Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
1,566 results · page 16 of 32
May 19, 2020Jenzabar JICS (aka Internet Campus Solution) before 9.0.1 Patch 3, 9.1 before 9.1.2 Patch 2, and 9.2 before 9.2.2 Patch 8 has session cookies that are a determiCVE-2020-8434 · Other software · Jenzabar · reported by MITRECritical 9.8
Jenzabar JICS (aka Internet Campus Solution) before 9.0.1 Patch 3, 9.1 before 9.1.2 Patch 2, and 9.2 before 9.2.2 Patch 8 has session cookies that are a deterministic function of the username. There is a hard-coded password to supply a PBKDF feeding into AES to encrypt a username and base64 encode it to a client-side cookie for persistent session authentication. By knowing the key and algorithm, an attacker can select any username, encrypt it, base64 encode it, and save it in their browser with the correct JICSLoginCookie cookie format to impersonate any real user in the JICS database without the need for authenticating (or verifying with MFA if implemented).
- Product
- Internet Campus Solution
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 14, 2020IBM Sterling File Gateway 2.2.0.0 through 6.0.3.1 could allow an authenticated user could manipulate cookie information and remove or add modules from the cookiCVE-2020-4259 · Other software · IBM · reported by psirt@us.ibm.comMedium 6.5
IBM Sterling File Gateway 2.2.0.0 through 6.0.3.1 could allow an authenticated user could manipulate cookie information and remove or add modules from the cookie to access functionality not authorized to. IBM X-Force ID: 175638.
- Product
- Sterling File Gateway
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexchange.xforce.ibmcloud.comibm.com
May 13, 2020The iubenda-cookie-law-solution plugin before 2.3.5 for WordPress does not restrict URL sanitization to http protocols.CVE-2020-12742 · WordPress plugins & themes · reported by MITREMedium 6.1
The iubenda-cookie-law-solution plugin before 2.3.5 for WordPress does not restrict URL sanitization to http protocols.
- Product
- iubenda-cookie-law-solution
- Fixed in
- 2.3.5
- What to do
- Update iubenda-cookie-law-solution to 2.3.5 or newer.
Full record and what to do →NVD recordgithub.comwordpress.org
Apr 29, 2020Subrion CMS 4.2.1 allows session fixation via an alphanumeric value in a session cookie.CVE-2020-12467 · Other software · Intelliants · reported by MITREMedium 6.5
Subrion CMS 4.2.1 allows session fixation via an alphanumeric value in a session cookie.
- Product
- Subrion
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 27, 2020In Rukovoditel 2.5.2, users' passwords and usernames are stored in a cookie with URL encoding, base64 encoding, and hashing.CVE-2020-11821 · Other software · Rukovoditel · reported by MITREMedium 5.3
In Rukovoditel 2.5.2, users' passwords and usernames are stored in a cookie with URL encoding, base64 encoding, and hashing. Thus, an attacker can easily apply brute force on them.
- Product
- Rukovoditel
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordfatihhcelik.blogspot.comfatihhcelik.blogspot.com
Apr 8, 2020An information exposure vulnerability in the logging component of Palo Alto Networks Global Protect Agent allows a local authenticated user to read VPN cookie iCVE-2020-1987 · Network & remote access · Palo Alto Networks · reported by psirt@paloaltonetworks.comLow 3.9
An information exposure vulnerability in the logging component of Palo Alto Networks Global Protect Agent allows a local authenticated user to read VPN cookie information when the troubleshooting logging level is set to "Dump". This issue affects Palo Alto Networks Global Protect Agent 5.0 versions prior to 5.0.9; 5.1 versions prior to 5.1.1.
- Product
- Global Protect Agent
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurity.paloaltonetworks.comsecurity.paloaltonetworks.com
Mar 24, 2020lib/NSSDropbox.php in ZendTo prior to 5.22-2 Beta failed to properly check for equality when validating the session cookie, allowing an attacker to gain adminisCVE-2020-8986 · Other software · Zend · reported by MITRECritical 9.8
lib/NSSDropbox.php in ZendTo prior to 5.22-2 Beta failed to properly check for equality when validating the session cookie, allowing an attacker to gain administrative access with a large number of requests.
- Product
- Zendto
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 13, 2020Some Brother printers (such as the HL-L8360CDW v1.20) were affected by a stack buffer overflow vulnerability as the web server did not parse the cookie value prCVE-2019-13193 · Other software · Brother · reported by MITREHigh 8.8
Some Brother printers (such as the HL-L8360CDW v1.20) were affected by a stack buffer overflow vulnerability as the web server did not parse the cookie value properly. This would allow an attacker to execute arbitrary code on the device.
- Product
- Ads-2400n Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordglobal.brothersupport.brother.com
Mar 13, 2020Some Xerox printers (such as the Phaser 3320 V53.006.16.000) were affected by a buffer overflow vulnerability in the Authentication Cookie of the web applicatioCVE-2019-13172 · Other software · Xerox · reported by MITRECritical 9.8
Some Xerox printers (such as the Phaser 3320 V53.006.16.000) were affected by a buffer overflow vulnerability in the Authentication Cookie of the web application that would allow an attacker to execute arbitrary code on the device.
- Product
- Phaser 3320 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurity.business.xerox.comnccgroup.trust
Mar 10, 2020SAP Enable Now, before version 1911, sends the Session ID cookie value in URL.CVE-2020-6178 · Network & remote access · SAP SE · reported by cna@sap.comMedium 5.4
SAP Enable Now, before version 1911, sends the Session ID cookie value in URL. This might be stolen from the browser history or log files, leading to Information Disclosure.
- Product
- SAP Enable Now
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlaunchpad.support.sap.comwiki.scn.sap.com
Feb 25, 2020IBL Online Weather before 4.3.5a allows attackers to obtain sensitive information by reading the IWEBSERVICE_JSONRPC_COOKIE cookie.CVE-2020-9407 · Other software · Iblsoft · reported by MITREMedium 5.3
IBL Online Weather before 4.3.5a allows attackers to obtain sensitive information by reading the IWEBSERVICE_JSONRPC_COOKIE cookie.
- Product
- Online Weather
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 21, 2020graph_realtime.php in Cacti 1.2.8 allows remote attackers to execute arbitrary OS commands via shell metacharacters in a cookie, if a guest user has the graph rCVE-2020-8813 · Other software · Cacti · reported by MITREHigh 8.8
graph_realtime.php in Cacti 1.2.8 allows remote attackers to execute arbitrary OS commands via shell metacharacters in a cookie, if a guest user has the graph real-time privilege.
- Product
- Cacti
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlists.opensuse.orglists.opensuse.org
Feb 21, 2020Information-disclosure vulnerability in Netsurf through 2.8 due to a world-readable cookie jar.CVE-2012-0844 · Other software · netsurf · reported by Red HatMedium 5.5
Information-disclosure vulnerability in Netsurf through 2.8 due to a world-readable cookie jar.
- Product
- netsurf
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordopenwall.comaccess.redhat.com
Feb 18, 2020IBM Tivoli Endpoint Manager 8 does not set the HttpOnly flag on cookies.CVE-2012-0718 · Other software · IBM · reported by psirt@us.ibm.comMedium 5.4
IBM Tivoli Endpoint Manager 8 does not set the HttpOnly flag on cookies.
- Product
- Tivoli Endpoint Manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexchange.xforce.ibmcloud.comexchange.xforce.ibmcloud.com
Feb 11, 2020YaBB through 2.5.2: 'guestlanguage' Cookie Parameter Local File Include VulnerabilityCVE-2013-2057 · Other software · YaBB · reported by Red HatCritical 9.8
YaBB through 2.5.2: 'guestlanguage' Cookie Parameter Local File Include Vulnerability
- Product
- YaBB
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordopenwall.comsecurityfocus.com
Feb 11, 2020TAIWAN SECOM CO., LTD., a Door Access Control and Personnel Attendance Management system, stores users’ information by cleartext in the cookie, which divulges pCVE-2020-3935 · Other software · TAIWAN SECOM CO., LTD. · reported by twcert@cert.org.twHigh 7.5
TAIWAN SECOM CO., LTD., a Door Access Control and Personnel Attendance Management system, stores users’ information by cleartext in the cookie, which divulges password to attackers.
- Product
- Door Access Control system
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comchtsecurity.com
Feb 10, 2020A Cookie based reflected XSS exists in the Web File Manager of Rumpus FTP Server 8.2.9.1, related to RumpusLoginUserName and snp.CVE-2019-19661 · Other software · Maxum · reported by MITREMedium 6.1
A Cookie based reflected XSS exists in the Web File Manager of Rumpus FTP Server 8.2.9.1, related to RumpusLoginUserName and snp.
- Product
- Rumpus FTP
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 7, 2020ProjectPier 0.8.8 does not use the Secure flag for cookiesCVE-2013-3637 · Other software · Projectpier · reported by MITREMedium 5.4
ProjectPier 0.8.8 does not use the Secure flag for cookies
- Product
- Projectpier
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.compacketstormsecurity.com
Feb 7, 2020ProjectPier 0.8.8 has a Remote Information Disclosure Weakness because of the lack of the HttpOnly cookie flagCVE-2013-3636 · Other software · Projectpier · reported by MITREMedium 5.4
ProjectPier 0.8.8 has a Remote Information Disclosure Weakness because of the lack of the HttpOnly cookie flag
- Product
- Projectpier
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comsecurityfocus.com
Feb 6, 2020The CentralNotice extension for MediaWiki before 1.19.9, 1.20.x before 1.20.8, and 1.21.x before 1.21.3 sets the Cache-Control header to cache session cookies wCVE-2013-4572 · Other software · Wikimedia Foundation · reported by Red HatHigh 7.5
The CentralNotice extension for MediaWiki before 1.19.9, 1.20.x before 1.20.8, and 1.21.x before 1.21.3 sets the Cache-Control header to cache session cookies when a user is autocreated, which allows remote attackers to authenticate as the created user.
- Product
- MediaWiki
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlists.fedoraproject.orglists.fedoraproject.org
Feb 5, 2020IBM Workflow for Bluemix does not set the secure flag for the session cookie in an https session, which makes it easier for remote attackers to capture this cooCVE-2015-0102 · Other software · IBM · reported by psirt@us.ibm.comHigh 8.1
IBM Workflow for Bluemix does not set the secure flag for the session cookie in an https session, which makes it easier for remote attackers to capture this cookie by intercepting its transmission within an http session.
- Product
- Workflow for Bluemix
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordwww-01.ibm.comsecurityfocus.com
Feb 5, 2020IBM Cloud Automation Manager 3.2.1.0 does not set the secure attribute on authorization tokens or session cookies.CVE-2019-4616 · Other software · IBM · reported by psirt@us.ibm.comLow 3.5
IBM Cloud Automation Manager 3.2.1.0 does not set the secure attribute on authorization tokens or session cookies. Attackers may be able to get the cookie values by sending a http:// link to a user or by planting this link in a site the user goes to. The cookie will be sent to the insecure link and the attacker can then obtain the cookie value by snooping the traffic. IBM X-Force ID: 168644.
- Product
- Cloud Automation Manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexchange.xforce.ibmcloud.comibm.com
Jan 30, 2020In Opencast before 7.6 and 8.1, using a remember-me cookie with an arbitrary username can cause Opencast to assume proper authentication for that user even if tCVE-2020-5206 · Other software · opencast · reported by GitHubHigh 8.7
In Opencast before 7.6 and 8.1, using a remember-me cookie with an arbitrary username can cause Opencast to assume proper authentication for that user even if the remember-me cookie was incorrect given that the attacked endpoint also allows anonymous access. This way, an attacker can, for example, fake a remember-me token, assume the identity of the global system administrator and request non-public content from the search service without ever providing any proper authentication. This problem is fixed in Opencast 7.6 and Opencast 8.1
- Product
- opencast
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 30, 2020Opencast before 7.6 and 8.1 enables a remember-me cookie based on a hash created from the username, password, and an additional system key.CVE-2020-5222 · Other software · opencast · reported by GitHubMedium 6.8
Opencast before 7.6 and 8.1 enables a remember-me cookie based on a hash created from the username, password, and an additional system key. This means that an attacker getting access to a remember-me token for one server can get access to all servers which allow log-in using the same credentials without ever needing the credentials. This problem is fixed in Opencast 7.6 and Opencast 8.1
- Product
- opencast
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 28, 2020An Information Disclosure vulnerability exists due to insufficient validation of authentication cookies for the RTSP session in D-Link DCS-5635 1.01, DCS-1100L CVE-2013-1602 · Other software · Dlink · reported by MITREHigh 7.5
An Information Disclosure vulnerability exists due to insufficient validation of authentication cookies for the RTSP session in D-Link DCS-5635 1.01, DCS-1100L 1.04, DCS-1130L 1.04, DCS-1100 1.03/1.04_US, DCS-1130 1.03/1.04_US , DCS-2102 1.05_RU/1.06/1.06_FR/1.05_TESCO, DCS-2121 1.05_RU/1.06/1.06_FR/1.05_TESCO, DCS-3410 1.02, DCS-5230 1.02, DCS-5230L 1.02, DCS-6410 1.0, DCS-7410 1.0, DCS-7510 1.0, and WCS-1100 1.02, which could let a malicious user obtain unauthorized access to video streams.
- Product
- Dcs-3411 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurityfocus.comexchange.xforce.ibmcloud.com
Jan 28, 2020IBM Security Secret Server 10.7 does not set the secure attribute on authorization tokens or session cookies.CVE-2019-4638 · Other software · IBM · reported by psirt@us.ibm.comLow 3.7
IBM Security Secret Server 10.7 does not set the secure attribute on authorization tokens or session cookies. This could allow an attacker to obtain sensitive information using man in the middle techniques. IBM X-Force ID: 170044.
- Product
- Security Secret Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexchange.xforce.ibmcloud.comibm.com
Jan 27, 2020SimpleHRM 2.3 and earlier could allow remote attackers to bypass the authentication process in 'user_manager.php' via spoofing a cookie.CVE-2013-2499 · Other software · Simplehrm · reported by MITREHigh 7.5
SimpleHRM 2.3 and earlier could allow remote attackers to bypass the authentication process in 'user_manager.php' via spoofing a cookie.
- Product
- Simplehrm
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordopenwall.comsecurityfocus.com
Jan 22, 2020An issue exists in Vanilla Forums before 2.0.17.9 due to the way cookies are handled.CVE-2011-3613 · Other software · Vanilla · reported by Red HatHigh 7.5
An issue exists in Vanilla Forums before 2.0.17.9 due to the way cookies are handled.
- Product
- Vanilla Forums
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comopenwall.com
Jan 6, 2020Multiple Cross-Site Scripting (XSS) vulnerabilities exist in Simple Online Planning (SOPlanning) before 1.33 via the document.cookie in nb_mois and mb_ligness aCVE-2014-8674 · Other software · Soplanning · reported by MITREMedium 5.4
Multiple Cross-Site Scripting (XSS) vulnerabilities exist in Simple Online Planning (SOPlanning) before 1.33 via the document.cookie in nb_mois and mb_ligness and the debug GET parameter to export.php, which allows malicious users to execute arbitrary code.
- Product
- Soplanning
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comseclists.org
Dec 31, 2019The GOsa_Filter_Settings cookie in GONICUS GOsa 2.7.5.2 is vulnerable to PHP objection injection, which allows a remote authenticated attacker to perform file dCVE-2019-14466 · Other software · Gosa Project · reported by MITREMedium 6.5
The GOsa_Filter_Settings cookie in GONICUS GOsa 2.7.5.2 is vulnerable to PHP objection injection, which allows a remote authenticated attacker to perform file deletions (in the context of the user account that runs the web server) via a crafted cookie value, because unserialize is used to restore filter settings from a cookie.
- Product
- Gosa
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comlists.debian.org
Dec 30, 2019MFScripts YetiShare 3.5.2 through 4.5.3 does not set the Secure flag on session cookies, allowing the cookie to be sent over cleartext channels.CVE-2019-19739 · Other software · Mfscripts · reported by MITREHigh 7.5
MFScripts YetiShare 3.5.2 through 4.5.3 does not set the Secure flag on session cookies, allowing the cookie to be sent over cleartext channels.
- Product
- Yetishare
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 30, 2019MFScripts YetiShare 3.5.2 through 4.5.3 does not set the SameSite flag on session cookies, allowing the cookie to be sent in cross-site requests and potentiallyCVE-2019-19737 · Other software · Mfscripts · reported by MITREHigh 8.8
MFScripts YetiShare 3.5.2 through 4.5.3 does not set the SameSite flag on session cookies, allowing the cookie to be sent in cross-site requests and potentially be used in cross-site request forgery attacks.
- Product
- Yetishare
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 30, 2019MFScripts YetiShare 3.5.2 through 4.5.3 does not set the HttpOnly flag on session cookies, allowing the cookie to be read by script, which can potentially be usCVE-2019-19736 · Other software · Mfscripts · reported by MITREMedium 6.1
MFScripts YetiShare 3.5.2 through 4.5.3 does not set the HttpOnly flag on session cookies, allowing the cookie to be read by script, which can potentially be used by attackers to obtain the cookie via cross-site scripting.
- Product
- Yetishare
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 20, 2019IBM Financial Transaction Manager 3.0 does not set the secure attribute on authorization tokens or session cookies.CVE-2019-4743 · Other software · IBM · reported by psirt@us.ibm.comMedium 4.3
IBM Financial Transaction Manager 3.0 does not set the secure attribute on authorization tokens or session cookies. Attackers may be able to get the cookie values by sending a http:// link to a user or by planting this link in a site the user goes to. The cookie will be sent to the insecure link and the attacker can then obtain the cookie value by snooping the traffic. IBM X-Force ID: 172880.
- Product
- Financial Transaction Manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexchange.xforce.ibmcloud.comibm.com
Dec 12, 2019In phpfastcache before 5.1.3, there is a possible object injection vulnerability in cookie driver.CVE-2019-16774 · Websites & servers · PHPSocialNetwork · reported by GitHubMedium 4.4
In phpfastcache before 5.1.3, there is a possible object injection vulnerability in cookie driver.
- Product
- phpfastcache
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 12, 2019A vulnerability was found in 3scale before version 2.6, did not set the HTTPOnly attribute on the user session cookie.CVE-2019-14849 · Other software · Redhat · reported by Red HatMedium 5.4
A vulnerability was found in 3scale before version 2.6, did not set the HTTPOnly attribute on the user session cookie. An attacker could use this to conduct cross site scripting attacks and gain access to unauthorized information.
- Product
- 3scale
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugzilla.redhat.combugzilla.redhat.com
Dec 10, 2019Insufficient policy enforcement in cookies in Google Chrome prior to 79.0.3945.79 allowed a remote attacker to leak cross-origin data via a crafted HTML page.CVE-2019-13744 · Computers, phones & browsers · Google · reported by chrome-cve-admin@google.comMedium 6.5
Insufficient policy enforcement in cookies in Google Chrome prior to 79.0.3945.79 allowed a remote attacker to leak cross-origin data via a crafted HTML page.
- Product
- Chrome
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlists.opensuse.orglists.opensuse.org
Dec 3, 2019In OkayCMS through 2.3.4, an unauthenticated attacker can achieve remote code execution by injecting a malicious PHP object via a crafted cookie.CVE-2019-16885 · Other software · Okay-cms · reported by MITRECritical 9.8
In OkayCMS through 2.3.4, an unauthenticated attacker can achieve remote code execution by injecting a malicious PHP object via a crafted cookie. This could happen at two places: first in view/ProductsView.php using the cookie price_filter, and second in api/Comparison.php via the cookie comparison.
- Product
- Okaycms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comseclists.org
Nov 28, 2019In Octopus Deploy before 2019.10.7, in a configuration where SSL offloading is enabled, the CSRF cookie was sometimes sent without the secure attribute.CVE-2019-19375 · Other software · Octopus · reported by MITREMedium 5.3
In Octopus Deploy before 2019.10.7, in a configuration where SSL offloading is enabled, the CSRF cookie was sometimes sent without the secure attribute. (The fix for this was backported to LTS versions 2019.6.14 and 2019.9.8.)
- Product
- Octopus Deploy
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 25, 2019ipa 3.0 does not properly check server identity before sending credential containing cookiesCVE-2012-5631 · Other software · ipa · reported by Red HatHigh 8.8
ipa 3.0 does not properly check server identity before sending credential containing cookies
- Product
- ipa
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurityfocus.comaccess.redhat.com
Nov 22, 2019IBM SmartCloud Analytics 1.3.1 through 1.3.5 does not set the secure attribute on authorization tokens or session cookies.CVE-2019-4214 · Other software · IBM · reported by psirt@us.ibm.comLow 3.7
IBM SmartCloud Analytics 1.3.1 through 1.3.5 does not set the secure attribute on authorization tokens or session cookies. This could allow an attacker to obtain sensitive information using man in the middle techniques. IBM X-Force ID: 159185.
- Product
- SmartCloud Analytics
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexchange.xforce.ibmcloud.comibm.com
Nov 19, 2019Node-cookie-signature before 1.0.6 is affected by a timing attack due to the type of comparison used.CVE-2016-1000236 · Other software · Cookie-signature Project · reported by MITREMedium 4.4
Node-cookie-signature before 1.0.6 is affected by a timing attack due to the type of comparison used.
- Product
- Cookie-signature
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugs.debian.orgbugzilla.redhat.com
Nov 19, 2019uzbl: Information disclosure via world-readable cookies storage fileCVE-2012-0843 · Other software · uzbl · reported by Red HatMedium 5.5
uzbl: Information disclosure via world-readable cookies storage file
- Product
- uzbl
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordopenwall.comaccess.redhat.com
Nov 19, 2019surf: cookie jar has read access from other local userCVE-2012-0842 · Other software · surf · reported by Red HatMedium 5.5
surf: cookie jar has read access from other local user
- Product
- surf
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordopenwall.comopenwall.com
Nov 18, 2019Apache Shiro before 1.4.2, when using the default "remember me" configuration, cookies could be susceptible to a padding attack.CVE-2019-12422 · Websites & servers · Apache · reported by security@apache.orgHigh 7.5
Apache Shiro before 1.4.2, when using the default "remember me" configuration, cookies could be susceptible to a padding attack.
- Product
- Shiro
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlists.apache.orglists.apache.org
Nov 6, 2019Cookie Dump Servlet stored XSS vulnerability in jetty though 6.1.20.CVE-2009-5048 · Other software · Mortbay · reported by MITREMedium 6.1
Cookie Dump Servlet stored XSS vulnerability in jetty though 6.1.20.
- Product
- Jetty
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordush.itsecurity-tracker.debian.org
Oct 28, 2019IBM Security Guardium Big Data Intelligence (SonarG) 4.0 does not set the secure attribute for cookies in HTTPS sessions, which could cause the user agent to seCVE-2019-4330 · Other software · IBM · reported by psirt@us.ibm.comMedium 4.3
IBM Security Guardium Big Data Intelligence (SonarG) 4.0 does not set the secure attribute for cookies in HTTPS sessions, which could cause the user agent to send those cookies in plaintext over an HTTP session. IBM X-Force ID: 161210.
- Product
- Security Guardium Big Data Intelligence
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexchange.xforce.ibmcloud.comibm.com
Oct 16, 2019The eu-cookie-law plugin through 3.0.6 for WordPress (aka EU Cookie Law (GDPR)) is susceptible to Stored XSS due to improper encoding of several configuration oCVE-2019-16522 · WordPress plugins & themes · reported by MITREMedium 4.8
The eu-cookie-law plugin through 3.0.6 for WordPress (aka EU Cookie Law (GDPR)) is susceptible to Stored XSS due to improper encoding of several configuration options in the admin area and the displayed cookie consent message. This affects Font Color, Background Color, and the Disable Cookie text. An attacker with high privileges can attack other users.
- Product
- eu-cookie-law
- Affected
- up to 3.0.6
- What to do
- Affects up to 3.0.6. Update eu-cookie-law to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordgithub.comwordpress.org
Oct 16, 2019NETGEAR JNR1010 devices before 1.0.0.32 have Incorrect Access Control because the ok value of the auth cookie is a special case.CVE-2016-11014 · Network & remote access · Netgear · reported by MITRECritical 9.8
NETGEAR JNR1010 devices before 1.0.0.32 have Incorrect Access Control because the ok value of the auth cookie is a special case.
- Product
- Jnr1010 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcybersecurityworks.comgithub.com
Oct 10, 2019A spoofing vulnerability exists when Microsoft Browsers improperly handle browser cookies, aka 'Microsoft Browser Spoofing Vulnerability'.CVE-2019-1357 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comMedium 4.3
A spoofing vulnerability exists when Microsoft Browsers improperly handle browser cookies, aka 'Microsoft Browser Spoofing Vulnerability'. This CVE ID is unique from CVE-2019-0608.
- Product
- Internet Explorer 11
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordportal.msrc.microsoft.comportal.msrc.microsoft.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.