PT-2024-8444 · Symphony +4 · Symphony +4

Name of the Vulnerable Software and Affected Versions: Symphony versions prior to 5.4.47 Symphony versions prior to 6.4.15 Symphony versions prior to 7.1.8 Description: The vulnerability is related to the authentication process in the Symphony PHP framework. When consuming a persisted remember-me...

Cross-site Scripting (XSS)

Overview feast is a Python SDK for Feast Affected versions of this package are vulnerable to Cross-site Scripting XSS in Jinja2 Environment. Details Cross-site scripting or XSS is a code vulnerability that occurs when an attacker “injects” a malicious script into an otherwise trusted website. The...

The vulnerability of the Session Cookie Handler component of the Ragic Enterprise Cloud Database platform allows a hacker to obtain user session cookies.

The vulnerability of the Session Cookie Handler component of the Ragic Enterprise Cloud Database platform’s tool for creating customizable databases is related to the lack of authentication for the critical function. Exploiting this vulnerability could allow a malicious actor to obtain user sessi...

Mozilla多款产品 安全漏洞

Mozilla Firefox and others are products of the Mozilla Foundation in the U.S.A. Mozilla Firefox is an open source web browser.Mozilla Firefox ESR is an extended support version of Firefox web browser.Mozilla Thunderbird is a suite of e-mail client software separate from the Mozilla Application...

CVE-2024-48955

Broken access control in NetAdmin 4.030319 returns data with functionalities on the endpoint that "assembles" the functionalities menus, the return of this call is not encrypted and as the system does not validate the session authorization, an attacker can copy the content of the browser of a use...

NetAdmin 安全漏洞

NetAdmin is nsnail's open source, a general purpose backend permissions management system, rapid development framework. A security vulnerability exists in NetAdmin version 4.0.30319, which can be exploited to steal a valid session cookie and inject it into another device to grant unauthorized...

PT-2024-31043 · Apple · Ipados +6

Name of the Vulnerable Software and Affected Versions: Safari versions prior to 18.1 visionOS versions prior to 2.1 tvOS versions prior to 18.1 iOS versions prior to 18.1 iPadOS versions prior to 18.1 watchOS versions prior to 11.1 Description: A cookie management issue was addressed with improve...

Fortinet FortiWeb ] Buffer overflow vulnerability in the cookie header (FG-IR-20-126)

The version of FortiWeb installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the FG-IR-20-126 advisory. - A stack-based buffer overflow vulnerability in FortiWeb 6.3.0 through 6.3.7 and version before 6.2.4 may allow a remote,...

Exploit for Authentication Bypass by Spoofing in Zabbix

CVE-2022-23131 Zabbix Frontend Authentication Bypass Vulnerabi...

CVE-2024-9598

The AMP for WP – Accelerated Mobile Pages plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.99.1. This is due to missing or incorrect nonce validation on the 'proxy' function. This makes it possible for unauthenticated attackers to send the...

GPT Academic Cross-Site Scripting Vulnerability (CNVD-2025-22743)

GPT Academic is an interface that provides pragmatic interactions for LLM grand language models such as GPT/GLM. GPT Academic suffers from a cross-site scripting vulnerability that stems from the application's lack of effective filtering and escaping of user-supplied data, which can be exploited ...

CVE-2024-43177

IBM Concert 1.0.0 and 1.0.1 vulnerable to attacks that rely on the use of cookies without the SameSite attribute...

CVE-2024-43173

IBM Concert 1.0.0 and 1.0.1 vulnerable to attacks that rely on the use of cookies without the SameSite attribute...

CVE-2024-43177 IBM Concert improper certificate validation

IBM Concert 1.0.0 and 1.0.1 vulnerable to attacks that rely on the use of cookies without the SameSite attribute...

SUSE CVE-2022-48989

In the Linux kernel, the following vulnerability has been resolved: fscache: Fix oops due to race with cookielru and usecookie If a cookie expires from the LRU and the LRUDISCARD flag is set, but the state machine has not run yet, it's possible another thread can call fscacheusecookie and begin t...

PT-2024-30358 · Ibm · Ibm Concert

Name of the Vulnerable Software and Affected Versions: IBM Concert versions 1.0.0 through 1.0.1 Description: The issue concerns attacks that rely on the use of cookies without the SameSite attribute. Recommendations: For versions 1.0.0 and 1.0.1, consider configuring cookies to include the SameSi...

Cross-site Scripting (XSS)

Overview Affected versions of this package are vulnerable to Cross-site Scripting XSS through the input validation process. An attacker can manipulate the output seen by other users by injecting malicious scripts. Details Cross-site scripting or XSS is a code vulnerability that occurs when an...

DEBIAN-CVE-2022-48989

In the Linux kernel, the following vulnerability has been resolved: fscache: Fix oops due to race with cookielru and usecookie If a cookie expires from the LRU and the LRUDISCARD flag is set, but the state machine has not run yet, it's possible another thread can call fscacheusecookie and begin t...

UBUNTU-CVE-2022-48989

In the Linux kernel, the following vulnerability has been resolved: fscache: Fix oops due to race with cookielru and usecookie If a cookie expires from the LRU and the LRUDISCARD flag is set, but the state machine has not run yet, it's possible another thread can call fscacheusecookie and begin t...

DEBIAN-CVE-2024-49870

In the Linux kernel, the following vulnerability has been resolved: cachefiles: fix dentry leak in cachefilesopenfile A dentry leak may be caused when a lookup cookie and a cull are concurrent: P1 | P2 ----------------------------------------------------------- cachefileslookupcookie...