866 matches found
Web-Penetration-Test
Web-Penetration-Test Exploiting WordPress vulnerabilities CVE-2025-34077, authentication bypass via cookie injection, and privilege escalation to root. Part of my Cybersecurity Specialization. Day 1: Hacking my First Website Lab Report: Exploiting the "BigWear" Server In this first session of my...
discuz-ml-rce
discuz-ml-rce Affected systems and versions: Discuz!ML V3.2-3.4 Discuz!x V3.2-3.4 Vulnerability cause: The Discuz!ML system does not filter the language parameter content received by l in the cookie, leading to string concatenation, thereby executing PHP code. The cookie field will contain an...
CVE-2026-5513
CVE-2026-5513 https://t.me/FreeToolsCpa CVE-2026-5513 — Bookly ≤ 27.2 Stored XSS via Cookie CVE-2026-5513 — Bookly ≤ 27.2 Stored XSS via Cookie CVE CVSS Type Auth https://t.me/FreeToolsCpa CVE file In Group Overview Field Value CVE ID CVE-2026-5513 Vulnerability Stored Cross-Site Scripting XSS...
CVE-2024-34324
An issue in ProPhoenix Law RMS v2022.2403.3.101 allows attackers to execute a session hijacking attack via injecting a crafted 24-character string into the ASP.NETSessionId cookie...
curl security update
An update is available for curl. This update affects Rocky Linux 9. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list The curl packages provide the libcurl library and the curl utility for downloadi...
RLSA-2026:80511 Moderate: curl security update
The curl packages provide the libcurl library and the curl utility for downloading files from servers using various protocols, including HTTP, FTP, and LDAP. Security Fixes: curl: curl: Cookie injection via malicious HTTP server using super cookies CVE-2026-8924 curl: curl: Information disclosure...
Oracle Linux 9 : curl (ELSA-2026-80511)
The remote Oracle Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-80511 advisory. - fix cookie injection via trailing dot super cookies CVE-2026-8924 Tenable has extracted the preceding description block directly from the Oracle Lin...
CVE-2024-34324: Session Fixation
An issue in ProPhoenix Law RMS v2022.2403.3.101 allows attackers to execute a session hijacking attack via injecting a crafted 24-character string into the ASP.NETSessionId cookie...
CVE-2026-107226
The AsyncHttpClient AHC library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. From 2.1.0 until 3.0.14, the default ThreadSafeCookieStore does not retain whether a Set-Cookie response used a secure transport. It accepts Secure cookies received...
CVE-2026-107226
The AsyncHttpClient AHC library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. From 2.1.0 until 3.0.14, the default ThreadSafeCookieStore does not retain whether a Set-Cookie response used a secure transport. It accepts Secure cookies received...
curl: curl: Cookie injection via malicious HTTP server using super cookies
A flaw was found in curl's cookie parsing logic. A malicious HTTP server can exploit this by setting 'super cookies' that bypass the Public Suffix List check. This allows an attacker-controlled origin to inject cookies that curl then transmits to unrelated third-party domains, leading to...
Moderate: Red Hat Security Advisory: curl security update
An update for curl is now available for Red Hat Enterprise Linux 9. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the C...
Moderate: curl security update
The curl packages provide the libcurl library and the curl utility for downloading files from servers using various protocols, including HTTP, FTP, and LDAP. Security Fixes: curl: curl: Cookie injection via malicious HTTP server using super cookies CVE-2026-8924 curl: curl: Information disclosure...
ALSA-2026:80511 Moderate: curl security update
The curl packages provide the libcurl library and the curl utility for downloading files from servers using various protocols, including HTTP, FTP, and LDAP. Security Fixes: curl: curl: Cookie injection via malicious HTTP server using super cookies CVE-2026-8924 curl: curl: Information disclosure...
CVE-2023-25292
CVE-2023-25292 Reflected Cross Site Scripting XSS in Intermesh BV Group-Office version 6.6.145, allows attackers to gain escalated privileges and gain sensitive information via the GOLANGUAGE cookie Vulnerability Details Product: Group Office Application Version: 6.6.145 Vulnerability Type:...
chromecookiestealer
Chrome Cookie Stealer y inyector Se adjunta a Chrome utilizando su protocolo Remote DevTools y roba/inyecta/limpia/elimina cookies. Muy inspirado por WhiteChocolateMacademiaNut. Las cookies se vuelcan como objetos JSON usando el propio formato de Chrome. El mismo formato se usa para las cookies a...
curl security update
7.76.1-40.el98.8 - fix cookie injection via trailing dot super cookies CVE-2026-8924 - fix digest auth state leak on origin or credential change CVE-2026-11856...
Improper Input Validation
AsyncHttpClient is vulnerable to Improper Input Validation. The vulnerability is due to failure to reject public suffixes in cookie Domain attributes, which allows an attacker controlling a host beneath a public suffix to inject or overwrite cookies shared across unrelated hosts, potentially...
EUVD-2026-94639
AsyncHttpClient: Cookie Domain attribute is not checked against the public suffix list, so a cookie can be set for co.uk...
UBUNTU-CVE-2026-107280
The AsyncHttpClient AHC library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. Prior to 3.0.13 and 2.16.1, ThreadSafeCookieStore validates Domain attributes with domain matching but does not reject public suffixes. A host beneath a suffix such ...