204 matches found
CVE-2023-38946
An issue in Multilaser RE160 firmware v5.07.51ptMTL01 and v5.07.52ptMTL01 allows attackers to bypass the access control and gain complete access to the application via supplying a crafted cookie...
Multilaser RE160 Security Vulnerability
The Multilaser RE160 is a wireless router from Multilaser. A security vulnerability exists in the Multilaser RE160 v5.07.51ptMTL01 and v5.07.52ptMTL01 firmware versions, which originated from a vulnerability that allows an attacker to bypass access control and gain full access to an application b...
mod_auth_openidc:2.3 security and bug fix update
cjose 0.6.1-4 - CVE-2023-37464 cjose: AES GCM decryption uses the Tag length from the actual Authentication Tag provided in the JWE Resolves: rhbz2223308 modauthopenidc 2.4.9.4-5 Related: rhbz2141850 - fix cjose version dependency 2.4.9.4-4 Resolves: rhbz2141850 - authopenidc.conf mode 0640 by...
mod_auth_openidc: NULL pointer dereference when OIDCStripCookies is set and a crafted Cookie header is supplied
A flaw was found in modauthopenidc, an OpenID Certified™ authentication and authorization module for the Apache HTTP server. It is possible to trigger a NULL pointer dereference when OIDCStripCookies is set and a crafted Cookie header is supplied, leading to a segmentation fault and a denial of...
CVE-2023-45393
An indirect object reference IDOR in GRANDING UTime Master v9.0.7-Build:Apr 4,2023 allows authenticated attackers to access sensitive information via a crafted cookie...
CVE-2023-45393
An indirect object reference IDOR in GRANDING UTime Master v9.0.7-Build:Apr 4,2023 allows authenticated attackers to access sensitive information via a crafted cookie...
CVE-2023-45393
An indirect object reference IDOR in GRANDING UTime Master v9.0.7-Build:Apr 4,2023 allows authenticated attackers to access sensitive information via a crafted cookie...
PT-2023-29545 · Granding · Granding Utime Master
Name of the Vulnerable Software and Affected Versions: GRANDING UTime Master version 9.0.7-Build:Apr 4,2023 Description: The issue is related to an indirect object reference IDOR that allows authenticated attackers to access sensitive information. This is achieved via a crafted cookie...
GRANDING UTime Master Security Vulnerability
GRANDING UTime Master is a powerful web-based time and attendance management software from GRANDING. A security vulnerability exists in GRANDING UTime Master v9.0.7-Build: Apr 4,2023 that stems from a vulnerability that allows an authenticated attacker to access sensitive information via a crafte...
CVE-2023-45393
An indirect object reference IDOR in GRANDING UTime Master v9.0.7-Build:Apr 4,2023 allows authenticated attackers to access sensitive information via a crafted cookie...
PT-2023-9252 · Actiontec · Actiontec Wcb6200Q
Name of the Vulnerable Software and Affected Versions: Actiontec WCB6200Q affected versions not specified Description: This issue allows network-adjacent attackers to execute arbitrary code on affected installations of Actiontec WCB6200Q routers. The flaw exists within the HTTP server, where a...
SUSE CVE-2023-28625
modauthopenidc is an authentication and authorization module for the Apache 2.x HTTP server that implements the OpenID Connect Relying Party functionality. In versions 2.0.0 through 2.4.13.1, when OIDCStripCookies is set and a crafted cookie supplied, a NULL pointer dereference would occur,...
DEBIAN-CVE-2023-28625
modauthopenidc is an authentication and authorization module for the Apache 2.x HTTP server that implements the OpenID Connect Relying Party functionality. In versions 2.0.0 through 2.4.13.1, when OIDCStripCookies is set and a crafted cookie supplied, a NULL pointer dereference would occur,...
UBUNTU-CVE-2023-28625
modauthopenidc is an authentication and authorization module for the Apache 2.x HTTP server that implements the OpenID Connect Relying Party functionality. In versions 2.0.0 through 2.4.13.1, when OIDCStripCookies is set and a crafted cookie supplied, a NULL pointer dereference would occur,...
CVE-2023-27570
The eotags package before 1.4.19 for PrestaShop allows SQL injection via a crafted ga cookie...
K16838: XSS vulnerability in the BIG-IP and Enterprise Manager Configuration utilities CVE-2015-1470
Security Advisory Description Using the BIGIPAuthUsernameCookie value with/tmui/login.jsp can expose a cross-site scripting XSS security flaw. CVE-2015-1470 Impact Some login.jsp parameters may allow an attacker to bypass XSS protection mechanisms by using a crafted cookie. Security Advisory Stat...
SUSE CVE-2014-0098
The logcookie function in modlogconfig.c in the modlogconfig module in the Apache HTTP Server before 2.4.8 allows remote attackers to cause a denial of service segmentation fault and daemon crash via a crafted cookie that is not properly handled during truncation...
SUSE CVE-2021-31826
Shibboleth Service Provider 3.x before 3.2.2 is prone to a NULL pointer dereference flaw involving the session recovery feature. The flaw is exploitable for a daemon crash on systems not using this feature if a crafted cookie is supplied...
