PT-2024-21245 · Amss++ · Amss++

Name of the Vulnerable Software and Affected Versions: AMSS++ version 4.31 Description: The issue is related to insufficient encoding of user-controlled input, resulting in a Cross-Site Scripting XSS vulnerability. This vulnerability can be exploited through the...

PT-2024-21233 · Amss++ · Amss++

Name of the Vulnerable Software and Affected Versions: AMSS++ version 4.31 Description: The issue is related to insufficient encoding of user-controlled input, resulting in a Cross-Site Scripting XSS vulnerability. This vulnerability can be exploited through the /amssplus/admin/index.php endpoint...

IBM Sterling Secure Proxy 安全漏洞

IBM Sterling Secure Proxy is an application proxy from International Business Machines IBM that is used to ensure the secure transfer of files in an organization's unprotected zone DMZ. An information disclosure vulnerability exists in IBM Sterling Secure Proxy that stems from not setting a...

TOTOLINK A8000RU has an unspecified vulnerability

TOTOLINK A8000RU is a wireless router from China's Gion Electronics TOTOLINK. An unspecified vulnerability exists in the TOTOLINK A8000RU, which can be exploited by an attacker to log into the administrator account by providing a specially crafted session cookie...

CVE-2024-28338

A login bypass in TOTOLINK A8000RU V7.1cu.643B20200521 allows attackers to login to Administrator accounts via providing a crafted session cookie...

CVE-2024-28338

A login bypass in TOTOLINK A8000RU V7.1cu.643B20200521 allows attackers to login to Administrator accounts via providing a crafted session cookie...

Design/Logic Flaw

A login bypass in TOTOLINK A8000RU V7.1cu.643B20200521 allows attackers to login to Administrator accounts via providing a crafted session cookie...

CVE-2024-28338

The provided connected documents confirm a vulnerability in TOTOLINK A8000RU (firmware version V7.1cu.643_B20200521): a login bypass that allows an attacker to authenticate as an Administrator by supplying a crafted session cookie. The exact root cause and affected software internals are not deta...

CVE-2024-28338

A login bypass in TOTOLINK A8000RU V7.1cu.643B20200521 allows attackers to login to Administrator accounts via providing a crafted session cookie...

PT-2024-22396 · Totolink · Totolink A8000Ru

Name of the Vulnerable Software and Affected Versions: TOTOLINK A8000RU version V7.1cu.643 B20200521 Description: A login bypass issue allows attackers to login to Administrator accounts by providing a crafted session cookie. Recommendations: For TOTOLINK A8000RU version V7.1cu.643 B20200521,...

CVE-2024-28338

A login bypass in TOTOLINK A8000RU V7.1cu.643B20200521 allows attackers to login to Administrator accounts via providing a crafted session cookie...

TOTOLINK A8000RU 安全漏洞

TOTOLINK A8000RU is a wireless router from China's Gion Electronics TOTOLINK. An unspecified vulnerability exists in the TOTOLINK A8000RU, which can be exploited by an attacker to log into the administrator account by providing a specially crafted session cookie...

Use Of Cache Containing Sensitive Information

Shopware is vulnerable to Use of Cache Containing Sensitive Information. The vulnerability is due to caching 404 pages with Session Cookies set in the cached response which is used by the Session Handler. This can allow an attacker to access the page with 404 response and steal the session cookie...

CVE-2024-27917

Shopware is an open commerce platform based on Symfony Framework and Vue. The Symfony Session Handler pops the Session Cookie and assigns it to the Response. Since Shopware 6.5.8.0, the 404 pages are cached to improve the performance of 404 pages. So the cached Response which contains a Session...

GHSA-C2F9-4JMM-V45M Shopware's session is persistent in Cache for 404 pages

Impact The Symfony Session Handler, pop's the Session Cookie and assign it to the Response. Since Shopware 6.5.8.0 the 404 pages, are cached, to improve the performance of 404 pages. So the cached Response, contains a Session Cookie when the Browser accessing the 404 page, has no cookies yet. The...

BIT-TYPO3-2023-47127

TYPO3 is an open source PHP based web content management system released under the GNU GPL. In typo3 installations there are always at least two different sites. Eg. first.example.org and second.example.com. In affected versions a session cookie generated for the first site can be reused on the...

BIT-COUCHDB-2023-45725 Apache CouchDB, IBM Cloudant: Privilege Escalation Using _design Documents

Design document functions which receive a user http request object may expose authorization or session cookie headers of the user who accesses the document. These design document functions are: list show rewrite update An attacker can leak the session component using an HTML-like output,...

Session fixation

A CWE-613 “Insufficient Session Expiration” vulnerability in the web application, due to the session cookie “sessionid” lasting two weeks, facilitates session hijacking attacks against victims. This issue affects: AiLux imx6 bundle below version imx61.0.7-2...

CVE-2024-26144

A flaw was found in Active Storage that may lead to a sensitive session information leak. By default, Active Storage sends a Set-Cookie header along with the user’s session cookie when serving blobs and sets Cache-Control to public. Certain proxies may cache Set-Cookie, leading to an information...

Active Storage Security Vulnerability

Active Storage is a plugin for uploading files to multiple cloud storage services and attaching files to Active Record objects. A security vulnerability exists in Rails Active Storage that stems from Active Storage sending a Set-Cookie header along with the user's session cookie when serving a bl...