MAL-2025-3541 Malicious code in express-cookie-parser (npm)

This package impersonates the popular 'cookie-parser' package. Remote code execution, persistence, self-deletion, and obfuscation found in the package's code confirm its malicious nature...

[SECURITY] Fedora 41 Update: rust-cookie_store-0.21.1-1.fc41

Implementation of Cookie storage and retrieval...

[SECURITY] Fedora 40 Update: rust-cookie_store-0.21.1-1.fc40

Implementation of Cookie storage and retrieval...

[SECURITY] Fedora 42 Update: rust-cookie_store-0.21.1-1.fc42

Implementation of Cookie storage and retrieval...

CVE-2025-31120 NamelessMC Vulnerable to Cookie-Based View Count Manipulation

NamelessMC is a free, easy to use & powerful website software for Minecraft servers. In version 2.1.4 and prior, an insecure view count mechanism in the forum page allows an unauthenticated attacker to artificially increase the view count. The application relies on a client-side cookie nl-topic-t...

CVE-2025-31120

CVE-2025-31120 affects NamelessMC 2.1.4 and earlier. The issue stems from an insecure view count mechanism on the forum page that relies on a client-side cookie nl-topic-[tid] (or session for guests) to decide whether a view should be counted. When the cookie is absent, every page request increme...

CVE-2025-31120 NamelessMC Vulnerable to Cookie-Based View Count Manipulation

NamelessMC is a free, easy to use & powerful website software for Minecraft servers. In version 2.1.4 and prior, an insecure view count mechanism in the forum page allows an unauthenticated attacker to artificially increase the view count. The application relies on a client-side cookie nl-topic-t...

PT-2025-17332 · Unknown · Volmarg Personal Management System

Name of the Vulnerable Software and Affected Versions: Volmarg Personal Management System version 1.4.65 Description: The issue allows attackers to execute arbitrary code and obtain sensitive information via the SameSite cookie attribute defaults value set to none. This is related to Cross Site...

CVE-2025-28355

Volmarg Personal Management System 1.4.65 is vulnerable to Cross Site Request Forgery CSRF allowing attackers to execute arbitrary code and obtain sensitive information via the SameSite cookie attribute defaults value set to none...

CVE-2025-28355

Volmarg Personal Management System 1.4.65 is vulnerable to Cross Site Request Forgery CSRF allowing attackers to execute arbitrary code and obtain sensitive information via the SameSite cookie attribute defaults value set to none...

CVE-2025-28355

Volmarg Personal Management System 1.4.65 is vulnerable to Cross Site Request Forgery CSRF allowing attackers to execute arbitrary code and obtain sensitive information via the SameSite cookie attribute defaults value set to none...

CVE-2024-55211

An issue in Think Router Tk-Rt-Wr135G V3.0.2-X000 allows attackers to bypass authentication via a crafted cookie...

CVE-2024-55211

An issue in Think Router Tk-Rt-Wr135G V3.0.2-X000 allows attackers to bypass authentication via a crafted cookie...

USN-7442-1 ruby2.3, ruby2.5 vulnerabilities

It was discovered that the Ruby CGI gem incorrectly handled parsing certain cookies. A remote attacker could possibly use this issue to consume resources, leading to a denial of service. CVE-2025-27219 It was discovered that the Ruby CGI gem incorrectly handled parsing certain regular expressions...

CLSA-2025-1744874696 Fix CVE(s): CVE-2024-7592

SECURITY UPDATE: Quadratic complexity, resulting in excess CPU while parsing - debian/patches/CVE-2024-7592.patch: fix quadratic complexity in parsing "-quoted cookie values with backslashes - CVE-2024-7592...

webkitgtk: A malicious website may exfiltrate data cross-origin

A flaw was found in WebKitGTK. A malicious website may exfiltrate data cross-origin due to a cookie management issue related to improper state management...

Security Bulletin: Multiple Vulnerabilities in IBM Event Streams

Summary Multiple vulnerabilities were addressed in IBM Event Streams version 11.6.1. Vulnerability Details CVEID:CVE-2024-47764 DESCRIPTION: jshttp cookie could allow a remote attacker to bypass security restrictions, caused by improper input validation by the cookie name, path, and domain. By...

PT-2025-16955

Name of the Vulnerable Software and Affected Versions DeimosC2 version 1.1.0-Beta Description The graph functionality of DeimosC2 is susceptible to Stored Cross-Site Scripting XSS. This allows for the potential theft of session cookies and unauthorized access to the C2 server. DeimosC2 is a...

PT-2025-17211 · Unknown · Think Router Tk-Rt-Wr135G

Name of the Vulnerable Software and Affected Versions: Think Router Tk-Rt-Wr135G version 3.0.2-X000 Description: The issue allows attackers to bypass authentication via a crafted cookie. Recommendations: For Think Router Tk-Rt-Wr135G version 3.0.2-X000, as a temporary workaround, consider...

CVE-2024-55211

An issue in Think Router Tk-Rt-Wr135G V3.0.2-X000 allows attackers to bypass authentication via a crafted cookie...