CVE-2023-21495

Improper access control vulnerability in Knox Enrollment Service prior to SMR May-2023 Release 1 allow attacker install KSP app when device admin is set...

Samsung Mobile Devices Resource Management Error Vulnerability

SAMSUNG Mobile devices are a range of Samsung mobile devices, including cell phones, tablets, etc. from Samsung South Korea. A security vulnerability exists in SAMSUNG Mobile devices SMR May-2023 Release 1 prior to version 1, which stems from setPinPadImages in the mPOS TUI trustlet that allows a...

python-future: remote attackers can cause denial of service via crafted Set-Cookie header from malicious web server

A denial of service flaw was found in Python Charmers Future. This flaw allows an attacker to send a specially crafted Set-Cookie header in an HTTP request, resulting in a loss of system availability...

Amazon Fire TV Stick cross-site scripting vulnerability

The Amazon Fire TV Stick is a TV voice recognition remote control from Amazon.com, Inc. A security vulnerability exists in the Amazon Fire TV Stick that stems from the setMediaSource function on the amzn.thin.pl service not being cleaned up...

AZL-43798 CVE-2023-30861 affecting package python-flask 1.1.1-4

Flask is a lightweight WSGI web application framework. When all of the following conditions are met, a response containing data intended for one client may be cached and subsequently sent by the proxy to other clients. If the proxy also caches Set-Cookie headers, it may send one client's session...

CVE-2023-29680

Cleartext Transmission in set-cookie:ecospw: Tenda N301 v6.0, Firmware v12.02.01.61multi allows an authenticated attacker on the LAN or WLAN to intercept communications with the router and obtain the password...

PT-2023-22357 · Tenda · Tenda N301

Name of the Vulnerable Software and Affected Versions: Tenda N301 version 6.0, Firmware version 12.02.01.61 multi Description: The issue allows an authenticated attacker on the LAN or WLAN to intercept communications with the router and obtain the password due to cleartext transmission in...

CVE-2023-29680: Cleartext Transmission of Sensitive Information

Cleartext Transmission in set-cookie:ecospw: Tenda N301 v6.0, Firmware v12.02.01.61multi allows an authenticated attacker on the LAN or WLAN to intercept communications with the router and obtain the password...

Flask vulnerable to possible disclosure of permanent session cookie due to missing Vary: Cookie header

When all of the following conditions are met, a response containing data intended for one client may be cached and subsequently sent by a proxy to other clients. If the proxy also caches Set-Cookie headers, it may send one client's session cookie to other clients. The severity depends on the...

CVE-2023-29680

CVE-2023-29680 affects Tenda N301 devices with v6.0 firmware (example: v12.02.01.61_multi). The issue is cleartext transmission via the set-cookie:ecos_pw cookie, allowing an authenticated attacker on the LAN/WLAN to intercept router communications and obtain the password. Red Hat and NVD entries...

OESA-2023-1263 screen security update

Screen is a full-screen window manager that multiplexes a physical terminal between several processes,typically interactive shells. Security Fixes: socket.c in GNU Screen through 4.9.0, when installed setuid or setgid the default on platforms such as Arch Linux and FreeBSD, allows local users to...

ROS-20230428-01

A vulnerability in the Python Charmers Future program is related to improper input validation when processing the the Set-Cookie header. Exploitation of the vulnerability could allow an attacker acting remotely to to send a specially crafted HTTP request to the application and perform a denial of...

CVE-2023-29779

Sengled Dimmer Switch V0.0.9 contains a denial of service DOS vulnerability, which allows a remote attacker to send malicious Zigbee messages to a vulnerable device and cause crashes. After receiving the malicious command, the device will keep reporting its status and finally drain its battery...

Cross site request forgery (csrf)

A cross-site request forgery CSRF vulnerability in ChurchCRM v4.5.3 allows attackers to set a person to a user and set that user to be an Administrator...

CVE-2023-26060

An issue was discovered in Nokia NetAct before 22 FP2211. On the Working Set Manager page, users can create a Working Set with a name that has a client-side template injection payload. Input validation is missing during creation of the working set. For an external attacker, it is very difficult t...

CVE-2023-26060

An issue was discovered in Nokia NetAct before 22 FP2211. On the Working Set Manager page, users can create a Working Set with a name that has a client-side template injection payload. Input validation is missing during creation of the working set. For an external attacker, it is very difficult t...

Input validation

An issue was discovered in Nokia NetAct before 22 FP2211. On the Working Set Manager page, users can create a Working Set with a name that has a client-side template injection payload. Input validation is missing during creation of the working set. For an external attacker, it is very difficult t...

DEBIAN-CVE-2023-31083

An issue was discovered in drivers/bluetooth/hcildisc.c in the Linux kernel 6.2. In hciuartttyioctl, there is a race condition between HCIUARTSETPROTO and HCIUARTGETPROTO. HCIUARTPROTOSET is set before hu-proto is set. A NULL pointer dereference may occur...

UBUNTU-CVE-2023-31083

An issue was discovered in drivers/bluetooth/hcildisc.c in the Linux kernel 6.2. In hciuartttyioctl, there is a race condition between HCIUARTSETPROTO and HCIUARTGETPROTO. HCIUARTPROTOSET is set before hu-proto is set. A NULL pointer dereference may occur...

Nokia NetAct code injection vulnerability

Nokia NetAct is a network management system from Nokia of Finland. A security vulnerability exists in Nokia NetAct versions prior to 22 FP2211, which stems from a lack of input validation during the creation of a working set...