AZL-61665 CVE-2025-4035 affecting package libsoup 3.0.4-12

A flaw was found in libsoup. When handling cookies, libsoup clients mistakenly allow cookies to be set for public suffix domains if the domain contains at least two components and includes an uppercase character. This bypasses public suffix protections and could allow a malicious website to set...

AZL-61670 CVE-2025-4035 affecting package libsoup 3.4.4-12

A flaw was found in libsoup. When handling cookies, libsoup clients mistakenly allow cookies to be set for public suffix domains if the domain contains at least two components and includes an uppercase character. This bypasses public suffix protections and could allow a malicious website to set...

UBUNTU-CVE-2025-4035

A flaw was found in libsoup. When handling cookies, libsoup clients mistakenly allow cookies to be set for public suffix domains if the domain contains at least two components and includes an uppercase character. This bypasses public suffix protections and could allow a malicious website to set...

CVE-2025-4035 Libsoup: cookie domain validation bypass via uppercase characters in libsoup

A flaw was found in libsoup. When handling cookies, libsoup clients mistakenly allow cookies to be set for public suffix domains if the domain contains at least two components and includes an uppercase character. This bypasses public suffix protections and could allow a malicious website to set...

CVE-2025-4035

Libsoup3 is affected by CVE-2025-4035: a cookie-domain validation bypass occurs when handling cookies where the domain contains at least two components and includes an uppercase character, allowing cookies to be set for public suffix domains a site does not own. The vulnerability is described acr...

CVE-2025-4035

A flaw was found in libsoup. When handling cookies, libsoup clients mistakenly allow cookies to be set for public suffix domains if the domain contains at least two components and includes an uppercase character. This bypasses public suffix protections and could allow a malicious website to set...

PT-2025-18149

Name of the Vulnerable Software and Affected Versions libsoup affected versions not specified Description A flaw was found in libsoup. When handling cookies, libsoup clients mistakenly allow cookies to be set for public suffix domains if the domain contains at least two components and includes an...

PT-2025-17827 · Devignstudiosltd · Devignstudiosltd Covid-19 (Coronavirus) Update Your Customers

Name of the Vulnerable Software and Affected Versions: devignstudiosltd COVID-19 Coronavirus Update Your Customers versions 1.5.1 and earlier Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting. This allows for Store...

CVE-2024-22351 IBM InfoSphere Information Server session fixation

IBM InfoSphere Information 11.7 Server does not invalidate session after logout which could allow an authenticated user to impersonate another user on the system...

CVE-2024-22351 IBM InfoSphere Information Server session fixation

IBM InfoSphere Information 11.7 Server does not invalidate session after logout which could allow an authenticated user to impersonate another user on the system...

CVE-2024-22351

CVE-2024-22351 affects IBM InfoSphere Information Server (11.7). The vulnerability arises because the server does not invalidate the session after logout, allowing an authenticated user to impersonate another user. IBM’s Security Bulletin confirms the issue and provides remediation guidance: upda...

CVE-2024-45651 IBM Sterling Connect:Direct Web Services session fixation

IBM Sterling Connect:Direct Web Services 6.1.0, 6.2.0, and 6.3.0 does not invalidate session after a browser closure which could allow an authenticated user to impersonate another user on the system...

CVE-2024-45651 IBM Sterling Connect:Direct Web Services session fixation

IBM Sterling Connect:Direct Web Services 6.1.0, 6.2.0, and 6.3.0 does not invalidate session after a browser closure which could allow an authenticated user to impersonate another user on the system...

CVE-2024-45651

IBM Sterling Connect:Direct Web Services versions 6.1.0, 6.2.0, and 6.3.0 expose a session-fixation issue: closing a browser does not invalidate the session, potentially allowing an authenticated user to impersonate another user. Remediation per IBM bulletin is to upgrade to fixed versions: 6.3.0...

CVE-2024-49825 IBM Robotic Process Automation session fixation

IBM Robotic Process Automation and Robotic Process Automation for Cloud Pak 21.0.0 through 21.0.7.20 and 23.0.0 through 23.0.20 does not invalidate session after a logout which could allow an authenticated user to impersonate another user on the system...

CVE-2024-49825

CVE-2024-49825 affects IBM Robotic Process Automation and IBM RPA for Cloud Pak, versions 21.0.0–21.0.7.20 and 23.0.0–23.0.20. Root cause: sessions are not invalidated after logout, enabling an authenticated user to impersonate another user. IBM’s bulletin cites CWE-613 and CVSS v3.1 base score 6...

CVE-2024-49825 IBM Robotic Process Automation session fixation

IBM Robotic Process Automation and Robotic Process Automation for Cloud Pak 21.0.0 through 21.0.7.20 and 23.0.0 through 23.0.20 does not invalidate session after a logout which could allow an authenticated user to impersonate another user on the system...

CVE-2025-0126

When configured using SAML, a session fixation vulnerability in the GlobalProtect™ login enables an attacker to impersonate a legitimate authorized user and perform actions as that GlobalProtect user. This requires the legitimate user to first click on a malicious link provided by the attacker. T...

CVE-2025-0126

When configured using SAML, a session fixation vulnerability in the GlobalProtect™ login enables an attacker to impersonate a legitimate authorized user and perform actions as that GlobalProtect user. This requires the legitimate user to first click on a malicious link provided by the attacker. T...

CVE-2025-0126

CVE-2025-0126 affects PAN-OS GlobalProtect SAML login where a session fixation flaw allows an attacker to impersonate a legitimate user after the user clicks a malicious link. The PAN-OS PAN-OS management interface SAML login is not affected; Cloud NGFW and Prisma Access instances are proactively...