12 matches found
CVE-2026-11538 IBM WebSphere Application Server prior to 9.0.5.29 and 8.5.5.31 are affected by multiple vulnerabilities
IBM WebSphere Application Server 9.0 and 8.5 is affected by a log injection vulnerability through crafted LTPA token cookies...
CVE-2026-11538 IBM WebSphere Application Server prior to 9.0.5.29 and 8.5.5.31 are affected by multiple vulnerabilities
IBM WebSphere Application Server 9.0 and 8.5 is affected by a log injection vulnerability through crafted LTPA token cookies...
EUVD-2026-83276
IBM WebSphere Application Server 9.0 and 8.5 is affected by a log injection vulnerability through crafted LTPA token cookies...
CVE-2026-11538
IBM WebSphere Application Server versions prior to 9.0.5.29 and 8.5.5.31 are affected by a log injection vulnerability. The root cause is the improper output neutralization of crafted LTPA token cookies , which can be exploited to inject malicious entries into logs. This issue also impacts Jazz f...
PT-2026-95600
Name of the Vulnerable Software and Affected Versions IBM WebSphere Application Server 9.0 IBM WebSphere Application Server 8.5 Description Log injection is possible through the use of crafted LTPA Lightweight Third-Party Authentication token cookies. This allows an attacker to insert malicious...
CVE-2026-11538: Improper Output Neutralization for Logs
IBM WebSphere Application Server 9.0 and 8.5 is affected by a log injection vulnerability through crafted LTPA token cookies...
CVE-2026-76186
The apache-airflow-providers-keycloak package (specifically in Airflow 3.3 and later) is vulnerable to a logic flaw where the Keycloak auth manager fails to validate that the Keycloak access and refresh tokens (provided via separate, unauthenticated cookies) belong to the same subject as the sign...
CVE-2026-76186 Apache Airflow Keycloak provider: Keycloak token cookies not bound to Airflow session identity
Apache Airflow Keycloak provider: from Airflow 3.3 the Keycloak auth manager takes a user's identity from the signed Airflow session token but takes the Keycloak access and refresh tokens used for every authorization decision from separate, unauthenticated cookies, and never checks that the two...
CVE-2026-65655: Sensitive Cookie in HTTPS Session Without 'Secure' Attribute
When OAuth authentication is enabled and browser-facing TLS terminates at a reverse proxy that forwards the callback to Temporal UI Server over HTTP, affected versions derive authentication-cookie Secure attributes from the proxy-to-server connection. Temporal UI Server can therefore issue...
CVE-2026-46550 NocoDB: Refresh Token Cookie Set Without `Secure` and `SameSite` Flags
NocoDB is software for building databases as spreadsheets. Prior to 2026.04.1, the refresh-token cookie was set with httpOnly: true but missing both the secure flag and the sameSite attribute. Over plain HTTP the cookie could be intercepted on the network; without sameSite, browsers attached it t...
CVE-2021-3509
Affects Red Hat Ceph Storage 4 dashboard (ceph-dashboard). The root cause is storage of the JWT for user authentication in the browser (localStorage), which exposes tokens to XSS risks. This is described in connected advisories for Ceph-derived distributions (Astral/Linux security bulletins and M...