5.0 Firmware version 3.10.16.R leads to unauthorized user groups accessing due to insecure cookie handling...
CVE-2021-46416
Insecure direct object reference in SUNNY TRIPOWER 5.0 Firmware version 3.10.16.R leads to unauthorized user groups accessing due to insecure cookie handling...
CVE-2021-46416
Insecure direct object reference in SUNNY TRIPOWER 5.0 Firmware version 3.10.16.R leads to unauthorized user groups accessing due to insecure cookie handling...
CVE-2021-46416
Insecure direct object reference in SUNNY TRIPOWER 5.0 Firmware version 3.10.16.R leads to unauthorized user groups accessing due to insecure cookie handling...
CVE-2021-46416
CVE-2021-46416 concerns the SUNNY TRIPOWER 5.0 firmware (version 3.10.16.R). The vulnerability arises from insecure cookie handling that enables an insecure direct object reference, allowing an unauthorized user group to access restricted functionality. The issue is described in the CVE entry as ...
SMA Solar Technology SUNNY TRIPOWER 安全漏洞
The SMA Solar Technology SUNNY TRIPOWER is a solar inverter from SMA Solar Technology, Germany. A security vulnerability exists in SMA Solar Technology SUNNY TRIPOWER 5.0, which stems from an insecure direct object reference that could lead to unauthorized user group access due to insecure cookie...