DEBIAN-CVE-2024-51996

Symphony process is a module for the Symphony PHP framework which executes commands in sub-processes. When consuming a persisted remember-me cookie, Symfony does not check if the username persisted in the database matches the username attached with the cookie, leading to authentication bypass. Th...

UBUNTU-CVE-2024-51996

Symphony process is a module for the Symphony PHP framework which executes commands in sub-processes. When consuming a persisted remember-me cookie, Symfony does not check if the username persisted in the database matches the username attached with the cookie, leading to authentication bypass. Th...

Authentication Bypass

Overview symfony/security-http is a provides an infrastructure for sophisticated authorization systems, which makes it possible to easily separate the actual authorization logic from so called user providers that hold the users credentials. Affected versions of this package are vulnerable to...

CVE-2024-51996 Symphony has an Authentication Bypass via RememberMe

Symphony process is a module for the Symphony PHP framework which executes commands in sub-processes. When consuming a persisted remember-me cookie, Symfony does not check if the username persisted in the database matches the username attached with the cookie, leading to authentication bypass. Th...

CVE-2024-51996 Symphony has an Authentication Bypass via RememberMe

Symphony process is a module for the Symphony PHP framework which executes commands in sub-processes. When consuming a persisted remember-me cookie, Symfony does not check if the username persisted in the database matches the username attached with the cookie, leading to authentication bypass. Th...

CVE-2024-52305 UnoPim Stored XSS : Cookie hijacking through Create User function

UnoPim is an open-source Product Information Management PIM system built on the Laravel framework. A vulnerability exists in the Create User process, allowing the creation of a new admin account with an option to upload a profile image. An attacker can upload a malicious SVG file containing an...

CVE-2024-52305 UnoPim Stored XSS : Cookie hijacking through Create User function

UnoPim is an open-source Product Information Management PIM system built on the Laravel framework. A vulnerability exists in the Create User process, allowing the creation of a new admin account with an option to upload a profile image. An attacker can upload a malicious SVG file containing an...

Symphony Communication ServicesHp Symphony 安全漏洞

Symphony Communication ServicesHp Symphony is a solution from Symphony Communication ServicesHp, Inc. for connecting and liquefying financial transaction workflows. A security vulnerability exists in Symphony Communication ServicesHp Symphony that stems from the fact that when using a persistent...

Ubuntu 18.04 LTS / 20.04 LTS / 22.04 LTS : Tomcat vulnerabilities (USN-7106-1)

The remote Ubuntu 18.04 LTS / 20.04 LTS / 22.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-7106-1 advisory. It was discovered that Tomcat did not include the secure attribute for session cookies when using the RemoteIpFilter with request...

kernel: dpll: fix dpll_pin_on_pin_register() for multiple parent pins

In the Linux kernel, the following vulnerability has been resolved: dpll: fix dpllpinonpinregister for multiple parent pins In scenario where pin is registered with multiple parent pins via dpllpinonpinregister.., all belonging to the same dpll device. A second call to dpllpinonpinunregister...

kernel: cachefiles: fix slab-use-after-free in cachefiles_withdraw_cookie()

A potential use after free was found in the Linux kernel...

mod_auth_openidc: DoS when using `OIDCSessionType client-cookie` and manipulating cookies

A flaw was found in modauthopenidc, an OpenID Certified™ authentication and authorization module for the Apache HTTP server. Missing input validation in the modauthopenidcsessionchunks cookie value can make the server vulnerable to a denial of service attack. This issue may allow a remote attacke...

RHEL 9 : mod_auth_openidc (RHSA-2024:9180)

The remote Redhat Enterprise Linux 9 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2024:9180 advisory. The modauthopenidc is an OpenID Connect authentication module for Apache HTTP Server. It enables an Apache HTTP Server to operate as an OpenID Connec...

Moderate: mod_auth_openidc security update

The modauthopenidc is an OpenID Connect authentication module for Apache HTTP Server. It enables an Apache HTTP Server to operate as an OpenID Connect Relying Party and/or OAuth 2.0 Resource Server. Security Fixes: modauthopenidc: DoS when using OIDCSessionType client-cookie and manipulating...

PT-2024-34350 · Axigen · Axigen Mail Server

Name of the Vulnerable Software and Affected Versions: Axigen Mail Server versions prior to 10.5.29 Description: The issue concerns persistent and reflected XSS vulnerabilities in the themeMode cookie and h URL parameter. This could allow attackers to execute arbitrary Javascript, potentially...

WordPress Cookie Nonsense for YT plugin <= 1.2.0 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by SOPROBRO Patchstack Alliance in WordPress Plugin Cookie Nonsense for YT versions = 1.2.0...

EulerOS 2.0 SP10 : python3 (EulerOS-SA-2024-2911)

According to the versions of the python3 packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : An issue was found in the CPython zipfile module affecting versions 3.12.1, 3.11.7, 3.10.13, 3.9.18, and 3.8.18 and prior. The zipfile module is...

WordPress Cookie Nonsense for YT Plugin <= 1.2.0 is vulnerable to Cross Site Scripting (XSS)

Software Cookie Nonsense for YT Type Plugin Vulnerable versions = 1.2.0 Fixed in N/A OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-51933 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID 0e3863ff0bc1 Credits SOPROBRO Required privilege...

CVE-2024-30142

HCL BigFix Compliance is affected by a missing secure flag on a cookie. If a secure flag is not set, cookies may be stolen by an attacker using XSS, resulting in unauthorized access or session cookies could be transferred over an unencrypted channel...

CVE-2024-30142

HCL BigFix Compliance is affected by a missing secure flag on a cookie. If a secure flag is not set, cookies may be stolen by an attacker using XSS, resulting in unauthorized access or session cookies could be transferred over an unencrypted channel...