Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
1,563 results · page 10 of 32
Jan 12, 2024User browser may be forced to execute JavaScript and pass the authentication cookie to the attacker leveraging the XSS vulnerability located at "/gui/terminal_tCVE-2023-49258 · Other software · Hongdian · reported by cvd@cert.plMedium 6.1
User browser may be forced to execute JavaScript and pass the authentication cookie to the attacker leveraging the XSS vulnerability located at "/gui/terminal_tool.cgi" in the "data" parameter.
- Product
- H8951-4G-ESP
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 3, 2024Complianz – GDPR/CCPA Cookie Consent: Stored Cross-Site ScriptingCVE-2023-6498 · WordPress plugins & themes · reported by WordfenceMedium 4.4
The Complianz – GDPR/CCPA Cookie Consent plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to and including 6.5.5 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.
- Product
- Complianz – GDPR/CCPA Cookie Consent
- Affected
- up to 6.5.5
- What to do
- Affects up to 6.5.5. Update Complianz – GDPR/CCPA Cookie Consent to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Dec 31, 2023Sympa before 6.2.62 relies on a cookie parameter for certain security objectives, but does not ensure that this parameter exists and has an unpredictable value.CVE-2021-46900 · Other software · Sympa · reported by MITREHigh 7.5
Sympa before 6.2.62 relies on a cookie parameter for certain security objectives, but does not ensure that this parameter exists and has an unpredictable value. Specifically, the cookie parameter is both a salt for stored passwords and an XSS protection mechanism.
- Product
- Sympa
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 20, 2023Due to this vulnerability, the Master operator could potentially incorporate an SVG tag into HTML, leading to an alert pop-up displaying a cookie.CVE-2023-28025 · Other software · HCL Software · reported by psirt@hcl.comMedium 6.6
Due to this vulnerability, the Master operator could potentially incorporate an SVG tag into HTML, leading to an alert pop-up displaying a cookie. To mitigate stored XSS vulnerabilities, a preventive measure involves thoroughly sanitizing and validating all user inputs before they are processed and stored in the server storage.
- Product
- HCL BigFix Mobile / Modern Client Management
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.hcltechsw.comsupport.hcltechsw.com
Dec 18, 2023The website configured in the URL widget will receive a session cookie when testing or executing scheduled reports.CVE-2023-32725 · Other software · Zabbix · reported by security@zabbix.comCritical 9.6
The website configured in the URL widget will receive a session cookie when testing or executing scheduled reports. The received session cookie can then be used to access the frontend as the particular user.
- Product
- Zabbix
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.zabbix.comsupport.zabbix.com
Dec 15, 2023GDPR Cookie Consent by Supsystic: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2023-49191 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Supsystic GDPR Cookie Consent by Supsystic allows Stored XSS.This issue affects GDPR Cookie Consent by Supsystic: from n/a through 2.1.2.
- Product
- GDPR Cookie Consent by Supsystic
- Affected
- up to 2.1.2
- What to do
- Affects up to 2.1.2. Update GDPR Cookie Consent by Supsystic to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Dec 14, 2023Cookie Bar: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2023-49836 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Brontobytes Cookie Bar allows Stored XSS.This issue affects Cookie Bar: from n/a through 2.0.
- Product
- Cookie Bar
- Affected
- up to 2.0
- What to do
- Affects up to 2.0. Update Cookie Bar to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Dec 13, 2023Design document functions which receive a user http request object may expose authorization or session cookie headers of the user who accesses the document.CVE-2023-45725 · Websites & servers · Apache Software Foundation · reported by security@apache.orgMedium 5.7
Design document functions which receive a user http request object may expose authorization or session cookie headers of the user who accesses the document. These design document functions are: * list * show * rewrite * update An attacker can leak the session component using an HTML-like output, insert the session as an external resource (such as an image), or store the credential in a _local document with an "update" function. For the attack to succeed the attacker has to be able to insert the design documents into the database, then manipulate a user to access a function from that design document. Workaround: Avoid using design documents from untrusted sources which may attempt to access or manipulate request object's headers
- Product
- Apache CouchDB
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocs.couchdb.orglists.apache.org
Dec 12, 2023The Devise gem before 3.5.4 for Ruby mishandles Remember Me cookies for sessions, which may allow an adversary to obtain unauthorized persistent application accCVE-2015-8314 · Other software · Heartcombo · reported by MITREHigh 7.5
The Devise gem before 3.5.4 for Ruby mishandles Remember Me cookies for sessions, which may allow an adversary to obtain unauthorized persistent application access.
- Product
- Devise
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 6, 2023This flaw allows a malicious HTTP server to set "super cookies" in curl that are then passed back to more origins than what is otherwise allowed or possible.CVE-2023-46218 · Other software · curl · reported by support@hackerone.comMedium 6.5
This flaw allows a malicious HTTP server to set "super cookies" in curl that are then passed back to more origins than what is otherwise allowed or possible. This allows a site to set cookies that then would get sent to different and unrelated sites and domains. It could do this by exploiting a mixed case flaw in curl's function that verifies a given cookie domain against the Public Suffix List (PSL). For example a cookie could be set with `domain=co.UK` when the URL used a lower case hostname `curl.co.uk`, even though `co.uk` is listed as a PSL domain.
- Product
- curl
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 4, 2023Welcart e-Commerce: Unserializes user input from cookiesCVE-2023-5952 · WordPress plugins & themes · reported by WPScanCritical 9.8
The Welcart e-Commerce WordPress plugin before 2.9.5 unserializes user input from cookies, which could allow unautehtniacted users to perform PHP Object Injection when a suitable gadget is present on the blog
- Product
- Welcart e-Commerce
- Fixed in
- 2.9.5
- What to do
- Update Welcart e-Commerce to 2.9.5 or newer.
Nov 30, 2023Cookies and Content Security Policy: Exposure of Sensitive Information to an Unauthorized ActorCVE-2023-40662 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Jonk @ Follow me Darling Cookies and Content Security Policy.This issue affects Cookies and Content Security Policy: from n/a through 2.15.
- Product
- Cookies and Content Security Policy
- Affected
- up to 2.15
- What to do
- Affects up to 2.15. Update Cookies and Content Security Policy to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Nov 22, 2023Cross-Site Request Forgery (CSRF) vulnerability in wpWax Legal Pages – Privacy Policy, Terms & Conditions, GDPR, CCPA, and Cookie Notice Generator plugin <= 1.3CVE-2023-47824 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Cross-Site Request Forgery (CSRF) vulnerability in wpWax Legal Pages – Privacy Policy, Terms & Conditions, GDPR, CCPA, and Cookie Notice Generator plugin <= 1.3.8 versions.
- Fixed in
- 1.3.9
- What to do
- Update the plugin to 1.3.9 or newer.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Nov 20, 2023Dev blog v1.0 allows to exploit an account takeover through the "user" cookie.CVE-2023-6144 · Other software · Dev Blog · reported by help@fluidattacks.comCritical 9.1
Dev blog v1.0 allows to exploit an account takeover through the "user" cookie. With this, an attacker can access any user's session just by knowing their username.
- Product
- Dev Blog
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordfluidattacks.comgithub.com
Nov 15, 2023Cross-Site Scripting (XSS) vulnerability in the ‘manageApiKeys’ component of Grocy 4.0.3 and earlier allows attackers to obtain victim's cookies when the victimCVE-2023-48197 · Other software · Grocy Project · reported by MITREMedium 5.4
Cross-Site Scripting (XSS) vulnerability in the ‘manageApiKeys’ component of Grocy 4.0.3 and earlier allows attackers to obtain victim's cookies when the victim clicks on the "see QR code" function.
- Product
- Grocy
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comnitipoom-jar.github.io
Nov 12, 2023 IBM CICS TX Advanced 10.1 does not set the secure attribute on authorization tokens or session cookies.CVE-2023-38363 · Other software · IBM · reported by psirt@us.ibm.comMedium 4.3
IBM CICS TX Advanced 10.1 does not set the secure attribute on authorization tokens or session cookies. Attackers may be able to get the cookie values by sending a http:// link to a user or by planting this link in a site the user goes to. The cookie will be sent to the insecure link and the attacker can then obtain the cookie value by snooping the traffic. IBM X-Force ID: 260818.
- Product
- CICS TX Advanced
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexchange.xforce.ibmcloud.comibm.com
Nov 8, 2023An issue discovered in Axios 1.5.1 inadvertently reveals the confidential XSRF-TOKEN stored in cookies by including it in the HTTP header X-XSRF-TOKEN for everyCVE-2023-45857 · Other software · Axios · reported by MITREMedium 6.5
An issue discovered in Axios 1.5.1 inadvertently reveals the confidential XSRF-TOKEN stored in cookies by including it in the HTTP header X-XSRF-TOKEN for every request made to any host allowing attackers to view sensitive information.
- Product
- Axios
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comsecurity.netapp.com
Nov 7, 2023WP Cookie Consent ( for GDPR, CCPA & ePrivacy ): Improper Neutralization of Formula Elements in a CSV FileCVE-2023-23678 · WordPress plugins & themes · reported by PatchstackMedium 4
Improper Neutralization of Formula Elements in a CSV File vulnerability in WPEkaClub WP Cookie Consent ( for GDPR, CCPA & ePrivacy ).This issue affects WP Cookie Consent ( for GDPR, CCPA & ePrivacy ): from n/a through 2.2.5.
- Product
- WP Cookie Consent ( for GDPR, CCPA & ePrivacy )
- Affected
- up to 2.2.5
- What to do
- Affects up to 2.2.5. Update WP Cookie Consent ( for GDPR, CCPA & ePrivacy ) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Nov 2, 2023A vulnerability has been identified in PT-G503 Series firmware versions prior to v5.2, where the Secure attribute for sensitive cookies in HTTPS sessions is notCVE-2023-5035 · Other software · Moxa · reported by psirt@moxa.comLow 3.1
A vulnerability has been identified in PT-G503 Series firmware versions prior to v5.2, where the Secure attribute for sensitive cookies in HTTPS sessions is not set, which could cause the cookie to be transmitted in plaintext over an HTTP session. The vulnerability may lead to security risks, potentially exposing user session data to unauthorized access and manipulation.
- Product
- PT-G503 Series
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 2, 2023A vulnerability has been identified in PT-G503 Series versions prior to v5.2, where the session cookies attribute is not set properly in the affected applicatioCVE-2023-4217 · Other software · Moxa · reported by psirt@moxa.comLow 3.1
A vulnerability has been identified in PT-G503 Series versions prior to v5.2, where the session cookies attribute is not set properly in the affected application. The vulnerability may lead to security risks, potentially exposing user session data to unauthorized access and manipulation.
- Product
- PT-G503 Series
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 30, 2023Sensitive Cookie in HTTPS Session Without 'Secure' Attribute in GitHub repository thorsten/phpmyfaq prior to 3.2.1.CVE-2023-5866 · Other software · thorsten · reported by security@huntr.devMedium 5.7
Sensitive Cookie in HTTPS Session Without 'Secure' Attribute in GitHub repository thorsten/phpmyfaq prior to 3.2.1.
- Product
- thorsten/phpmyfaq
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 26, 2023 Sielco PolyEco1000 is vulnerable to a session hijack vulnerability due to the cookie being vulnerable to a brute force attack, lack of SSL, and the session beiCVE-2023-0897 · Other software · Sielco · reported by ics-cert@hq.dhs.govHigh 8.8
Sielco PolyEco1000 is vulnerable to a session hijack vulnerability due to the cookie being vulnerable to a brute force attack, lack of SSL, and the session being visible in requests.
- Product
- PolyEco1000
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 26, 2023The cookie session ID is of insufficient length and can be exploited by brute force, which may allow a remote attacker to obtain a valid session, bypass autheCVE-2023-42769 · Other software · Sielco · reported by ics-cert@hq.dhs.govCritical 9.8
The cookie session ID is of insufficient length and can be exploited by brute force, which may allow a remote attacker to obtain a valid session, bypass authentication, and manipulate the transmitter.
- Product
- Analog FM transmitter
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 25, 2023An attacker with temporary script access to a site could have set a cookie containing invalid characters using `document.cookie` that could have led to unknown CVE-2023-5723 · Computers, phones & browsers · Mozilla · reported by security@mozilla.orgMedium 5.3
An attacker with temporary script access to a site could have set a cookie containing invalid characters using `document.cookie` that could have led to unknown errors. This vulnerability affects Firefox < 119.
- Product
- Firefox
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugzilla.mozilla.orgsecurity.gentoo.org
Oct 19, 2023An issue in Yamcs 5.8.6 allows attackers to obtain the session cookie via upload of crafted HTML file.CVE-2023-45281 · Other software · Spaceapplications · reported by MITREMedium 6.1
An issue in Yamcs 5.8.6 allows attackers to obtain the session cookie via upload of crafted HTML file.
- Product
- Yamcs
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlinkedin.comlinkedin.com
Oct 18, 2023This flaw allows an attacker to insert cookies at will into a running program using libcurl, if the specific series of conditions are met.CVE-2023-38546 · Other software · curl · reported by support@hackerone.comLow 3.7
This flaw allows an attacker to insert cookies at will into a running program using libcurl, if the specific series of conditions are met. libcurl performs transfers. In its API, an application creates "easy handles" that are the individual handles for single transfers. libcurl provides a function call that duplicates en easy handle called [curl_easy_duphandle](https://curl.se/libcurl/c/curl_easy_duphandle.html). If a transfer has cookies enabled when the handle is duplicated, the cookie-enable state is also cloned - but without cloning the actual cookies. If the source handle did not read any cookies from a specific file on disk, the cloned version of the handle would instead store the file name as `none` (using the four ASCII letters, no quotes). Subsequent use of the cloned handle that does not explicitly set a source to load cookies from would then inadvertently load cookies from a file named `none` - if such a file exists and is readable in the current directory of the program using libcurl. And if using the correct file format of course.
- Product
- curl
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordseclists.orgseclists.org
Oct 10, 2023 An authenticated user's session cookie may remain valid for a limited time after logging out from the BIG-IP Configuration utility on a multi-blade VIPRION plaCVE-2023-40537 · Network & remote access · F5 · reported by f5sirt@f5.comHigh 8.1
An authenticated user's session cookie may remain valid for a limited time after logging out from the BIG-IP Configuration utility on a multi-blade VIPRION platform. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
- Product
- BIG-IP
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 6, 2023Versions of the package geokit-rails before 2.5.0 are vulnerable to Command Injection due to unsafe deserialisation of YAML within the 'geo_location' cookie.CVE-2023-26153 · Other software · Geokit · reported by report@snyk.ioHigh 8.3
Versions of the package geokit-rails before 2.5.0 are vulnerable to Command Injection due to unsafe deserialisation of YAML within the 'geo_location' cookie. This issue can be exploited remotely via a malicious cookie value. **Note:** An attacker can use this vulnerability to execute commands on the host system.
- Product
- Geokit-rails
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comgithub.com
Oct 4, 2023IBM Security Guardium 11.5 could disclose sensitive information due to a missing or insecure SameSite attribute for a sensitive cookie.CVE-2022-43906 · Other software · IBM · reported by psirt@us.ibm.comLow 3.1
IBM Security Guardium 11.5 could disclose sensitive information due to a missing or insecure SameSite attribute for a sensitive cookie. IBM X-Force ID: 240897.
- Product
- Security Guardium
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexchange.xforce.ibmcloud.comhttps
Oct 3, 2023Cross-Site Request Forgery (CSRF) vulnerability in Antsanchez Easy Cookie Law plugin <= 3.1 versions.CVE-2023-40198 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Cross-Site Request Forgery (CSRF) vulnerability in Antsanchez Easy Cookie Law plugin <= 3.1 versions.
- Affected
- up to 3.1
- What to do
- Affects up to 3.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Oct 3, 2023Cross-site Scripting (XSS) vulnerability in Syslog Section of Pandora FMS allows attacker to cause that users cookie value will be transferred to the attackers CVE-2023-0828 · Other software · Artica PFMS · reported by cve-coordination@incibe.esMedium 6.7
Cross-site Scripting (XSS) vulnerability in Syslog Section of Pandora FMS allows attacker to cause that users cookie value will be transferred to the attackers users server. This issue affects Pandora FMS v767 version and prior versions on all platforms.
- Product
- Pandora FMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpandorafms.compandorafms.com
Sep 25, 2023A reflected cross-site scripting (XSS) vulnerability in the data[redirect_url] parameter of mooSocial v3.1.8 allows attackers to steal user's session cookies anCVE-2023-43325 · Other software · Moosocial · reported by MITREMedium 6.1
A reflected cross-site scripting (XSS) vulnerability in the data[redirect_url] parameter of mooSocial v3.1.8 allows attackers to steal user's session cookies and impersonate their account via a crafted URL.
- Product
- Moosocial
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.commoosocial.com
Sep 25, 2023A reflected cross-site scripting (XSS) vulnerability exisits in multiple url of mooSocial v3.1.8 allows attackers to steal user's session cookies and impersonatCVE-2023-43326 · Other software · Moosocial · reported by MITREMedium 6.1
A reflected cross-site scripting (XSS) vulnerability exisits in multiple url of mooSocial v3.1.8 allows attackers to steal user's session cookies and impersonate their account via a crafted URL.
- Product
- Moosocial
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.commoosocial.com
Sep 25, 2023UpLight cookiebanner before 1.5.1 was discovered to contain a SQL injection vulnerability via the component Hook::getHookModuleExecList().CVE-2023-39640 · Other software · uplight · reported by MITRECritical 9.8
UpLight cookiebanner before 1.5.1 was discovered to contain a SQL injection vulnerability via the component Hook::getHookModuleExecList().
- Product
- cookie_law
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurity.friendsofpresta.orgsecurity.friendsofpresta.org
Sep 18, 2023 A potential attacker with or without (cookie theft) access to the device would be able to include malicious code (XSS) when uploading new devicCVE-2023-38255 · Other software · Socomec · reported by ics-cert@hq.dhs.govMedium 6.5
A potential attacker with or without (cookie theft) access to the device would be able to include malicious code (XSS) when uploading new device configuration that could affect the intended function of the device.
- Product
- MODULYS GP (MOD3GP-SY-120K)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 18, 2023 Session management within the web application is incorrect and allows attackers to steal session cookies to perform a multitude of actions that the wCVE-2023-41084 · Other software · Socomec · reported by ics-cert@hq.dhs.govCritical 10
Session management within the web application is incorrect and allows attackers to steal session cookies to perform a multitude of actions that the web app allows on the device.
- Product
- MODULYS GP (MOD3GP-SY-120K)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 11, 2023HKcms v2.3.0.230709 is vulnerable to Cross Site Scripting (XSS) allowing administrator cookies to be stolen.CVE-2023-40786 · Other software · Hkcms · reported by MITREMedium 5.4
HKcms v2.3.0.230709 is vulnerable to Cross Site Scripting (XSS) allowing administrator cookies to be stolen.
- Product
- Hkcms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 5, 2023Cerebrate before 1.15 lacks the Secure attribute for the session cookie.CVE-2023-41908 · Other software · Cerebrate-project · reported by MITREMedium 5.3
Cerebrate before 1.15 lacks the Secure attribute for the session cookie.
- Product
- Cerebrate
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 30, 2023Sensitive Cookie in HTTPS Session Without 'Secure' Attribute in GitHub repository instantsoft/icms2 prior to 2.16.1.CVE-2023-4654 · Other software · instantsoft · reported by security@huntr.devLow 3.5
Sensitive Cookie in HTTPS Session Without 'Secure' Attribute in GitHub repository instantsoft/icms2 prior to 2.16.1.
- Product
- instantsoft/icms2
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 30, 2023GDPR Cookie Compliance (CCPA, DSGVO, Cookie Consent): Does not have proper CSRF checksCVE-2023-4013 · WordPress plugins & themes · reported by WPScanMedium 6.5
The GDPR Cookie Compliance (CCPA, DSGVO, Cookie Consent) WordPress plugin before 4.12.5 does not have proper CSRF checks when managing its license, which could allow attackers to make logged in admins update and deactivate the plugin's license via CSRF attacks
- Product
- GDPR Cookie Compliance (CCPA, DSGVO, Cookie Consent)
- Fixed in
- 4.12.5
- What to do
- Update GDPR Cookie Compliance (CCPA, DSGVO, Cookie Consent) to 4.12.5 or newer.
Aug 24, 2023A vulnerability has been identified in ioLogik 4000 Series (ioLogik E4200) firmware versions v1.6 and prior, where the session cookies attribute is not set propCVE-2023-4228 · Other software · Moxa · reported by psirt@moxa.comLow 3.1
A vulnerability has been identified in ioLogik 4000 Series (ioLogik E4200) firmware versions v1.6 and prior, where the session cookies attribute is not set properly in the affected application. The vulnerability may lead to security risks, potentially exposing user session data to unauthorized access and manipulation.
- Product
- ioLogik 4000 Series
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 22, 2023Cross-site Scripting (XSS) vulnerability in the Pandora FMS Special Days component allows an attacker to use it to steal the session cookie value of admin userCVE-2023-24516 · Other software · Artica PFMS · reported by cve-coordination@incibe.esMedium 5.9
Cross-site Scripting (XSS) vulnerability in the Pandora FMS Special Days component allows an attacker to use it to steal the session cookie value of admin users easily with little user interaction. This issue affects Pandora FMS v767 version and prior versions on all platforms.
- Product
- Pandora FMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.compandorafms.com
Aug 22, 2023Cross-site Scripting (XSS) vulnerability in Visual Console Module of Pandora FMS could be used to hijack admin users session cookie values, carry out phishing aCVE-2023-24514 · Other software · Artica PFMS · reported by cve-coordination@incibe.esMedium 6.3
Cross-site Scripting (XSS) vulnerability in Visual Console Module of Pandora FMS could be used to hijack admin users session cookie values, carry out phishing attacks, etc. This issue affects Pandora FMS v767 version and prior versions on all platforms.
- Product
- Pandora FMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpandorafms.compandorafms.com
Aug 15, 2023Broadcom RAID Controller web interface is vulnerable due to insecure default of HTTP configuration that does not safeguard cookies with Secure attributeCVE-2023-4336 · Other software · Broadcom · reported by cret@cert.orgCritical 9.8
Broadcom RAID Controller web interface is vulnerable due to insecure default of HTTP configuration that does not safeguard cookies with Secure attribute
- Product
- LSI Storage Authority (LSA)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbroadcom.combroadcom.com
Aug 15, 2023Broadcom RAID Controller web interface is vulnerable due to insecure default of HTTP configuration that does not safeguard SESSIONID cookie with SameSite attribCVE-2023-4329 · Other software · Broadcom · reported by cret@cert.orgCritical 9.8
Broadcom RAID Controller web interface is vulnerable due to insecure default of HTTP configuration that does not safeguard SESSIONID cookie with SameSite attribute
- Product
- LSI Storage Authority (LSA)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbroadcom.combroadcom.com
Aug 11, 2023An issue was discovered in getRememberedSerializedIdentity function in CookieRememberMeManager class in lerry903 RuoYi version 3.4.0, allows remote attackers toCVE-2021-28411 · Other software · Ruoyi · reported by MITRECritical 9.8
An issue was discovered in getRememberedSerializedIdentity function in CookieRememberMeManager class in lerry903 RuoYi version 3.4.0, allows remote attackers to escalate privileges.
- Product
- Ruoyi
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 8, 2023This vulnerability exists in ESDS Emagic Data Center Management Suit due to non-expiry of session cookie.CVE-2023-37570 · Other software · ESDS · reported by vdisclose@cert-in.org.inHigh 7.2
This vulnerability exists in ESDS Emagic Data Center Management Suit due to non-expiry of session cookie. By reusing the stolen cookie, a remote attacker could gain unauthorized access to the targeted system.
- Product
- Emagic Data Center Management Suite
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcert-in.org.incert-in.org.in
Aug 5, 2023A vulnerability was found in Templatecookie Adlisting 2.14.0.CVE-2023-4168 · Other software · Templatecookie · reported by VulDBMedium 4.3
A vulnerability was found in Templatecookie Adlisting 2.14.0. It has been classified as problematic. Affected is an unknown function of the file /ad-list of the component Redirect Handler. The manipulation leads to information disclosure. It is possible to launch the attack remotely. The identifier of this vulnerability is VDB-236184. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- Adlisting
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comvuldb.com
Aug 1, 2023When the number of cookies per domain was exceeded in `document.cookie`, the actual cookie jar sent to the host was no longer consistent with expected cookie jaCVE-2023-4055 · Computers, phones & browsers · Mozilla · reported by security@mozilla.orgHigh 7.5
When the number of cookies per domain was exceeded in `document.cookie`, the actual cookie jar sent to the host was no longer consistent with expected cookie jar state. This could have caused requests to be sent with some cookies missing. This vulnerability affects Firefox < 116, Firefox ESR < 102.14, and Firefox ESR < 115.1.
- Product
- Firefox
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugzilla.mozilla.orglists.debian.org
Jul 26, 2023An issue has been discovered in GitLab DAST scanner affecting all versions starting from 3.0.29 before 4.0.5, in which the DAST scanner leak cross site cookies CVE-2023-1401 · Websites & servers · GitLab · reported by cve@gitlab.comMedium 5
An issue has been discovered in GitLab DAST scanner affecting all versions starting from 3.0.29 before 4.0.5, in which the DAST scanner leak cross site cookies on redirect during authorization.
- Product
- GitLab
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgitlab.comhackerone.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.