PT-2025-30386 · WordPress · Bsecure

Name of the Vulnerable Software and Affected Versions: bSecure plugin for WordPress versions 1.3.7 through 1.7.9 Description: The plugin is susceptible to privilege escalation due to a missing authorization check within the order info REST endpoint. The /webhook/v2/order info/ route’s permission...

Mozilla多款产品 安全漏洞

Mozilla Firefox and others are products of the Mozilla Foundation in the U.S.A. Mozilla Firefox is an open source web browser.Mozilla Firefox ESR is an extended support version of Firefox web browser.Mozilla Thunderbird is a suite of e-mail client software that is separate from the Mozilla...

Mozilla -- cookie shadowing

[email protected] reports: Setting a nameless cookie with an equals sign in the value shadowed other cookies. Even if the nameless cookie was set over HTTP and the shadowed cookie included the Secure attribute...

Security Vulnerabilities fixed in Thunderbird 140.1 — Mozilla

On 64-bit platforms IonMonkey-JIT only wrote 32 bits of the 64-bit return value space on the stack. Baseline-JIT, however, read the entire 64 bits. On arm64, a WASM brtable instruction with a lot of entries could lead to the label being too far from the instruction causing truncation and incorrec...

PT-2025-30486

Name of the Vulnerable Software and Affected Versions Firefox versions prior to 141 Firefox ESR versions prior to 140.1 Thunderbird versions prior to 141 Thunderbird versions prior to 140.1 Description Setting a nameless cookie with an equals sign in the value shadowed other cookies. This occurre...

Adobe ColdFusion Cross-Site Scripting Vulnerability (CNVD-2025-16380)

Adobe ColdFusion is the United States Odo than Adobe company's set of rapid application development platform. The platform includes an integrated development environment and scripting language. A cross-site scripting vulnerability exists in Adobe ColdFusion, which is caused by improper validation...

Adobe ColdFusion Cross-Site Scripting Vulnerability (CNVD-2025-16379)

Adobe ColdFusion is the United States Odo than Adobe company's set of rapid application development platform. The platform includes an integrated development environment and scripting language. A cross-site scripting vulnerability exists in Adobe ColdFusion, which is caused by improper validation...

Adobe ColdFusion Cross-Site Scripting Vulnerability (CNVD-2025-16381)

Adobe ColdFusion is the United States Odo than Adobe company's set of rapid application development platform. The platform includes an integrated development environment and scripting language. A cross-site scripting vulnerability exists in Adobe ColdFusion, which is caused by improper validation...

Adobe Experience Manager cross-site scripting vulnerability (CNVD-2025-16388)

Adobe Experience Manager AEM is a set of content management solutions that can be used to build websites, mobile applications and forms from the American company Odobie Adobe. The program supports mobile content management, marketing and sales campaign management and multi-site management. A...

Adobe ColdFusion Cross-Site Scripting Vulnerability (CNVD-2025-16384)

Adobe ColdFusion is the United States Odo than Adobe company's set of rapid application development platform. The platform includes an integrated development environment and scripting language. A cross-site scripting vulnerability exists in Adobe ColdFusion, which is caused by improper validation...

The vulnerability of the Wing FTP server, related to improper checking of the value of the session cookie file UID, allows a hacker to disclose protected information.

The vulnerability of the Wing FTP server is related to improper checking of the value of the session cookie file UID at the /loginok.html endpoint. Exploiting this vulnerability can allow an attacker, operating remotely, to disclose sensitive information...

Exploit for CVE-2025-51863

CVE-2025-51863 Vulnerability description ChatGPTUtil is...

Use of Password Hash With Insufficient Computational Effort

Overview com.xuxueli:xxl-job is a distributed task scheduling framework. Affected versions of this package are vulnerable to Use of Password Hash With Insufficient Computational Effort via the XXLJOBLOGINIDENTITY in the cookie. An attacker can obtain sensitive information by exploiting weak...

CVE-2025-53757

This vulnerability exists in Digisol DG-GR6821AC Router due to misconfiguration of both Secure and HttpOnly flags on session cookies associated with the router web interface. A remote attacker could exploit this vulnerability by capturing the session cookies transmitted over an unsecure HTTP...

CVE-2024-27779

An insufficient session expiration vulnerability CWE-613 in FortiSandbox FortiSandbox version 4.4.4 and below, version 4.2.6 and below, 4.0 all versions, 3.2 all versions and FortiIsolator version 2.4 and below, 2.3 all versions, 2.2 all versions, 2.1 all versions, 2.0 all versions, 1.2 all...

CVE-2024-27779

An insufficient session expiration vulnerability CWE-613 in FortiSandbox FortiSandbox version 4.4.4 and below, version 4.2.6 and below, 4.0 all versions, 3.2 all versions and FortiIsolator version 2.4 and below, 2.3 all versions, 2.2 all versions, 2.1 all versions, 2.0 all versions, 1.2 all...

CVE-2024-27779

CVE-2024-27779 concerns an insufficient session expiration (CWE-613) in Fortinet FortiSandbox and FortiIsolator. Affected: FortiSandbox versions before 4.4.5 (and 4.0–4.2.6) and FortiIsolator versions before 2.4 (and 1.2–2.3). Impact: a remote attacker with a valid admin session cookie can contin...

CVE-2024-27779

An insufficient session expiration vulnerability CWE-613 in FortiSandbox FortiSandbox version 4.4.4 and below, version 4.2.6 and below, 4.0 all versions, 3.2 all versions and FortiIsolator version 2.4 and below, 2.3 all versions, 2.2 all versions, 2.1 all versions, 2.0 all versions, 1.2 all...

CVE-2024-27779

An insufficient session expiration vulnerability CWE-613 in FortiSandbox FortiSandbox version 4.4.4 and below, version 4.2.6 and below, 4.0 all versions, 3.2 all versions and FortiIsolator version 2.4 and below, 2.3 all versions, 2.2 all versions, 2.1 all versions, 2.0 all versions, 1.2 all...

CVE-2024-27779

An insufficient session expiration vulnerability CWE-613 in FortiSandbox FortiSandbox version 4.4.4 and below, version 4.2.6 and below, 4.0 all versions, 3.2 all versions and FortiIsolator version 2.4 and below, 2.3 all versions, 2.2 all versions, 2.1 all versions, 2.0 all versions, 1.2 all...