CWE-565 Archives - CVE Vulnerability

CVE-2018-5190

Sun, 26 Feb 2023 06:50:14 +0000

PicturesPro Photo Cart 6 and 7 before Security-Patch-2018-B allows remote attackers to access arbitrary customer accounts via a modified cookie, related to pc_head.php, pc_login.php, and pc_login_page.php.

The post CVE-2018-5190 appeared first on CVE Vulnerability.

CVE-2018-20512

Sun, 26 Feb 2023 06:48:37 +0000

EPON CPE-WiFi devices 2.0.4-X000 are vulnerable to escalation of privileges by sending cooLogin=1, cooUser=admin, and timestamp=-1 cookies.

The post CVE-2018-20512 appeared first on CVE Vulnerability.

CVE-2018-19224

Sun, 26 Feb 2023 06:48:05 +0000

An issue was discovered in LAOBANCMS 2.0. /admin/login.php allows spoofing of the id and guanliyuan cookies.

The post CVE-2018-19224 appeared first on CVE Vulnerability.

CVE-2020-7070

Sun, 26 Feb 2023 06:42:57 +0000

In PHP versions 7.2.x below 7.2.34, 7.3.x below 7.3.23 and 7.4.x below 7.4.11, when PHP is processing incoming HTTP cookie values, the cookie names are url-decoded. This may lead to cookies with prefixes like __Host confused with cookies that decode to such prefix, thus leading to an attacker being able to forge cookie which is supposed to be secure. See also CVE-2020-8184 for more information.

The post CVE-2020-7070 appeared first on CVE Vulnerability.

CVE-2020-4749

Sun, 26 Feb 2023 06:42:07 +0000

IBM Spectrum Scale 5.0.0 through 5.0.5.2 does not set the secure attribute on authorization tokens or session cookies. Attackers may be able to get the cookie values by sending a http:// link to a user or by planting this link in a site the user goes to. The cookie will be sent to the insecure link and the attacker can then obtain the cookie value by snooping the traffic. IBM X-Force ID: 188518.

The post CVE-2020-4749 appeared first on CVE Vulnerability.

CVE-2020-29668

Sun, 26 Feb 2023 06:41:01 +0000

Sympa before 6.2.59b.2 allows remote attackers to obtain full SOAP API access by sending any arbitrary string (except one from an expired cookie) as the cookie value to authenticateAndRun.

The post CVE-2020-29668 appeared first on CVE Vulnerability.

CVE-2020-26955

Sun, 26 Feb 2023 06:40:11 +0000

When a user downloaded a file in Firefox for Android, if a cookie is set, it would have been re-sent during a subsequent file download operation on the same domain, regardless of whether the original and subsequent request were in private and non-private browsing modes. *Note: This issue only affected Firefox for Android. Other operating systems are unaffected.*. This vulnerability affects Firefox < 83.

The post CVE-2020-26955 appeared first on CVE Vulnerability.

CVE-2019-7266

Sun, 26 Feb 2023 06:34:13 +0000

Linear eMerge 50P/5000P devices allow Authentication Bypass.

The post CVE-2019-7266 appeared first on CVE Vulnerability.

CVE-2019-4688

Sun, 26 Feb 2023 06:33:27 +0000

IBM Security Guardium Data Encryption (GDE) 3.0.0.2 does not set the secure attribute on authorization tokens or session cookies. Attackers may be able to get the cookie values by sending a http:// link to a user or by planting this link in a site the user goes to. The cookie will be sent to the insecure link and the attacker can then obtain the cookie value by snooping the traffic. IBM X-Force ID: 171825.

The post CVE-2019-4688 appeared first on CVE Vulnerability.

CVE-2019-4638

Sun, 26 Feb 2023 06:33:27 +0000

IBM Security Secret Server 10.7 does not set the secure attribute on authorization tokens or session cookies. This could allow an attacker to obtain sensitive information using man in the middle techniques. IBM X-Force ID: 170044.

The post CVE-2019-4638 appeared first on CVE Vulnerability.