32240 matches found
CVE-2024-0947
Reliance on Cookies without Validation and Integrity Checking vulnerability in Talya Informatics Elektraweb allows Session Credential Falsification through Manipulation, Accessing/Intercepting/Modifying HTTP Cookies, Manipulating Opaque Client-based Data Tokens. This issue affects Elektraweb:...
Elektraweb Security Vulnerabilities
Elektraweb is a cloud-hosted web-based hotel program from Elektraweb, Turkey. A security vulnerability exists in Elektraweb versions prior to v17.0.68, which stems from reliance on unvalidated and integrity-checked cookies, which allows an attacker to manipulate, access/intercept/modify HTTP...
CVE-2024-4869
The WP Cookie Consent for GDPR, CCPA & ePrivacy plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘Client-IP’ header in all versions up to, and including, 3.2.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers...
WordPress Plugin WP Cookie Consent Cross-Site Scripting Vulnerability
WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a set of blogging platform developed using the PHP language. The platform supports personal blog sites on servers with PHP and MySQL. WordPress plugin is an application plugin. A cross-site scripting...
Nutanix AOS : Multiple Vulnerabilities (NXSA-AOS-6.8.0.5)
The version of AOS installed on the remote host is prior to 6.8.0.5. It is, therefore, affected by multiple vulnerabilities as referenced in the NXSA-AOS-6.8.0.5 advisory. - CVE-2023-38546 is a cookie injection vulnerability in the curleasyduphandle, a function in libcurl that duplicates easy...
CVE-2024-4869
Based on the CVE entry CVE-2024-4869 and corroborating sources, the WP Cookie Consent plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Client-IP header in all versions up to 3.2.0 due to insufficient input sanitization and output escaping. The vulnerability can allow an u...
CVE-2024-4869 WP Cookie Consent ( for GDPR, CCPA & ePrivacy ) <= 3.2.0 - Unauthenticated Stored Cross-Site Scripting via Client-IP header
The WP Cookie Consent for GDPR, CCPA & ePrivacy plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘Client-IP’ header in all versions up to, and including, 3.2.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers...
CVE-2024-30112
HCL Connections is vulnerable to a cross-site scripting attack where an attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user which leads to executing malicious script code. This may let the attacker steal cookie-based authentication credentials...
CVE-2024-30112 HCL Connections is vulnerable to a cross-site scripting (XSS) vulnerability
HCL Connections is vulnerable to a cross-site scripting attack where an attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user which leads to executing malicious script code. This may let the attacker steal cookie-based authentication credentials...
WordPress WP Cookie Consent ( for GDPR, CCPA & ePrivacy ) plugin <= 3.2.0 - Unauthenticated Stored Cross-Site Scripting via Client-IP header vulnerability
Unauthenticated Stored Cross-Site Scripting via Client-IP header vulnerability discovered by Krzysztof Zając in WordPress Plugin WP Cookie Notice for GDPR, CCPA & ePrivacy Consent versions = 3.2.0...
WordPress WP Cookie Notice for GDPR, CCPA & ePrivacy Consent Plugin <= 3.2.0 is vulnerable to Cross Site Scripting (XSS)
Software WP Cookie Notice for GDPR, CCPA & ePrivacy Consent Type Plugin Vulnerable versions = 3.2.0 Fixed in 3.3.0 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-4869 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID...
PT-2024-23192 · Hcl · Hcl Connections
Name of the Vulnerable Software and Affected Versions: HCL Connections affected versions not specified Description: The issue allows an attacker to execute arbitrary script code in the browser of an unsuspecting user through a cross-site scripting attack. This can lead to the execution of malicio...
Adobe Experience Manager 跨站脚本漏洞
Adobe Experience Manager AEM is a set of content management solutions that can be used to build websites, mobile applications and forms from the American company Odobie Adobe. The program supports mobile content management, marketing and sales campaign management and multi-site management. A...
CVE-2024-6160 SQL Injection in MegaBIP
SQL Injection vulnerability in MegaBIP software allows attacker to disclose the contents of the database, obtain session cookies or modify the content of pages. This issue affects MegaBIP software versions through 5.12.1...
PT-2024-25188 · Asus · Asus Rt-Ax88U
Name of the Vulnerable Software and Affected Versions: ASUS RT-AX88U router firmware versions 3.0.0.4.388 24198 Description: The issue is related to a Buffer Overflow that allows a remote attacker to execute arbitrary code. This is due to improper length validation for the cookie field in the...
Important: php
Issue Overview: The opensslprivatedecrypt function in PHP, when using PKCS1 padding OPENSSLPKCS1PADDING, which is the default, is vulnerable to the Marvin Attack unless it is used with an OpenSSL version that includes the changes from this pull request: https://github.com/openssl/openssl/pull/138...
OPENSUSE-SU-2024:14073-1 ruby3.3-rubygem-http-cookie-1.0.6-1.1 on GA media
These are all security issues fixed in the ruby3.3-rubygem-http-cookie-1.0.6-1.1 package on the GA media of openSUSE Tumbleweed...
Exploit for Injection in Datagear
CVE-2024-37759 PoC Description DataGear version 5.0.0 and...