Reliance on Cookies without Validation and Integrity Checking

Overview yt-dlp is an A youtube-dl fork with additional features and patches Affected versions of this package are vulnerable to Reliance on Cookies without Validation and Integrity Checking due to improper cookies validation through YoutubeDL.py. This vulnerability allows unscoped cookies to be...

CVE-2024-9820: Reliance on Cookies without Validation and Integrity Checking in a Security Decision

The WP 2FA with Telegram plugin for WordPress is vulnerable to Two-Factor Authentication Bypass in versions up to, and including, 3.0. This is due to the two-factor code being stored in a cookie, which makes it possible to bypass two-factor authentication...

CVE-2024-47764

A flaw was found in the Cookie Node.js module, a basic HTTP cookie parser and serializer for HTTP servers. The cookie name could be used to set other fields of the cookie, resulting in an unexpected cookie value. A similar escape can be used for path and domain, which could be abused to alter oth...

AZL-50067 CVE-2024-47764 affecting package nodejs-nodemon 2.0.3-5

cookie is a basic HTTP cookie parser and serializer for HTTP servers. The cookie name could be used to set other fields of the cookie, resulting in an unexpected cookie value. A similar escape can be used for path and domain, which could be abused to alter other fields of the cookie. Upgrade to...

CVE-2023-26770

TaskCafe 0.3.2 lacks validation in the Cookie value. Any unauthenticated attacker who knows a registered UserID can change the password of that user...

Jordanknott Taskcafe 安全漏洞

Jordanknott Taskcafe is a project management tool developed in the Go language by Jordanknott. A security vulnerability exists in Jordanknott Taskcafe version 0.3.2, which stems from a lack of validation of cookie values, and allows any unauthenticated attacker who knows the ID of a registered us...

CVE-2023-26770

TaskCafe 0.3.2 lacks validation in the Cookie value. Any unauthenticated attacker who knows a registered UserID can change the password of that user...

CVE-2023-26770

TaskCafe 0.3.2 lacks validation in the Cookie value. Any unauthenticated attacker who knows a registered UserID can change the password of that user...

Persistent Login - Moderately critical - Access bypass - SA-CONTRIB-2024-044

This module enables users to remain logged in separately from session timeouts. The module doesn't sufficiently check a user's disabled status when validating cookies. This vulnerability is mitigated by the fact that an attacker must have an unexpired cookie from a previous successful login...

WordPress To Do CSRF

The vulnerability of the wptodoaddcomment function in the WordPress To Do plugin, a content management system for websites, is related to the of cross-site requests due to incorrect validation of the value of the nonce cookie. Exploiting this vulnerability could allow an attacker to execute a CSR...

PT-2024-15928

Name of the Vulnerable Software and Affected Versions Elektraweb versions prior to 17.0.68 Description The issue is related to the reliance on cookies without proper validation and integrity checking, allowing for session credential falsification through manipulation. This can involve accessing,...

CLSA-2024-1716883173 curl: Fix of CVE-2023-46218

CVE-2023-46218: fix cookie validation to prevent passing cookies to unrelated sites...

CLSA-2024-1716882786 curl: Fix of CVE-2023-46218

CVE-2023-46218: fix cookie validation to prevent passing cookies to unrelated sites...

CVE-2024-21872 Electrolink FM/DAB/TV Transmitter Reliance on Cookies without Validation and Integrity Checking

The device allows an unauthenticated attacker to bypass authentication and modify the cookie to reveal hidden pages that allows more critical operations to the transmitter...

CVE-2024-21872: Reliance on Cookies without Validation and Integrity Checking

The device allows an unauthenticated attacker to bypass authentication and modify the cookie to reveal hidden pages that allows more critical operations to the transmitter...

CVE-2024-28288: Reliance on Cookies without Validation and Integrity Checking

Ruijie RG-NBR700GW 10.34b12 router lacks cookie verification when resetting the password, resulting in an administrator password reset vulnerability. An attacker can use this vulnerability to log in to the device and disrupt the business of the enterprise...

USN-6456-2: Firefox regressions

USN-6456-1 fixed vulnerabilities in Firefox. The update introduced several minor regressions. This update fixes the problem. We apologize for the inconvenience. Original advisory details: Multiple security issues were discovered in Firefox. If a user were tricked into opening a specially crafted...

USN-6456-1: Firefox vulnerabilities

Multiple security issues were discovered in Firefox. If a user were tricked into opening a specially crafted website, an attacker could potentially exploit these to cause a denial of service, obtain sensitive information across domains, or execute arbitrary code. CVE-2023-5722, CVE-2023-5724,...

USN-6456-1 firefox vulnerabilities

Multiple security issues were discovered in Firefox. If a user were tricked into opening a specially crafted website, an attacker could potentially exploit these to cause a denial of service, obtain sensitive information across domains, or execute arbitrary code. CVE-2023-5722, CVE-2023-5724,...

CVE-2023-35794

An issue was discovered in Cassia Access Controller 2.1.1.2303271039. The Web SSH terminal endpoint spawned console can be accessed without authentication. Specifically, there is no session cookie validation on the Access Controller; instead, there is only Basic Authentication to the SSH console...