CGI: Denial of Service in CGI::Cookie.parse

A flaw was found in Ruby's CGI gem. Processing specially crafted large cookies with the CGI::Cookie.parse method can cause excessive resource consumption due to a missing limit on the length of the raw cookie value, resulting in a denial of service...

Oracle Linux 9 : ruby:3.3 (ELSA-2025-4493)

The remote Oracle Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2025-4493 advisory. - Fix Net::IMAP vulnerable to possible DoS by memory exhaustion. CVE-2025-25186 - Fix Denial of Service in CGI::Cookie.parse. CVE-2025-27219 Resolves:...

USN-7476-1 python-scrapy vulnerabilities

It was discovered that Scrapy improperly exposed HTTP authentication credentials to request targets, including during redirects. An attacker could use this issue to gain unauthorized access to user accounts. This issue only affected Ubuntu 18.04 LTS and Ubuntu 20.04 LTS. CVE-2021-41125 It was...

U.S. Dept Of Defense: POST XSS - fields[account][lastname] parameter

A cross-site scripting XSS vulnerability was discovered in the fieldsaccountlastname parameter of the POST request. The vulnerability allowed an attacker to inject malicious scripts that could be executed. This could potentially lead to consequences such as cookie theft and session hijacking...

Improper Domain Validation

org.apache.httpcomponents.client5, httpclient5 is vulnerable to improper domain validation. The vulnerability is due to disabled domain checks where a bug in the PSL validation logic, affecting cookie management and host name verification, which allows an attacker to perform cookie injection or...

webkitgtk: A malicious website may exfiltrate data cross-origin

A flaw was found in WebKitGTK. A malicious website may exfiltrate data cross-origin due to a cookie management issue related to improper state management...

CVE-2024-58134

Mojolicious versions from 0.999922 for Perl uses a hard coded string, or the application's class name, as an HMAC session cookie secret by default. These predictable default secrets can be exploited by an attacker to forge session cookies. An attacker who knows or guesses the secret could compute...

CVE-2024-58134

Mojolicious versions from 0.999922 for Perl uses a hard coded string, or the application's class name, as an HMAC session cookie secret by default. These predictable default secrets can be exploited by an attacker to forge session cookies. An attacker who knows or guesses the secret could compute...

UBUNTU-CVE-2024-58134

Mojolicious versions from 0.999922 for Perl uses a hard coded string, or the application's class name, as an HMAC session cookie secret by default. These predictable default secrets can be exploited by an attacker to forge session cookies. An attacker who knows or guesses the secret could compute...

CVE-2024-58134

CVE-2024-58134 (Mojolicious on Perl): Affected versions are Mojolicious 0.999922 and later up to 9.39, where the HMAC session cookie secret is derived from a hard-coded string or the app class name by default. This predictable secret enables an attacker who learns or guesses the secret to forge v...

CVE-2024-58134

Mojolicious versions from 0.999922 for Perl uses a hard coded string, or the application's class name, as an HMAC session cookie secret by default. These predictable default secrets can be exploited by an attacker to forge session cookies. An attacker who knows or guesses the secret could compute...

PT-2025-18947 · Unknown +1 · Mojolicious +1

Name of the Vulnerable Software and Affected Versions: Mojolicious versions 0.999922 through 9.39 Description: The issue concerns the use of a hard-coded string or the application's class name as a HMAC session secret by default in Mojolicious for Perl. This predictable default secret can be...

The vulnerability of the Process component in the Symfony software development and web application management platform allows attackers to bypass security restrictions.

The vulnerability of the Process component in the Symfony software development and web application management platform is related to deficiencies in the authentication process due to the use of the Remember-me cookie. Exploiting this vulnerability allows a malicious actor to circumvent security...

CVE-2025-46549

YesWiki is a wiki system written in PHP. Prior to version 4.5.4, an attacker can use a reflected cross-site scripting attack to steal cookies from an authenticated user by having them click on a malicious link. Stolen cookies allow the attacker to take over the user’s session. This vulnerability...

CVE-2025-46350

YesWiki is a wiki system written in PHP. Prior to version 4.5.4, an attacker can use a reflected cross-site scripting attack to steal cookies from an authenticated user by having them click on a malicious link. Stolen cookies allow the attacker to take over the user’s session. This vulnerability...

CVE-2022-49803

In the Linux kernel, the following vulnerability has been resolved: netdevsim: Fix memory leak of nsimdev-facookie kmemleak reports this issue: unreferenced object 0xffff8881bac872d0 size 8: comm "sh", pid 58603, jiffies 4481524462 age 68.065s hex dump first 8 bytes: 04 00 00 00 de ad be ef...

AZL-69785 CVE-2022-49803 affecting package kernel 5.15.200.1-1

In the Linux kernel, the following vulnerability has been resolved: netdevsim: Fix memory leak of nsimdev-facookie kmemleak reports this issue: unreferenced object 0xffff8881bac872d0 size 8: comm "sh", pid 58603, jiffies 4481524462 age 68.065s hex dump first 8 bytes: 04 00 00 00 de ad be ef...

UBUNTU-CVE-2022-49803

In the Linux kernel, the following vulnerability has been resolved: netdevsim: Fix memory leak of nsimdev-facookie kmemleak reports this issue: unreferenced object 0xffff8881bac872d0 size 8: comm "sh", pid 58603, jiffies 4481524462 age 68.065s hex dump first 8 bytes: 04 00 00 00 de ad be ef...

CVE-2022-49803

In the Linux kernel, the following vulnerability has been resolved: netdevsim: Fix memory leak of nsimdev-facookie kmemleak reports this issue: unreferenced object 0xffff8881bac872d0 size 8: comm "sh", pid 58603, jiffies 4481524462 age 68.065s hex dump first 8 bytes: 04 00 00 00 de ad be ef...

PT-2025-18520

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A memory leak issue has been identified in the Linux kernel, specifically in the netdevsim module. The issue occurs when the nsim dev trap fa cookie write function allocates memory for f...