PT-2020-6394

Name of the Vulnerable Software and Affected Versions libvirt versions prior to 6.3.0 Description The issue is related to the preservation of HTTP cookie data in the XML dump of a guest domain, potentially allowing a remote attacker to access sensitive information within the domain configuration...

Debian DLA-2132-1 : libzypp security update

It was discovered that there was an issue where incorrect default permissions on a HTTP cookie store could have allowed local attackers to read private credentials. For Debian 8 'Jessie', this issue has been fixed in libzypp version 14.29.1-2+deb8u1. We recommend that you upgrade your libzypp...

[SECURITY] [DLA 2132-1] libzypp security update

Package : libzypp Version : 14.29.1-2+deb8u1 CVE ID : CVE-2019-18900 It was discovered that there was an issue where incorrect default permissions on a HTTP cookie store could have allowed local attackers to read private credentials. For Debian 8 "Jessie", this issue has been fixed in libzypp...

CVE-2014-9126

Multiple cross-site scripting XSS vulnerabilities in Open-School Community Edition 2.2 allow remote attackers to inject arbitrary web script or HTML via the YIICSRFTOKEN HTTP cookie or the StudentDocument, StudentCategories, StudentPreviousDatas parameters to index.php...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in Open-School Community Edition 2.2 allow remote attackers to inject arbitrary web script or HTML via the YIICSRFTOKEN HTTP cookie or the StudentDocument, StudentCategories, StudentPreviousDatas parameters to index.php...

CVE-2014-9126

Multiple cross-site scripting XSS vulnerabilities in Open-School Community Edition 2.2 allow remote attackers to inject arbitrary web script or HTML via the YIICSRFTOKEN HTTP cookie or the StudentDocument, StudentCategories, StudentPreviousDatas parameters to index.php...

CVE-2019-11668

HTTP cookie in Micro Focus Service manager, Versions 9.30, 9.31, 9.32, 9.33, 9.34, 9.35, 9.40, 9.41, 9.50, 9.51, 9.52, 9.60, 9.61, 9.62. And Micro Focus Service Manager Chat Server, versions 9.41, 9.50, 9.51, 9.52, 9.60, 9.61, 9.62. And Micro Focus Service Manager Chat Service 9.41, 9.50, 9.51,...

Design/Logic Flaw

HTTP cookie in Micro Focus Service manager, Versions 9.30, 9.31, 9.32, 9.33, 9.34, 9.35, 9.40, 9.41, 9.50, 9.51, 9.52, 9.60, 9.61, 9.62. And Micro Focus Service Manager Chat Server, versions 9.41, 9.50, 9.51, 9.52, 9.60, 9.61, 9.62. And Micro Focus Service Manager Chat Service 9.41, 9.50, 9.51,...

CVE-2019-11668

HTTP cookie in Micro Focus Service manager, Versions 9.30, 9.31, 9.32, 9.33, 9.34, 9.35, 9.40, 9.41, 9.50, 9.51, 9.52, 9.60, 9.61, 9.62. And Micro Focus Service Manager Chat Server, versions 9.41, 9.50, 9.51, 9.52, 9.60, 9.61, 9.62. And Micro Focus Service Manager Chat Service 9.41, 9.50, 9.51,...

CVE-2019-11668

CVE-2019-11668 involves an HTTP cookie issue in Micro Focus Service Manager and related Chat Server/Chat Service components. Affected versions are Service Manager 9.30–9.62, Chat Server 9.41, 9.50–9.52, 9.60–9.62, and Chat Service 9.41, 9.50–9.52, 9.60–9.62. The Red Hat entry and related records ...

CVE-2019-11668: Undefined Security Weakness

HTTP cookie in Micro Focus Service manager, Versions 9.30, 9.31, 9.32, 9.33, 9.34, 9.35, 9.40, 9.41, 9.50, 9.51, 9.52, 9.60, 9.61, 9.62. And Micro Focus Service Manager Chat Server, versions 9.41, 9.50, 9.51, 9.52, 9.60, 9.61, 9.62. And Micro Focus Service Manager Chat Service 9.41, 9.50, 9.51,...

PT-2019-12470

Name of the Vulnerable Software and Affected Versions Micro Focus Service Manager versions 9.30 through 9.62 Micro Focus Service Manager Chat Server versions 9.41 through 9.62 Micro Focus Service Manager Chat Service versions 9.41 through 9.62 Description The issue concerns an HTTP cookie in Micr...

CVE-2019-14300

Several Ricoh printers have multiple buffer overflows parsing HTTP cookie headers, which allow an attacker to cause a denial of service or code execution via crafted requests to the web server. Affected firmware versions depend on the printer models. One affected configuration is...

Buffer overflow

Several Ricoh printers have multiple buffer overflows parsing HTTP cookie headers, which allow an attacker to cause a denial of service or code execution via crafted requests to the web server. Affected firmware versions depend on the printer models. One affected configuration is...

CVE-2019-14300: Improper Restriction of Operations within the Bounds of a Memory Buffer

Several Ricoh printers have multiple buffer overflows parsing HTTP cookie headers, which allow an attacker to cause a denial of service or code execution via crafted requests to the web server. Affected firmware versions depend on the printer models. One affected configuration is...

PT-2019-13596

Name of the Vulnerable Software and Affected Versions Ricoh SP C250DN firmware versions up to 1.06 Ricoh SP C250SF firmware versions up to 1.12 Description The issue affects several Ricoh printer models, where multiple buffer overflows occur when parsing HTTP cookie headers. This allows an attack...

FaceSentry Access Control System 6.4.8 Authentication Credential Disclosure

FaceSentry Access Control System 6.4.8 Authentication Credentials MiTM Disclosure Vendor: iWT Ltd. Product web page: http://www.iwt.com.hk Affected version: Firmware 6.4.8 build 264 Algorithm A16 Firmware 5.7.2 build 568 Algorithm A14 Firmware 5.7.0 build 539 Algorithm A14 Summary: FaceSentry 5AN...

PT-2018-9517

Name of the Vulnerable Software and Affected Versions Dojo Dojo Objective Harness DOH versions prior to 1.14 Description The issue is a Cross Site Scripting XSS vulnerability in unit.html, testsDOH/ base/loader/i18n-exhaustive/i18n-test/unit.html, and testsDOH/ base/i18nExhaustive.js. This can...

Sql injection

The vulnerability exists within processing of applets which are exposed on the web service in Schneider Electric U.motion Builder software versions prior to v1.3.4. The underlying SQLite database query to determine whether a user is logged in is subject to SQL injection on the loginSeed parameter...

CVE-2018-7772

The CVE-2018-7772 issue affects Schneider Electric U.motion Builder (pre-1.3.4) and is caused by SQL injection in the loginSeed handling within applets exposed via the web service. The underlying SQLite query used to verify a user is logged in is vulnerable and can be embedded in the HTTP cookie,...