ALSA-2024:10952 Moderate: php:7.4 security update

PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Server. Security Fixes: php: 1-byte array overrun in common path resolve code CVE-2023-0568 php: Passwordverify always return true with some hash CVE-2023-0567 php: Missing error check and insufficient random bytes in...

Moderate: php:8.2 security update

PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Server. Security Fixes: php: host/secure cookie bypass due to partial CVE-2022-31629 fix CVE-2024-2756 php: passwordverify can erroneously return true, opening ATO risk CVE-2024-3096 php: Filter bypass in filtervar...

Moderate: php:8.1 security update

PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Server. Security Fixes: php: host/secure cookie bypass due to partial CVE-2022-31629 fix CVE-2024-2756 php: passwordverify can erroneously return true, opening ATO risk CVE-2024-3096 php: Filter bypass in filtervar...

RHEL 8 : php:8.2 (RHSA-2024:10951)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2024:10951 advisory. PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Server. Security Fixes: php: host/secure cookie bypass due to...

ALSA-2024:10949 Moderate: php:8.2 security update

PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Server. Security Fixes: php: host/secure cookie bypass due to partial CVE-2022-31629 fix CVE-2024-2756 php: passwordverify can erroneously return true, opening ATO risk CVE-2024-3096 php: Filter bypass in filtervar...

Moderate: php:7.4 security update

PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Server. Security Fixes: php: 1-byte array overrun in common path resolve code CVE-2023-0568 php: Passwordverify always return true with some hash CVE-2023-0567 php: Missing error check and insufficient random bytes in...

ALSA-2024:10950 Moderate: php:8.1 security update

PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Server. Security Fixes: php: host/secure cookie bypass due to partial CVE-2022-31629 fix CVE-2024-2756 php: passwordverify can erroneously return true, opening ATO risk CVE-2024-3096 php: Filter bypass in filtervar...

Moderate: php:8.2 security update

PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Server. Security Fixes: php: host/secure cookie bypass due to partial CVE-2022-31629 fix CVE-2024-2756 php: passwordverify can erroneously return true, opening ATO risk CVE-2024-3096 php: Filter bypass in filtervar...

Quarkus 环境问题漏洞

Quarkus is a cloud-native Linux container-first framework for writing Java applications. An environmental issue vulnerability exists in Quarkus that stems from the inclusion of an HTTP cookie smuggling issue...

@eas-framework/server (>=1.0.1, <=1.5.8), express-nova-login (1.0.0) +2 more potentially affected by CVE-2024-53441 via cookie-encrypter (1.0.1)

cookie-encrypter NPM version 1.0.1 is affected by a known vulnerability. The following packages have a transitive dependency on cookie-encrypter and may be impacted: - @eas-framework/server =1.0.1, =1.0.0, =1.6.3, =1.6.4 Source cves: CVE-2024-53441 Source advisory: OSV:GHSA-H63V-HW6G-X8HP...

GHSA-H63V-HW6G-X8HP Bit flip attack vulnerability in cookie-encrypter

due to a weakness in the encryption method used in cookie-encrypter an attack can use the world visible IV to edit encrypted cookies without decrypting the cookie itself. This is known as an AES CBC bit flipping attack...

CVE-2024-53441

An issue in the index.js decryptCookie function of cookie-encrypter v1.0.1 allows attackers to execute a bit flipping attack...

cookie-encrypter 安全漏洞

cookie-encrypter is a cookie encryption and decryption library by the individual developer Emmanuel Bourmalo. A security vulnerability exists in cookie-encrypter version v1.0.1, which stems from an issue with the index.js decryptCookie function that allows an attacker to perform a bit flipping...

CVE-2024-53441

An issue in the index.js decryptCookie function of cookie-encrypter v1.0.1 allows attackers to execute a bit flipping attack...

CVE-2024-53441

An issue in the index.js decryptCookie function of cookie-encrypter v1.0.1 allows attackers to execute a bit flipping attack...

PT-2024-35742 · Unknown · Cookie-Encrypter

Name of the Vulnerable Software and Affected Versions: cookie-encrypter version 1.0.1 Description: The issue is related to a weakness in the encryption method used, allowing attackers to execute a bit flipping attack, specifically an AES CBC bit flipping attack, by exploiting the decryptCookie...

CVE-2024-53441

CVE-2024-53441 affects the cookie-encrypter library, specifically version 1.0.1, where a flaw in the index.js decryptCookie function enables a bit-flipping attack (AES-CBC) using the world-visible IV. This can allow an attacker to modify encrypted cookies without decrypting them, with a CVSSv3.1 ...

OESA-2024-2509 python-tornado security update

Tornado is a Python web framework and asynchronous networking library, originally developed at FriendFeed. By using non-blocking network I/O, Tornado can scale to tens of thousands of open connections, making it ideal for long polling, WebSockets, and other applications that require a long-lived...

PT-2024-37031

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 6.6.74 Description The issue is related to the TSO DMA API usage in the Linux kernel, specifically in the stmmac driver. The problem arises when the assignment of tx skbuff dma members is moved later in stmmac ts...

The vulnerability of the SSO authentication mechanism of the universal monitoring system Zabbix allows attackers to circumvent existing security restrictions and enhance their privileges.

The vulnerability of the Single Sign-On SSO authentication mechanism of the universal monitoring system Zabbix relates to the ability to bypass authentication through spoofing. Exploiting this vulnerability allows a malicious actor to circumvent existing security restrictions and enhance their...