10107 matches found
Session fixation
SKYWORTH GN542VF Boa version 0.94.13 does not set the Secure flag for the session cookie in an HTTPS session, which makes it easier for remote attackers to capture this cookie by intercepting its transmission within an HTTP session...
Cisco RV110W 1.2.1.7 - (vpn_account) Denial of Service Exploit
Exploit Title: Cisco RV110W 1.2.1.7 - 'vpnaccount' Denial of Service PoC Exploit Author: Shizhi He Vendor Homepage: https://www.cisco.com/ Software Link: https://software.cisco.com/download/home/283879340/type/282487380/release/1.2.1.7 Version: V1.2.1.7 Tested on: RV110W V1.2.1.7 CVE :...
CVE-2020-26732: Missing Encryption of Sensitive Data
SKYWORTH GN542VF Hardware Version 2.0 and Software Version 2.0.0.16 does not set the Secure flag for the session cookie in an HTTPS session, which makes it easier for remote attackers to capture this cookie by intercepting its transmission within an HTTP session...
CVE-2020-26732
SKYWORTH GN542VF Hardware Version 2.0 and Software Version 2.0.0.16 does not set the Secure flag for the session cookie in an HTTPS session, which makes it easier for remote attackers to capture this cookie by intercepting its transmission within an HTTP session...
CVE-2020-26732
The CVE affects SKYWORTH GN542VF devices: Hardware Version 2.0 and Software Version 2.0.0.16 have session cookies that do not set the Secure flag in HTTPS, enabling potential cookie capture over HTTP sessions. Related entries also mention Boa version 0.94.13. The impact is confidentiality loss if...
January 12, 2021âKB4598229 (OS Build 18363.1316) - EXPIRED
January 12, 2021âKB4598229 OS Build 18363.1316 - EXPIRED Applies To Windows 10, version 1909, all editions Windows Server version 1909 Note NEW 8/5/21 EXPIRATION NOTICE IMPORTANT As of 8/5/2021, this KB is no longer available from Windows Update, the Microsoft Update Catalog, or other release...
January 12, 2021âKB4598279 (Monthly Rollup)
January 12, 2021âKB4598279 Monthly Rollup Applies To Windows 7 Enterprise ESU Windows 7 Professional ESU Windows 7 Ultimate ESU Windows Server 2008 R2 Enterprise ESU Windows Server 2008 R2 Standard ESU Windows Server 2008 R2 Datacenter ESU Windows Embedded Standard 7 ESU Windows Embedded POSReady...
January 12, 2021âKB4598278 (Monthly Rollup)
January 12, 2021âKB4598278 Monthly Rollup Applies To Windows Server 2012 Windows Embedded 8 Standard Note IMPORTANT Adobe Flash Player went out of support on December 31, 2020. For more information, see Adobe Flash end of support on December 31, 2020. Flash content will be blocked from running in...
January 12, 2021âKB4598243 (OS Build 14393.4169) - EXPIRED
January 12, 2021âKB4598243 OS Build 14393.4169 - EXPIRED Applies To Windows 10, version 1607, all editions Windows Server 2016, all editions Note NEW 8/5/21 EXPIRATION NOTICE IMPORTANT As of 8/5/2021, this KB is no longer available from Windows Update, the Microsoft Update Catalog, or other relea...
CVE-2020-17502
Barco TransForm N before 3.8 allows Command Injection issue 2 of 4. The NDN-210 has a web administration panel which is made available over https. There is a command injection issue that will allow authenticated users of the administration panel to perform authenticated remote code execution. An...
CVE-2020-17503
The NDN-210 has a web administration panel which is made available over https. There is a command injection issue that will allow authenticated users to the administration panel to perform authenticated remote code execution. An issue exists in splitcardcmd.php in which the http parameter "lockin...
CVE-2020-17504
The NDN-210 has a web administration panel which is made available over https. There is a command injection issue that will allow authenticated users to the administration panel to perform authenticated remote code execution. An issue exists in ngpsystemcmd.php in which the http parameters...
CVE-2020-17503
The NDN-210 has a web administration panel which is made available over https. There is a command injection issue that will allow authenticated users to the administration panel to perform authenticated remote code execution. An issue exists in splitcardcmd.php in which the http parameter "lockin...
CVE-2020-17502
Barco TransForm N before 3.8 allows Command Injection issue 2 of 4. The NDN-210 has a web administration panel which is made available over https. There is a command injection issue that will allow authenticated users of the administration panel to perform authenticated remote code execution. An...
Updated busybox packages fix a security vulnerability
Busybox contains a Missing SSL certificate validation vulnerability in The "busybox wget" applet that can result in arbitrary code execution. This attack appear to be exploitable via Simply download any file over HTTPS using "busybox wget https://compromised-domain.com/important-file"...
CVE-2020-26976
When a HTTPS pages was embedded in a HTTP page, and there was a service worker registered for the former, the service worker could have intercepted the request for the secure page despite the iframe not being a secure context due to the insecure framing. This vulnerability affects Firefox 84...
CVE-2020-26976
When a HTTPS pages was embedded in a HTTP page, and there was a service worker registered for the former, the service worker could have intercepted the request for the secure page despite the iframe not being a secure context due to the insecure framing. This vulnerability affects Firefox 84...
DEBIAN-CVE-2020-26976
When a HTTPS pages was embedded in a HTTP page, and there was a service worker registered for the former, the service worker could have intercepted the request for the secure page despite the iframe not being a secure context due to the insecure framing. This vulnerability affects Firefox 84...
Design/Logic Flaw
When a HTTPS pages was embedded in a HTTP page, and there was a service worker registered for the former, the service worker could have intercepted the request for the secure page despite the iframe not being a secure context due to the insecure framing. This vulnerability affects Firefox 84...
CVE-2020-26976
When a HTTPS pages was embedded in a HTTP page, and there was a service worker registered for the former, the service worker could have intercepted the request for the secure page despite the iframe not being a secure context due to the insecure framing. This vulnerability affects Firefox 84...