CVE-2023-45857-Demo

Demo to verify the behavior of axios vulnerability CVE-2023-45857 1. Start with dev container 2. Run npm run dev on the app container 3. Access http://app.localhost 4. Verify that XSRF-TOKEN is set in the Cookie using the browser's developer tools The value is CREDENTIALTOKEN HttpOnly is false...

GHSA-JXJ7-G6GM-49J7 tarteaucitron: data-cookie attribute can be used to delete arbitrary cookies

Summary tarteaucitron provides a list of cookies and buttons to delete them. If an attacker can write HTML with data attributes, they could create an element that silently deletes a cookie when clicked and trick a user to delete this cookie. Details tarteaucitron.cookie.purge is called on any...

CVE-2024-49764 LibreNMS has a Stored XSS ('Cross-site Scripting') in librenms/includes/html/pages/device/capture.inc.php

LibreNMS is an open-source, PHP/MySQL/SNMP-based network monitoring system. A Stored Cross-Site Scripting XSS vulnerability in the "Capture Debug Information" page allows authenticated users to inject arbitrary JavaScript through the "hostname" parameter when creating a new device. This...

Apple OSX/iOS/Windows Safari Non-HTTPOnly Cookie Theft

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Apple OSX/iOS/Windows Safari Non-HTTPOnly Cookie Theft', 'Description' = %q A vulnerability exists in versions of OSX, iOS, and Windows Safari...

Apple OSX/iOS/Windows Safari Non-HTTPOnly Cookie Theft

A vulnerability exists in versions of OSX, iOS, and Windows Safari released before April 8, 2015 that allows the non-HTTPOnly cookies of any domain to be stolen. Module Options msf use auxiliary/gather/apple/safariftpurlcookietheft msf undefinedsafariftpurlcookietheft show actions ...actions... m...

SimpleRisk 20130915-01 - Multiple Vulnerabilities

No description provided by source. 1. Advisory Information Title: SimpleRisk v.20130915-01 CSRF-XSS Account Compromise Advisory ID: RS-2013-0001 Date Published: 2013-09-30 2. Vulnerability Information Type: Cross-Site Request Forgery CSRF CWE-352, OWASP-A8, Cross-Site Scripting XSS CWE-79, OWASP-...