CVE-2020-26732

CVE-2020-26732 SKYWORTH GN542VF ハードウェアバージョン 2.0 およびソフトウェアバージョン 2.0.0.16 は、HTTPS セッションにおいてセッションクッキーに Secure フラグを設定しません 説明 SKYWORTH GN542VF ハードウェアバージョン 2.0 およびソフトウェアバージョン 2.0.0.16 は、HTTPS セッションにおいてセッションクッキーに Secure フラグを設定しません。そのため、リモートの攻撃者が HTTP セッション内でその送信を傍受することにより、このクッキーを取得することが容易になります。 追加情報...

EUVD-2026-75174

Open WebUI: A user's session cookies are sent to tool servers configured for bearer authentication...

Open WebUI: A user's session cookies are sent to tool servers configured for bearer authentication

Summary When more than one external tool server is reachable in the same request, a tool call to a server configured for bearer authentication can arrive carrying the calling user's Open WebUI session cookies alongside that server's own key. The cookie jar is built per connection, but the callabl...

CVE-2023-34838

CVE-2023-34838 — eScan Management Console の保存型XSS 概要 Microworld Technologies eScan Management Console バージョン 14.0.1400.2281 には、保存型クロスサイトスクリプティング XSS 攻撃に対する脆弱性があります。ロール管理機能にアクセスできる認証済みの攻撃者は、新しいロールの 説明 Description フィールドに悪意のあるスクリプトを注入できます。ペイロードはアプリケーションデータベースに永続化され、その後影響を受けるページを表示したすべてのユーザー 特権を持つ管理者を...

CVE-2026-87015

Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.6.27 until 0.11.1, backend/openwebui/utils/tools.py captured a cookie jar from the enclosing connection loop instead of binding it to each external tool callable. When multiple tool servers were attached...

CVE-2026-87015 Open WebUI: A user's session cookies are sent to tool servers configured for bearer authentication

Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.6.27 until 0.11.1, backend/openwebui/utils/tools.py captured a cookie jar from the enclosing connection loop instead of binding it to each external tool callable. When multiple tool servers were attached...

CVE-2026-87015 Open WebUI: A user's session cookies are sent to tool servers configured for bearer authentication

Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.6.27 until 0.11.1, backend/openwebui/utils/tools.py captured a cookie jar from the enclosing connection loop instead of binding it to each external tool callable. When multiple tool servers were attached...

CVE-2026-87015 Open WebUI: A user's session cookies are sent to tool servers configured for bearer authentication

Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.6.27 until 0.11.1, backend/openwebui/utils/tools.py captured a cookie jar from the enclosing connection loop instead of binding it to each external tool callable. When multiple tool servers were attached...

CVE-2026-87930

MaxSite CMS through 109.6 passes the cisession cookie to unserialize without class restrictions, allowing unauthenticated attackers to inject PHP objects. Attackers can forge valid session cookies using the hardcoded encryption key to trigger magic methods and corrupt application state or achieve...

EUVD-2026-75112

MaxSite CMS through 109.6 passes the cisession cookie to unserialize without class restrictions, allowing unauthenticated attackers to inject PHP objects. Attackers can forge valid session cookies using the hardcoded encryption key to trigger magic methods and corrupt application state or achieve...

CVE-2026-86721

AVideo through commit c3edcc274c contains an authorization bypass vulnerability where a session cookie named 'key' with value 'value' overrides the $REQUEST'key' parameter in saveLive.php and related endpoints. Attackers can publish to any user's RTMP stream without authentication by using the...

EUVD-2026-72860

AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a cross-site request forgery vulnerability in plugin/YPTWallet/view/saveBalance.php that allows attackers to set arbitrary wallet balances by relying only on session cookies without token validation. Attackers can craft a...

CVE-2026-86721

AVideo through commit c3edcc274c is affected by an authorization bypass in saveLive.php and related endpoints. A session cookie named key with a known constant value value overrides the $_REQUEST['key'] parameter, allowing an unauthenticated attacker to publish to any user's RTMP stream and hijac...

EUVD-2026-72857

AVideo through commit c3edcc274c contains an authorization bypass vulnerability where a session cookie named 'key' with value 'value' overrides the $REQUEST'key' parameter in saveLive.php and related endpoints. Attackers can publish to any user's RTMP stream without authentication by using the...

GHSA-34FJ-MWM6-FJFG SiYuan: The session-cookie signing key (Conf.CookieKey) is returned to anonymous readers by /api/system/getConf

CVE: This vulnerability corresponds to CVE-2026-72794. Summary /api/system/getConf returns Conf.CookieKey, the key used to sign the server's session cookies in its response body. The endpoint is registered with CheckAuth only, so the field reaches the publish RoleReader token and the anonymous...

CVE-2026-75171

An issue in HubCore v.14.1.1 allows a remote attacker to escalate privileges via the HUBCOREID session cookie handling component...

CVE-2026-75171

An issue in HubCore v.14.1.1 allows a remote attacker to escalate privileges via the HUBCOREID session cookie handling component...

EUVD-2026-71442

An issue in HubCore v.14.1.1 allows a remote attacker to escalate privileges via the HUBCOREID session cookie handling component...

CVE-2026-75171

CVE-2026-75171 is a critical (CVSS 9.8) privilege escalation vulnerability in HubCore v.14.1.1 , exploitable by a remote, unauthenticated attacker via the HUBCOREID session cookie handling component. The CISA SSVC assessment rates exploitation as none observed, the vulnerability as automatable , ...

EUVD-2022-56032

In Trimble TM4WEB 21.4.0.4 due to security misconfiguration with session identifiers, it is possible to recover valid session cookies via reflected cross-site scripting affecting the external document viewer endpoint...