CVE-2021-29247

BTCPay Server through 1.0.7.0 could allow a remote attacker to obtain sensitive information, caused by failure to set the HTTPOnly flag for a cookie...

BTCPay Server 信息泄露漏洞

BTCPay Server is a self-hosted open source cryptocurrency payment processor. It is secure, private, uncensored and free. A cross-site scripting vulnerability exists in BTCPay Server 1.0.7.0 and earlier versions. The vulnerability stems from a failure to set the HTTPOnly flag for cookies. An...

How to Force Secure and HttpOnly Cookie Options for Websites Using NetScaler Appliance

The web administrators may forceSecure and/orHttpOnly flags on the Session ID and the authentication cookies that are generated by the web applications. Modifying Set-Cookie headers to include these two options can be done using an http Load Balancing Virtual Server and Rewrite Policies on a...

Cross-Site Request Forgery (CSRF)

Overview Affected versions of the fastify-csrf package are vulnerable to Cross-site Request Forgery CSRF. The generated cookie used insecure defaults, and did not have the httpOnly flag on: cookieOpts: path: '/', sameSite: true . Also, the CSRF token was available in the GET query parameter...

Cross-site Request Forgery in fastify-csrf

The package fastify-csrf before 3.0.0 has a set of issues that affect its ability to do CSRF protection. 1. The generated cookie used insecure defaults, and did not have the httpOnly flag on: cookieOpts: path: '/', sameSite: true 2. The CSRF token was available in the GET query parameter...

CVE-2020-28482

This affects the package fastify-csrf before 3.0.0. 1. The generated cookie used insecure defaults, and did not have the httpOnly flag on: cookieOpts: path: '/', sameSite: true 2. The CSRF token was available in the GET query parameter...

Cross site request forgery (csrf)

This affects the package fastify-csrf before 3.0.0. 1. The generated cookie used insecure defaults, and did not have the httpOnly flag on: cookieOpts: path: '/', sameSite: true 2. The CSRF token was available in the GET query parameter...

CVE-2020-28482 Cross-site Request Forgery (CSRF)

This affects the package fastify-csrf before 3.0.0. 1. The generated cookie used insecure defaults, and did not have the httpOnly flag on: cookieOpts: path: '/', sameSite: true 2. The CSRF token was available in the GET query parameter...

Fastify Fastify-csrf Cross-Site Request Forgery Vulnerability

Fastify Fastify-csrf is a Javascript-based plugin that provides CSRF protection for Fastify in the Fastify community. A security vulnerability exists in fastify-csrf before 3.0.0 due to an insecure default value being used in the generated cookie, no httpOnly, and CSRF tokens being available in t...

CVE-2021-21494

MK-AUTH through 19.01 K4.9 allows XSS via the admin/logsajax.php tipo parameter. An attacker can leverage this to read the centralmka2 session token cookie, which is not set to HTTPOnly...

Design/Logic Flaw

MK-AUTH through 19.01 K4.9 allows XSS via the admin/logsajax.php tipo parameter. An attacker can leverage this to read the centralmka2 session token cookie, which is not set to HTTPOnly...

CVE-2021-21494

CVE-2021-21494 affects MK-AUTH up to version 19.01 K4.9. It enables a cross-site scripting (XSS) flaw via the admin/logs_ajax.php tipo parameter, allowing an attacker to read the centralmka2 session token cookie, which is not marked HttpOnly. The provided documents consistently describe the vulne...

CVE-2021-21494

MK-AUTH through 19.01 K4.9 allows XSS via the admin/logsajax.php tipo parameter. An attacker can leverage this to read the centralmka2 session token cookie, which is not set to HTTPOnly...

phpMyAdmin 4.0.x < 4.0.10.18 / 4.4.x < 4.4.15.9 / 4.6.x < 4.6.5 Multiple Vulnerabilities

According to its self-reported version, the phpMyAdmin application hosted on the remote web server is 4.0.x prior to 4.0.10.18, 4.4.x prior to 4.4.15.9, or 4.6.x prior to 4.6.5. It is, therefore, affected by multiple vulnerabilities. - An issue was discovered in phpMyAdmin. When the user does not...

The vulnerability of the Synology Router Manager operating system arises from the absence of the “HttpOnly” flag in session cookie files. This allows attackers to gain unauthorized access to protected information.

The vulnerability of the Synology Router Manager operating system is related to the absence of the “HttpOnly” flag in session cookie files. Exploiting this vulnerability can allow an unauthorized attacker to gain unauthorized access to protected information...

IBM Cloud Pak for Security Information Disclosure Vulnerability (CNVD-2020-68252)

IBM Cloud Pak for Security is an integrated security tool that uses a unified interface to provide deep insight into threats in hybrid multi-cloud environments. An information disclosure vulnerability exists in IBM Cloud Pak for Security 1.3.0.1. The vulnerability stems from the HTTPOnly flag not...

CVE-2020-4625

IBM Cloud Pak for Security 1.3.0.1CP4S could allow a remote attacker to obtain sensitive information, caused by the failure to set the HTTPOnly flag. A remote attacker could exploit this vulnerability to obtain sensitive information from the cookie...

CVE-2020-4625

IBM Cloud Pak for Security 1.3.0.1CP4S could allow a remote attacker to obtain sensitive information, caused by the failure to set the HTTPOnly flag. A remote attacker could exploit this vulnerability to obtain sensitive information from the cookie...

Information disclosure

IBM Cloud Pak for Security 1.3.0.1CP4S could allow a remote attacker to obtain sensitive information, caused by the failure to set the HTTPOnly flag. A remote attacker could exploit this vulnerability to obtain sensitive information from the cookie...

Security Bulletin: CP4S 1.3.0.1 fails to use HTTPOnly flag (CVE-2020-4625)

Summary IBM Cloud Pak for Security CP4S could allow a remote attacker to obtain sensitive information, caused by the failure to set the HTTPOnly flag. A remote attacker could exploit this vulnerability to obtain sensitive information from the cookie. Vulnerability Details CVEID: CVE-2020-4625...