CVE-2023-42328

PeppermintLabs Peppermint v0.2.4 and earlier are affected by a vulnerability where a hardcoded session cookie allows a remote attacker to obtain sensitive information and execute arbitrary code. Root cause: hardcoded session cookie in Peppermint; impact is high (CVE-2023-42328, CVSS v3.1: AV:N/AC...

CVE-2023-41908

Cerebrate before 1.15 lacks the Secure attribute for the session cookie...

CVE-2023-41908

Cerebrate before 1.15 lacks the Secure attribute for the session cookie...

Design/Logic Flaw

Cerebrate before 1.15 lacks the Secure attribute for the session cookie...

CVE-2023-41908

Cerebrate before 1.15 lacks the Secure attribute for the session cookie...

CVE-2023-41908

Cerebrate before 1.15 lacks the Secure attribute for the session cookie...

CVE-2023-41908

Cerebrate (pre-1.15) has a vulnerability where the session cookie lacks the Secure attribute, enabling potential cookie interception over insecure channels. The issue affects Cerebrate versions prior to 1.15. The documented remediation is to upgrade to 1.15 or later, which ensures the session coo...

CVE-2023-41908

Cerebrate before 1.15 lacks the Secure attribute for the session cookie...

PT-2023-28161 · Cerebrate · Cerebrate

Name of the Vulnerable Software and Affected Versions: Cerebrate versions prior to 1.15 Description: The issue is related to the lack of the Secure attribute for the session cookie. This means that the session cookie is transmitted over an insecure channel, potentially allowing an attacker to...

Moxa ioLogik 4000 Series Session Cookie Without HttpOnly Flag (CVE-2023-4228)

A vulnerability has been identified in ioLogik 4000 Series ioLogik E4200 firmware versions v1.6 and prior, where the session cookies attribute is not set properly in the affected application. The vulnerability may lead to security risks, potentially exposing user session data to unauthorized acce...

CVE-2023-24516

Cross-site Scripting XSS vulnerability in the Pandora FMS Special Days component allows an attacker to use it to steal the session cookie value of admin users easily with little user interaction. This issue affects Pandora FMS v767 version and prior versions on all platforms...

Cross site scripting

Cross-site Scripting XSS vulnerability in the Pandora FMS Special Days component allows an attacker to use it to steal the session cookie value of admin users easily with little user interaction. This issue affects Pandora FMS v767 version and prior versions on all platforms...

CVE-2023-24516

CVE-2023-24516 is a Cross-site Scripting (XSS) vulnerability in the Pandora FMS Special Days component. The issue can allow an attacker to steal the admin session cookie, with little user interaction, and affects Pandora FMS v767 and earlier on all platforms. The nature of the flaw is stored XSS ...

CVE-2023-24516 Stored Cross Site Scripting - Special Days Module

Cross-site Scripting XSS vulnerability in the Pandora FMS Special Days component allows an attacker to use it to steal the session cookie value of admin users easily with little user interaction. This issue affects Pandora FMS v767 version and prior versions on all platforms...

CVE-2023-24516 Stored Cross Site Scripting - Special Days Module

Cross-site Scripting XSS vulnerability in the Pandora FMS Special Days component allows an attacker to use it to steal the session cookie value of admin users easily with little user interaction. This issue affects Pandora FMS v767 version and prior versions on all platforms...

PT-2023-19663 · Unknown · Pandora Fms

Name of the Vulnerable Software and Affected Versions: Pandora FMS versions prior to v767 Description: A Cross-site Scripting XSS issue in the Special Days component allows an attacker to steal the session cookie value of admin users with little user interaction. Recommendations: For versions pri...

Debian dla-3536 : python-flask - security update

The remote Debian 10 host has packages installed that are affected by a vulnerability as referenced in the dla-3536 advisory. ------------------------------------------------------------------------- Debian LTS Advisory DLA-3536-1 [email protected] https://www.debian.org/lts/security/...

CVE-2023-4329

Broadcom RAID Controller web interface is vulnerable due to insecure default of HTTP configuration that does not safeguard SESSIONID cookie with SameSite attribute...

Oracle Linux 8 : python-flask (ELSA-2023-12710)

The remote Oracle Linux 8 host has a package installed that is affected by a vulnerability as referenced in the ELSA-2023-12710 advisory. - Fix for CVE-2023-30861 Orabug: 35662469 Tenable has extracted the preceding description block directly from the Oracle Linux security advisory. Note that...

PHOENIX CONTACTs WP 6xxx series web panels Trust Management Issues Vulnerability

PHOENIX CONTACTs WP 6xxx series web panels is a series of web panels from PHOENIX CONTACTs, Germany. A trust management issue vulnerability exists in PHOENIX CONTACTs WP 6xxx series web panels prior to version 4.0.10, where a remote attacker with administrator privileges is able to read a...