GHSA-WVMQ-W7M8-G9XM Insecure cookie storage in Apache Atlas

Apache Atlas versions 0.6.0-incubating and 0.7.0-incubating use cookies that could be accessible to client-side script...

Insecure cookie storage in Apache Atlas

Apache Atlas versions 0.6.0-incubating and 0.7.0-incubating use cookies that could be accessible to client-side script...

CVE-2021-24879

The SupportCandy WordPress plugin before 2.2.7 does not have CSRF check in the wpsctickets AJAX action, nor has any sanitisation or escaping in some of the filter fields which could allow attackers to make a logged in user having access to the ticket lists dashboard set an arbitrary filter stored...

CVE-2020-15105

Django Two-Factor Authentication before 1.12, stores the user's password in clear text in the user session base64-encoded. The password is stored in the session when the user submits their username and password, and is removed once they complete authentication by entering a two-factor...

BSA-2019-783

Security Advisory ID : BSA-2019-783 Component : VPN Revision : 1.0: Final Virtual Private Networks VPNs are used to create a secure connection with another network over the internet. Multiple VPN applications store the authentication and/or session cookies insecurely in memory and/or log files...

PYSEC-2018-35

aio-libs aiohttp-session version 2.6.0 and earlier contains a Other/Unknown vulnerability in EncryptedCookieStorage and NaClCookieStorage that can result in Non-expiring sessions / Infinite lifespan. This attack appear to be exploitable via Recreation of a cookie post-expiry with the same value...

The vulnerability of the Mozilla Firefox browser, related to errors in the implementation of cookie storage mechanisms, allows a hacker to access cookies with the `HttpOnly` attribute.

The vulnerability of the Mozilla Firefox browser is related to errors in the implementation of cookie storage mechanisms. Exploiting this vulnerability can allow a malicious actor, operating remotely, to access cookies with the HttpOnly attribute through a crafted HTTP request...

CVE-2016-4027

An issue was discovered in Open-Xchange OX App Suite before 7.8.1-rev10. App Suite frontend offers to control whether a user wants to store cookies that exceed the session duration. This functionality is useful when logging in from clients with reduced privileges or shared environments. However t...

The vulnerability of the Firefox browser, which allows a violator to obtain confidential information

The vulnerability of Firefox browsers relates to the storage of cookie files, which contain vertical slashes. Exploiting this vulnerability allows a remote attacker to obtain confidential information by reading HTTP cookie headers...

The vulnerability of the Safari browser, which allows a hacker to track users

The vulnerability of the Top Sites function in the Safari browser is related to improper storage of cookie files. Exploiting this vulnerability can allow a malicious actor to remotely track users...

CVE-2016-1772

The Top Sites feature in Apple Safari before 9.1 mishandles cookie storage, which makes it easier for remote web servers to track users via unspecified vectors...

CVE-2016-1772

The Top Sites feature in Apple Safari before 9.1 mishandles cookie storage, which makes it easier for remote web servers to track users via unspecified vectors...

Design/Logic Flaw

The Top Sites feature in Apple Safari before 9.1 mishandles cookie storage, which makes it easier for remote web servers to track users via unspecified vectors...

CVE-2016-1772

The Top Sites feature in Apple Safari before 9.1 mishandles cookie storage, which makes it easier for remote web servers to track users via unspecified vectors...

CVE-2016-1772: Exposure of Sensitive Information to an Unauthorized Actor

The Top Sites feature in Apple Safari before 9.1 mishandles cookie storage, which makes it easier for remote web servers to track users via unspecified vectors...

CVE-2016-1939

CVE-2016-1939 affects Mozilla Firefox before 44.0, where cookies with vertical tab characters can leak sensitive information via HTTP Cookie headers. This issue is noted as stemming from an incomplete fix for CVE-2015-7208. The vulnerability is limited to cookie-name handling and can lead to info...

XMB - eXtreme Message Board 1.9.11.13 Weak Crypto / Insecure Password Storage

Credits: hyp3rlinx + Website: hyp3rlinx.altervista.org + Source: http://hyp3rlinx.altervista.org/advisories/XMB-WEAK-CRYPTO.txt Vendor: ============== xmbforum2.com Product: ====================================== XMB - eXtreme Message Board v1.9.11.13 XMB forum software is open source and runs...

Thousands of websites based on Ruby on Rails vulnerable to Cookie Handling flaw

Ruby on Rails contains a flaw in its design that may allow attackers to more easily access applications. Websites that rely on Ruby on Rails’s default cookie storage mechanism CookieStore are at risk. The vulnerability was actually reported two months ago, but still thousands of website are runni...

Re: Project Pier Web Vulnerabilities

Mitre has assigned the following CVE's for these issues in Project Pier: XSS: CVE-2013-3635 Session cookies lack HttpOnly flag: CVE-2013-3636 Session cookies lack Secure flag: CVE-2013-3637 On Tue, May 21, 2013 at 9:26 PM, the infinitenigma [email protected] wrote: Summary...

CVE-2013-0982: Exposure of Sensitive Information to an Unauthorized Actor

The Private Browsing feature in CFNetwork in Apple Mac OS X before 10.8.4 does not prevent storage of permanent cookies upon exit from Safari, which might allow physically proximate attackers to bypass cookie-based authentication by leveraging an unattended workstation...