Security Bulletin: Due to the use of Spring WebFlux, IBM Sterling Control Center is vulnerable to multiple CVEs (CVE-2026-47883, CVE-2026-47885, CVE-2026-47889, CVE-2026-47891 )

Summary Spring WebFlux is used by IBM Sterling Control Center and as part of dependency one of them is in spring-web-6.2.12.jar. Vulnerability Details CVEID:CVE-2026-47883 DESCRIPTION: UrlHandlerFilter can be vulnerable to an open redirect when configured with very broadly matching patterns. The...

Improper Cookie Domain

Http4s is vulnerable to improper cookie domain. The vulnerability is due to unanchored substring checks instead of RFC 6265-compliant domain and path matching when attaching stored cookies, which allows an attacker to exploit an application’s attacker-influenced outbound request to obtain session...

SameSite Cookie Vulnerability

kimai/kimai is vulnerable to SameSite cookie vulnerability. The vulnerability is due to improper cookie handling and insufficient SameSite protection in session management, which allows an attacker to exploit crafted PHP scripts to capture session cookie information and perform potential session...

Cookie Poisoning

Quarkus-HTTP is vulnerable to Cookie Poisoning. The vulnerability is due to improper parsing of cookies with specific value-delimiting characters, allowing attackers to exfiltrate HttpOnly cookie values or spoof arbitrary additional cookie values...

Moxa EDS-G512E improper cookie management (CVE-2017-13702)

An issue was discovered on MOXA EDS-G512E 5.1 build 16072215 devices. Cookies can be stolen, manipulated, and reused. This plugin only works with Tenable.ot. Please visit https://www.tenable.com/products/tenable-ot for more information. %NASLMINLEVEL 80900 C Tenable, Inc. include'compat.inc'; if...

Cross site request forgery (csrf)

IBM WebSphere Automation for Cloud Pak for Watson AIOps 1.4.2 is vulnerable to cross-site request forgery, caused by improper cookie attribute setting. IBM X-Force ID: 226449...

Google Chrome cookies security bypass vulnerability

Google Chrome is a web browser from Google, an American company. A security vulnerability exists in versions prior to Google chrome 87.0.4280.66 that stems from an improper implementation in cookies. An attacker can exploit this vulnerability to bypass security restrictions...

Security Bulletin: Information disclosure in WebSphere Application Server Liberty bundled with IBM Operations Analytics - Log Analysis (CVE-2019-4305)

Summary Cookie created without secure flag in WAS Liberty Vulnerability Details CVEID: CVE-2019-4305 DESCRIPTION: IBM WebSphere Application Server Liberty could allow a remote attacker to obtain sensitive information caused by the improper setting of a cookie. IBM X-Force ID: 160951. CVSS Base...

Security Bulletin: WebSphere Application Server improper cookie setting vulnerability affects IBM Control Center (CVE-2019-4305)

Summary WebSphere Application Server in IBM Control Center could allow a remote attacker to obtain sensitive information caused by the improper setting of a cookie. Vulnerability Details CVEID: CVE-2019-4305 DESCRIPTION: IBM WebSphere Application Server Liberty could allow a remote attacker to...

Information disclosure

IBM WebSphere Application Server Liberty could allow a remote attacker to obtain sensitive information caused by the improper setting of a cookie. IBM X-Force ID: 160951...

PT-2019-17026 · Ibm · Ibm Websphere Application Server Liberty

Name of the Vulnerable Software and Affected Versions: IBM WebSphere Application Server Liberty affected versions not specified Description: The issue is caused by the improper setting of a cookie, which could allow a remote attacker to obtain sensitive information. Recommendations: At the moment...

PDF Signer 3.0 Template Injection / CSRF / Code Execution

Exploit Title: PDF Signer v3.0 - SSTI to RCE via CSRF Cookie Dork: N/A Date: 2019-01-28 Exploit Author: dd [email protected] Vendor Homepage: https://codecanyon.net/user/simcycreative Software Link:...

Ubuntu 14.04 LTS / 16.04 LTS : Django vulnerability (USN-3089-1)

The remote Ubuntu 14.04 LTS / 16.04 LTS host has packages installed that are affected by a vulnerability as referenced in the USN-3089-1 advisory. Sergey Bobrov discovered that Django incorrectly parsed cookies when being used with Google Analytics. A remote attacker could possibly use this issue...

PT-2013-2937

Name of the Vulnerable Software and Affected Versions Cisco Unified MeetingPlace Web Conferencing Server versions 7.x through 7.1MR1 Patch 1 Cisco Unified MeetingPlace Web Conferencing Server versions 8.0 through 8.0MR1 Patch 1 Cisco Unified MeetingPlace Web Conferencing Server versions 8.5 throu...

Fedora 18 : freeipa-3.1.0-1.fc18 (2012-20123)

Update to upstream 3.1.0. Addresses CVE-2012-5631, improper cookie handling. Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without...

PT-2012-3584

Name of the Vulnerable Software and Affected Versions AjaXplorer versions 3.2.x through 3.2.4 AjaXplorer versions 4.0.x through 4.0.3 Description The issue is related to improper cookie authentication, allowing remote attackers to gain login access by exploiting knowledge of a password hash...