IBM Security Directory Server Authorization Issues Vulnerability

IBM Security Directory Server is a suite of enterprise identity management software from IBM USA that uses the Lightweight Directory Access Protocol LDAP. The software provides a trusted identity data infrastructure for authentication. An authorization issue vulnerability exists in IBM Security...

Synology Router Manager Information Disclosure Vulnerability (CNVD-2020-60462)

Synology Router Manager SRM is a software for configuring and managing Synology routers from Synology Inc. of Taiwan, China. An information disclosure vulnerability exists in Synology Router Manager SRM versions prior to 1.2.4-8081, which stems from a failure to include the HTTPOnly flag in the...

Synology SRM web interface session cookie HttpOnly flag information disclosure vulnerability

Talos Vulnerability Report TALOS-2020-1086 Synology SRM web interface session cookie HttpOnly flag information disclosure vulnerability October 30, 2020 CVE Number CVE-2020-27658 SUMMARY An exploitable information disclosure vulnerability exists in the web interface session cookie functionality o...

CVE-2020-27658

Synology Router Manager SRM before 1.2.4-8081 does not include the HTTPOnly flag in a Set-Cookie header for the session cookie, which makes it easier for remote attackers to obtain potentially sensitive information via script access to this cookie...

CVE-2020-27658

Synology Router Manager SRM before 1.2.4-8081 does not include the HTTPOnly flag in a Set-Cookie header for the session cookie, which makes it easier for remote attackers to obtain potentially sensitive information via script access to this cookie...

CVE-2020-27651

Synology Router Manager SRM before 1.2.4-8081 does not set the Secure flag for the session cookie in an HTTPS session, which makes it easier for remote attackers to capture this cookie by intercepting its transmission within an HTTP session...

CVE-2020-27650

Synology DiskStation Manager DSM before 6.2.3-25426-2 does not set the Secure flag for the session cookie in an HTTPS session, which makes it easier for remote attackers to capture this cookie by intercepting its transmission within an HTTP session...

CVE-2020-27651

Synology Router Manager SRM before 1.2.4-8081 does not set the Secure flag for the session cookie in an HTTPS session, which makes it easier for remote attackers to capture this cookie by intercepting its transmission within an HTTP session...

Design/Logic Flaw

Synology Router Manager SRM before 1.2.4-8081 does not include the HTTPOnly flag in a Set-Cookie header for the session cookie, which makes it easier for remote attackers to obtain potentially sensitive information via script access to this cookie...

CVE-2020-27650

CVE-2020-27650 affects Synology DiskStation Manager (DSM) versions before 6.2.3-25426-2. The issue is that the session cookie used in HTTPS sessions is not marked with the Secure flag, which can allow an attacker to capture the cookie by intercepting its transmission in an HTTP session. Impact is...

CVE-2020-27650

Synology DiskStation Manager DSM before 6.2.3-25426-2 does not set the Secure flag for the session cookie in an HTTPS session, which makes it easier for remote attackers to capture this cookie by intercepting its transmission within an HTTP session...

CVE-2020-27658

Synology Router Manager SRM before 1.2.4-8081 does not include the HTTPOnly flag in a Set-Cookie header for the session cookie, which makes it easier for remote attackers to obtain potentially sensitive information via script access to this cookie...

CVE-2020-27651

CVE-2020-27651 affects Synology SRM (RT2600ac) prior to 1.2.4-8081. The issue is that the web interface session cookie is issued without the Secure flag in HTTPS, enabling an attacker to capture the cookie via MITM in an HTTP session. Talos documentation confirms the vulnerable SRM web interface ...

CVE-2020-27651

Synology Router Manager SRM before 1.2.4-8081 does not set the Secure flag for the session cookie in an HTTPS session, which makes it easier for remote attackers to capture this cookie by intercepting its transmission within an HTTP session...

Synology SRM web interface session cookie secure flag Information Disclosure Vulnerability

Talos Vulnerability Report TALOS-2020-1059 Synology SRM web interface session cookie secure flag Information Disclosure Vulnerability October 29, 2020 CVE Number CVE-2020-27651 SUMMARY An exploitable information disclosure vulnerability exists in the web interface session cookie functionality of...

Cross-site Session Transfer

modauthmellon before 0.13.1 is vulnerable to a Cross-Site Session Transfer attack, where a user with access to one web site running on a server can copy their session cookie to a different web site on the same server to get access to that site...

projectworlds car rental management system cross-site scripting vulnerability

projectworlds car rental management system is a car rental management system from projectworlds. projectworlds car rental management system is vulnerable to a cross-site scripting vulnerability, which could be exploited to obtain an administrative login session cookie and steal an administrative...

CVE-2020-27606

BigBlueButton before 2.2.28 or earlier does not set the secure flag for the session cookie in an https session, which makes it easier for remote attackers to capture this cookie by intercepting its transmission within an http session...

CVE-2020-27606

BigBlueButton before 2.2.28 or earlier does not set the secure flag for the session cookie in an https session, which makes it easier for remote attackers to capture this cookie by intercepting its transmission within an http session...

CVE-2020-27606

BigBlueButton is affected pre-2.2.28: the session cookie is not marked Secure in HTTPS, enabling cookie capture if an attacker can observe HTTP traffic. Affected product: BigBlueButton; vulnerable component: session cookie handling; root cause: absence of Secure flag on the cookie in HTTPS sessio...