CVE-2025-30166 Pimcore's Admin Classic Bundle allows HTML Injection

Pimcore's Admin Classic Bundle provides a Backend UI for Pimcore. An HTML injection issue allows users with access to the email sending functionality to inject arbitrary HTML code into emails sent via the admin interface, potentially leading to session cookie theft and the alteration of page...

CVE-2025-30166 Pimcore's Admin Classic Bundle allows HTML Injection

Pimcore's Admin Classic Bundle provides a Backend UI for Pimcore. An HTML injection issue allows users with access to the email sending functionality to inject arbitrary HTML code into emails sent via the admin interface, potentially leading to session cookie theft and the alteration of page...

CVE-2025-30166: Improper Neutralization of Input During Web Page Generation

Pimcore's Admin Classic Bundle provides a Backend UI for Pimcore. An HTML injection issue allows users with access to the email sending functionality to inject arbitrary HTML code into emails sent via the admin interface, potentially leading to session cookie theft and the alteration of page...

Eltex NTU-RG-5420G-Wac Router Buffer Overflow DoS

The vulnerability of the Eltex NTU-RG-5420G-Wac router’s microprogramming software lies in the fact that the operation exceeds the buffer boundaries in memory when processing the value of the "session" parameter in the cookie header. Exploiting this vulnerability allows a remote attacker to cause...

CVE-2025-2859

An attacker with network access, could capture traffic and obtain user cookies, allowing the attacker to steal the active user session and make changes to the device via web, depending on the privileges obtained by the user...

Arteche saTECH BCU Authorization Issue Vulnerability

The Arteche saTECH BCU is a flight room control unit from Arteche. An authorization issue vulnerability exists in the Arteche saTECH BCU version 2.1.3, which originates from an attacker being able to capture traffic and obtain a user cookie to steal active sessions and change the device based on...

CVE-2024-7053

A vulnerability in open-webui/open-webui version 0.3.8 allows an attacker with a user-level account to perform a session fixation attack. The session cookie for all users is set with the default SameSite=Lax and does not have the Secure flag enabled, allowing the session cookie to be sent over HT...

CVE-2024-7053

Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority...

CVE-2024-7053

Open WebUI (open-webui/open-webui) version 0.3.8 is affected by a session-fixation vulnerability. A user-level attacker can induce the administrator’s cookie to be sent over HTTP to a cross-origin domain due to SameSite=Lax and missing Secure flag, enabling cookie leakage via a malicious markdown...

PT-2025-12183

Name of the Vulnerable Software and Affected Versions open-webui/open-webui version 0.3.8 Description A vulnerability allows an attacker with a user-level account to perform a session fixation attack. The session cookie for all users is set with the default SameSite=Lax and does not have the Secu...

PT-2025-31937

Name of the Vulnerable Software and Affected Versions ICTBroadcast versions 7.4 and below Description The ICTBroadcast application improperly handles session cookie data, passing it to shell processing. This allows an attacker to inject shell commands into a session cookie, leading to...

CVE-2024-12020

There is a reflected cross-site scripting XSS within JSP files used to control application appearance. An unauthenticated attacker could deceive a user into clicking a crafted link to trigger the vulnerability. Stealing the session cookie is not possible due to cookie security flags, however the...

CVE-2024-12020 Reflected Cross-Site Scripting (XSS)

There is a reflected cross-site scripting XSS within JSP files used to control application appearance. An unauthenticated attacker could deceive a user into clicking a crafted link to trigger the vulnerability. Stealing the session cookie is not possible due to cookie security flags, however the...

CVE-2024-12020 Reflected Cross-Site Scripting (XSS)

There is a reflected cross-site scripting XSS within JSP files used to control application appearance. An unauthenticated attacker could deceive a user into clicking a crafted link to trigger the vulnerability. Stealing the session cookie is not possible due to cookie security flags, however the...

CVE-2025-22493

Secure flag not set and SameSIte was set to Lax in the Foreseer Reporting Software FRS. Absence of this secure flag could lead into the session cookie being transmitted over unencrypted HTTP connections. This security issue has been resolved in the latest version of FRS v1.5.100...

CVE-2025-22493

Secure flag not set and SameSIte was set to Lax in the Foreseer Reporting Software FRS. Absence of this secure flag could lead into the session cookie being transmitted over unencrypted HTTP connections. This security issue has been resolved in the latest version of FRS v1.5.100...

CVE-2025-22493 Improper cookie attributes in Foreseer Reporting Software (FRS)

Secure flag not set and SameSIte was set to Lax in the Foreseer Reporting Software FRS. Absence of this secure flag could lead into the session cookie being transmitted over unencrypted HTTP connections. This security issue has been resolved in the latest version of FRS v1.5.100...

PT-2025-9801

Name of the Vulnerable Software and Affected Versions Foreseer Reporting Software FRS versions prior to 1.5.100 Description The issue arises from the secure flag not being set and the SameSite attribute being set to Lax in the Foreseer Reporting Software. This could lead to the session cookie bei...

Linux Distros Unpatched Vulnerability : CVE-2023-30861

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Flask is a lightweight WSGI web application framework. When all of the following conditions are met, a response containing data intended for one client may be...

CVE-2025-22493: Cleartext Transmission of Sensitive Information

Secure flag not set and SameSIte was set to Lax in the Foreseer Reporting Software FRS. Absence of this secure flag could lead into the session cookie being transmitted over unencrypted HTTP connections. This security issue has been resolved in the latest version of FRS v1.5.100...