PT-2025-21192 · Unknown +1 · Klaro Cookie & Consent Management +1

Name of the Vulnerable Software and Affected Versions: Klaro Cookie & Consent Management versions 0.0.0 through 3.0.4 Description: The issue affects Drupal Klaro Cookie & Consent Management, allowing Cross-Site Scripting XSS due to improper neutralization of input during web page generation...

Drupal Klaro Cookie & Consent Management 跨站脚本漏洞

Drupal Klaro Cookie & Consent Management is a module plugin in the Drupal content management system for the Drupal community. A cross-site scripting vulnerability exists in Drupal Klaro Cookie & Consent Management versions prior to 3.0.5, which stems from improper input neutralization and could...

Alibaba Cloud Linux 3 : 0008: python-flask (ALINUX3-SA-2024:0008)

The remote Alibaba Cloud Linux 3 host has packages installed that are affected by a vulnerability as referenced in the ALINUX3-SA-2024:0008 advisory. Package updates are available for Alibaba Cloud Linux 3 that fix the following vulnerabilities: CVE-2023-30861: Flask is a lightweight WSGI web...

Cross-site Scripting (XSS)

org.graylog2:graylog2-server is vulnerable to Cross-site Scripting XSS. The vulnerability is due to insecure input handling due to the ability to inject and submit malicious HTML forms via the Event Definition Remediation Step field, which can result in session cookie theft under specific...

EUVD-2025-14705

A stack-based buffer overflow vulnerability CWE-121 in Fortinet FortiVoice versions 7.2.0, 7.0.0 through 7.0.6, 6.4.0 through 6.4.10, FortiRecorder versions 7.2.0 through 7.2.3, 7.0.0 through 7.0.5, 6.4.0 through 6.4.5, FortiMail versions 7.6.0 through 7.6.2, 7.4.0 through 7.4.4, 7.2.0 through...

webkitgtk: A malicious website may exfiltrate data cross-origin

A flaw was found in WebKitGTK. A malicious website may exfiltrate data cross-origin due to a cookie management issue related to improper state management...

php: host/secure cookie bypass due to partial CVE-2022-31629 fix

An improper input validation vulnerability was found in PHP. Due to an incomplete fix to CVE-2022-31629, network and same-site attackers can set a standard insecure cookie in the victim's browser...

kernel: fscache: delete fscache_cookie_lru_timer when fscache exits to avoid UAF

In the Linux kernel, the following vulnerability has been resolved: fscache: delete fscachecookielrutimer when fscache exits to avoid UAF The fscachecookielrutimer is initialized when the fscache module is inserted, but is not deleted when the fscache module is removed. If timerreduce is called...

kernel: fscache: Fix oops due to race with cookie_lru and use_cookie

In the Linux kernel, the following vulnerability has been resolved: fscache: Fix oops due to race with cookielru and usecookie If a cookie expires from the LRU and the LRUDISCARD flag is set, but the state machine has not run yet, it's possible another thread can call fscacheusecookie and begin t...

kernel: fs/netfs/fscache_cookie: add missing "n_accesses" check

A race condition vulnerability was found in the Linux kernel. A race condition in the fscachecookie subsystem leads to a NULL pointer dereference. The issue occurred when multiple processes accessed a cached file while it was being withdrawn, causing the cache's metadata to clear prematurely...

PT-2025-29477 · Ооо 'Кьютэк' · Qsw-2800-10T-Ac +3

Уязвимость веб-интерфейса коммутаторов Qtech, связанная с некорректной обработкой файлов cookie. Эксплуатация уязвимости, может позволить нарушителю, действующему удаленно, повысить свои привилегии до уровня администратора...

CVE-2025-4537 yangzongzhuan RuoYi-Vue Password login.vue sensitive information in a cookie

A vulnerability was found in yangzongzhuan RuoYi-Vue up to 3.8.9 and classified as problematic. Affected by this issue is some unknown functionality of the file ruoyi-ui/jsencrypt.js and ruoyi-ui/login.vue of the component Password Handler. The manipulation leads to cleartext storage of sensitive...

CVE-2025-4537 yangzongzhuan RuoYi-Vue Password login.vue sensitive information in a cookie

A vulnerability was found in yangzongzhuan RuoYi-Vue up to 3.8.9 and classified as problematic. Affected by this issue is some unknown functionality of the file ruoyi-ui/jsencrypt.js and ruoyi-ui/login.vue of the component Password Handler. The manipulation leads to cleartext storage of sensitive...

RuoYi 安全漏洞

RuoYi is a backend management system for individual developers of RuoYi China. A security vulnerability exists in RuoYi 3.8.9 and earlier versions, which stems from an incorrect operation of the files ruoyi-ui/jsencrypt.js and ruoyi-ui/login.vue that results in sensitive information being stored ...

SUSE CVE-2025-46336

Rack::Session is a session management implementation for Rack. In versions starting from 2.0.0 to before 2.1.1, when using the Rack::Session::Pool middleware, and provided the attacker can acquire a session cookie already a major issue, the session may be restored if the attacker can trigger a lo...

CVE-2025-26844

An issue was discovered in Znuny through 7.1.3. A cookie is set without the HttpOnly flag...

PT-2025-27486

Name of the Vulnerable Software and Affected Versions Wing FTP Server versions prior to 7.4.4 Description Wing FTP Server contains an information disclosure issue in the loginok.html file. The vulnerability occurs when a long value is provided in the UID cookie. This allows a remote attacker to...

CVE-2025-47269

Summary: The code-server CVE-2025-47269 vulnerability affects versions before 4.99.4, where a maliciously crafted URL using the built-in proxy /proxy subpath can cause the proxy to forward to an attacker-controlled domain, potentially exposing a user’s session token and enabling session hijacking...

CVE-2025-47269 code-server session cookie can be extracted by having user visit specially crafted proxy URL

code-server runs VS Code on any machine anywhere through browser access. Prior to version 4.99.4, a maliciously crafted URL using the proxy subpath can result in the attacker gaining access to the session token. Failure to properly validate the port for a proxy request can result in proxying to a...

CVE-2025-47269 code-server session cookie can be extracted by having user visit specially crafted proxy URL

code-server runs VS Code on any machine anywhere through browser access. Prior to version 4.99.4, a maliciously crafted URL using the proxy subpath can result in the attacker gaining access to the session token. Failure to properly validate the port for a proxy request can result in proxying to a...