Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
1,566 results · page 13 of 32
Jun 17, 2022netgear wnap320 router WNAP320_V2.0.3_firmware is vulnerable to Incorrect Access Control via /recreate.php, which can leak all users cookies.CVE-2022-31876 · Network & remote access · Netgear · reported by MITREMedium 5.3
netgear wnap320 router WNAP320_V2.0.3_firmware is vulnerable to Incorrect Access Control via /recreate.php, which can leak all users cookies.
- Product
- Wnap320 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 14, 2022An issue in TopIDP3000 Topsec Operating System tos_3.3.005.665b.15_smpidp allows attackers to perform a brute-force attack via a crafted session_id cookie.CVE-2022-31273 · Other software · 17ido · reported by MITRECritical 9.8
An issue in TopIDP3000 Topsec Operating System tos_3.3.005.665b.15_smpidp allows attackers to perform a brute-force attack via a crafted session_id cookie.
- Product
- Topidp3000 Topsec Operating System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 14, 2022In Connx Version 6.2.0.1269 (20210623), a cookie can be issued by the application and not have the secure flag set.CVE-2021-40650 · Other software · Softwareag · reported by MITREMedium 6.5
In Connx Version 6.2.0.1269 (20210623), a cookie can be issued by the application and not have the secure flag set.
- Product
- Connx
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 14, 2022In Connx Version 6.2.0.1269 (20210623), a cookie can be issued by the application and not have the HttpOnly flag set.CVE-2021-40649 · Other software · Softwareag · reported by MITREMedium 6.5
In Connx Version 6.2.0.1269 (20210623), a cookie can be issued by the application and not have the HttpOnly flag set.
- Product
- Connx
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 8, 2022The package cookiecutter before 2.1.1 are vulnerable to Command Injection via hg argument injection.CVE-2022-24065 · Other software · Cookiecutter Project · reported by report@snyk.ioHigh 8.1
The package cookiecutter before 2.1.1 are vulnerable to Command Injection via hg argument injection. When calling the cookiecutter function from Python code with the checkout parameter, it is passed to the hg checkout command in a way that additional flags can be set. The additional flags can be used to perform a command injection.
- Product
- Cookiecutter
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 2, 2022libcurl wrongly allows cookies to be set for Top Level Domains (TLDs) if thehost name is provided with a trailing dot.curl can be told to receive and send cookiCVE-2022-27779 · Other software · Siemens · reported by support@hackerone.comMedium 5.3
libcurl wrongly allows cookies to be set for Top Level Domains (TLDs) if thehost name is provided with a trailing dot.curl can be told to receive and send cookies. curl's "cookie engine" can bebuilt with or without [Public Suffix List](https://publicsuffix.org/)awareness. If PSL support not provided, a more rudimentary check exists to atleast prevent cookies from being set on TLDs. This check was broken if thehost name in the URL uses a trailing dot.This can allow arbitrary sites to set cookies that then would get sent to adifferent and unrelated site or domain.
- Product
- SIMATIC S7-1500 CPU 1518-4 PN/DP MFP
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordhackerone.comsecurity.gentoo.org
Jun 2, 2022A insufficiently protected credentials vulnerability in fixed in curl 7.83.0 might leak authentication or cookie header data on HTTP redirects to the same host CVE-2022-27776 · Other software · Siemens · reported by support@hackerone.comMedium 6.5
A insufficiently protected credentials vulnerability in fixed in curl 7.83.0 might leak authentication or cookie header data on HTTP redirects to the same host but another port number.
- Product
- SIMATIC S7-1500 CPU 1518-4 PN/DP MFP
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordhackerone.comlists.debian.org
May 27, 2022The Master operator may be able to embed script tag in HTML with alert pop-up display cookie.CVE-2021-27781 · Other software · HCL Software · reported by psirt@hcl.comMedium 6.6
The Master operator may be able to embed script tag in HTML with alert pop-up display cookie.
- Product
- HCL BigFix Mobile / Modern Client Management
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.hcltechsw.comsupport.hcltechsw.com
May 26, 2022An access control issue in Linglong v1.0 allows attackers to access the background of the application via a crafted cookie.CVE-2022-29633 · Other software · Linglong Project · reported by MITRECritical 9.8
An access control issue in Linglong v1.0 allows attackers to access the background of the application via a crafted cookie.
- Product
- Linglong
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 26, 2022A cookie management issue was addressed with improved state management.CVE-2022-22662 · Computers, phones & browsers · Apple · reported by product-security@apple.comMedium 6.5
A cookie management issue was addressed with improved state management. This issue is fixed in Security Update 2022-003 Catalina, macOS Big Sur 11.6.5. Processing maliciously crafted web content may disclose sensitive user information.
- Product
- macOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordopenwall.comlists.fedoraproject.org
May 25, 2022Gibbon v23 does not generate a new session ID cookie after a user authenticates, making the application vulnerable to session fixation.CVE-2022-27305 · Other software · Gibbonedu · reported by MITREHigh 8.8
Gibbon v23 does not generate a new session ID cookie after a user authenticates, making the application vulnerable to session fixation.
- Product
- Gibbon
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 24, 2022In LuxSoft LuxCal Web Calendar before 5.2.0, an unauthenticated attacker can manipulate a cookie value.CVE-2021-45915 · Other software · Luxsoft · reported by MITRECritical 9.8
In LuxSoft LuxCal Web Calendar before 5.2.0, an unauthenticated attacker can manipulate a cookie value. This allows the attacker's session to be authenticated as any registered LuxCal user, including the site administrator.
- Product
- Luxcal
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comh1pmnh.github.io
May 23, 2022Inout Blockchain AltExchanger 1.2.1 allows index.php/home/about inoutio_language cookie SQL injection.CVE-2022-31489 · Other software · Inoutscripts · reported by MITREHigh 7.5
Inout Blockchain AltExchanger 1.2.1 allows index.php/home/about inoutio_language cookie SQL injection.
- Product
- Blockchain Altexchanger
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 23, 2022Rescue Dispatch Management System 1.0 suffers from Stored XSS, leading to admin account takeover via cookie stealing.CVE-2022-30017 · Other software · Rescue Dispatch Management System Project · reported by MITREMedium 5.4
Rescue Dispatch Management System 1.0 suffers from Stored XSS, leading to admin account takeover via cookie stealing.
- Product
- Rescue Dispatch Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comsourcecodester.com
May 18, 2022The Zoom Client for Meetings (for Android, iOS, Linux, MacOS, and Windows) before version 5.10.0 failed to properly constrain client session cookies to Zoom domCVE-2022-22785 · Other software · Zoom Video Communications Inc · reported by security@zoom.usMedium 5.9
The Zoom Client for Meetings (for Android, iOS, Linux, MacOS, and Windows) before version 5.10.0 failed to properly constrain client session cookies to Zoom domains. This issue could be used in a more sophisticated attack to send an unsuspecting users Zoom-scoped session cookies to a non-Zoom domain. This could potentially allow for spoofing of a Zoom user.
- Product
- Zoom Client for Meetings for Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexplore.zoom.usexplore.zoom.us
May 12, 2022An information disclosure vulnerability exists in the web interface session cookie functionality of InHand Networks InRouter302 V3.5.4.CVE-2022-25172 · Other software · InHand Networks · reported by talos-cna@cisco.comMedium 6.1
An information disclosure vulnerability exists in the web interface session cookie functionality of InHand Networks InRouter302 V3.5.4. The session cookie misses the HttpOnly flag, making it accessible via JavaScript and thus allowing an attacker, able to perform an XSS attack, to steal the session cookie.
- Product
- InRouter302
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtalosintelligence.cominhandnetworks.com
May 6, 2022Cookie without HTTPONLY flag set.CVE-2021-27764 · Other software · HCL Software · reported by psirt@hcl.comHigh 7.4
Cookie without HTTPONLY flag set. NUMBER cookie(s) was set without Secure or HTTPOnly flags. The images show the cookie with the missing flag. (WebUI)
- Product
- HCL BigFix WebUI
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.hcltechsw.comsupport.hcltechsw.com
May 6, 2022When handling a mismatched pre-authentication cookie, the application leaks the internal error message in the response, which contains the Splunk Enterprise locCVE-2022-26070 · Other software · Splunk · reported by prodsec@splunk.comMedium 4.3
When handling a mismatched pre-authentication cookie, the application leaks the internal error message in the response, which contains the Splunk Enterprise local system path. The vulnerability impacts Splunk Enterprise versions before 8.1.0.
- Product
- Splunk Enterprise
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 1, 2022The package s-cart/s-cart before 6.9; the package s-cart/core before 6.9 are vulnerable to Cross-site Scripting (XSS) which can lead to cookie stealing of any vCVE-2022-21149 · Other software · S-cart · reported by report@snyk.ioMedium 5.4
The package s-cart/s-cart before 6.9; the package s-cart/core before 6.9 are vulnerable to Cross-site Scripting (XSS) which can lead to cookie stealing of any victim that visits the affected URL so the attacker can gain unauthorized access to that user's account through the stolen cookie.
- Product
- S-cart
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 28, 2022The Ericom PowerTerm WebConnect 6.0 login portal can unsafely write an XSS payload from the AppPortal cookie into the page.CVE-2022-29152 · Other software · Ericom · reported by MITREMedium 6.1
The Ericom PowerTerm WebConnect 6.0 login portal can unsafely write an XSS payload from the AppPortal cookie into the page.
- Product
- Powerterm Webconnect
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 25, 2022In Terramaster F4-210, F2-210 TOS 4.2.X (4.2.15-2107141517), an attacker can self-sign session cookies by knowing the target's MAC address and the user's passwoCVE-2021-45841 · Other software · Terra-master · reported by MITREHigh 8.1
In Terramaster F4-210, F2-210 TOS 4.2.X (4.2.15-2107141517), an attacker can self-sign session cookies by knowing the target's MAC address and the user's password hash. Guest users (disabled by default) can be abused using a null/empty hash and allow an unauthenticated attacker to login as guest.
- Product
- TOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comthatsn0tmy.site
Apr 7, 2022Insecure direct object reference in SUNNY TRIPOWER 5.0 Firmware version 3.10.16.R leads to unauthorized user groups accessing due to insecure cookie handling.CVE-2021-46416 · Other software · SMA · reported by MITREHigh 8.1
Insecure direct object reference in SUNNY TRIPOWER 5.0 Firmware version 3.10.16.R leads to unauthorized user groups accessing due to insecure cookie handling.
- Product
- Sunny Tripower Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comdrive.google.com
Mar 25, 2022SurveyKing v0.2.0 was discovered to retain users' session cookies after logout, allowing attackers to login to the system and access data using the browser cachCVE-2022-25590 · Other software · Surveyking · reported by MITREMedium 6.5
SurveyKing v0.2.0 was discovered to retain users' session cookies after logout, allowing attackers to login to the system and access data using the browser cache when the user exits the application.
- Product
- Surveyking
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 16, 2022A malicious, but authorised and authenticated user can construct an HTTP request using their existing CSRF token and session cookie to manually upload files to CVE-2022-0959 · Other software · Pgadmin · reported by Red HatMedium 6.5
A malicious, but authorised and authenticated user can construct an HTTP request using their existing CSRF token and session cookie to manually upload files to any location that the operating system user account under which pgAdmin is running has permission to write.
- Product
- Pgadmin 4
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugzilla.redhat.combugzilla.redhat.com
Mar 14, 2022Cookie Information | Free GDPR Consent Solution: Does not escape user data before outputting it back in attributes in the admin dashboardCVE-2022-0147 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Cookie Information | Free GDPR Consent Solution WordPress plugin before 2.0.8 does not escape user data before outputting it back in attributes in the admin dashboard, leading to a Reflected Cross-Site Scripting issue
- Product
- Cookie Information | Free GDPR Consent Solution
- Fixed in
- 2.0.8
- What to do
- Update Cookie Information | Free GDPR Consent Solution to 2.0.8 or newer.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwpscan.com
Mar 10, 2022FreeTAKServer 1.9.8 contains a hardcoded Flask secret key which allows attackers to create crafted cookies to bypass authentication or escalate privileges.CVE-2022-25510 · Other software · Freetakserver-ui Project · reported by MITREHigh 8.8
FreeTAKServer 1.9.8 contains a hardcoded Flask secret key which allows attackers to create crafted cookies to bypass authentication or escalate privileges.
- Product
- Freetakserver-ui
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 7, 2022WordPress Real Cookie Banner: GDPR (DSGVO) & ePrivacy Cookie Consent: Does not have CSRF checks in placeCVE-2022-0445 · WordPress plugins & themes · reported by WPScanMedium 6.5
The WordPress Real Cookie Banner: GDPR (DSGVO) & ePrivacy Cookie Consent WordPress plugin before 2.14.2 does not have CSRF checks in place when resetting its settings, allowing attackers to make a logged in admin reset them via a CSRF attack
- Product
- WordPress Real Cookie Banner: GDPR (DSGVO) & ePrivacy Cookie Consent
- Fixed in
- 2.14.2
- What to do
- Update WordPress Real Cookie Banner: GDPR (DSGVO) & ePrivacy Cookie Consent to 2.14.2 or newer.
Mar 2, 2022In DCE/RPC it is possible to share the handles (cookies for resource state) between multiple connections via a mechanism called 'association groups'.CVE-2021-3738 · Other software · Samba · reported by Red HatHigh 8.8
In DCE/RPC it is possible to share the handles (cookies for resource state) between multiple connections via a mechanism called 'association groups'. These handles can reference connections to our sam.ldb database. However while the database was correctly shared, the user credentials state was only pointed at, and when one connection within that association group ended, the database would be left pointing at an invalid 'struct session_info'. The most likely outcome here is a crash, but it is possible that the use-after-free could instead allow different user state to be pointed at and this might allow more privileged access.
- Product
- Samba
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugzilla.redhat.combugzilla.samba.org
Mar 2, 2022A flaw was found in the way HAProxy processed HTTP responses containing the "Set-Cookie2" header.CVE-2022-0711 · Other software · Haproxy · reported by Red HatHigh 7.5
A flaw was found in the way HAProxy processed HTTP responses containing the "Set-Cookie2" header. This flaw could allow an attacker to send crafted HTTP response packets which lead to an infinite loop, eventually resulting in a denial of service condition. The highest threat from this vulnerability is availability.
- Product
- Haproxy
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordaccess.redhat.comgithub.com
Mar 2, 2022jQuery Cookie 1.4.1 is affected by prototype pollution, which can lead to DOM cross-site scripting (XSS).CVE-2022-23395 · Other software · Jquery.cookie Project · reported by MITREMedium 6.1
jQuery Cookie 1.4.1 is affected by prototype pollution, which can lead to DOM cross-site scripting (XSS).
- Product
- Jquery.cookie
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurity.netapp.comsnyk.io
Feb 28, 2022A stored cross-site scripting (XSS) vulnerability in Ice Hrm 30.0.0.OS allows attackers to steal cookies via a crafted payload inserted into the First Name fielCVE-2022-25015 · Other software · Icehrm · reported by MITREMedium 5.4
A stored cross-site scripting (XSS) vulnerability in Ice Hrm 30.0.0.OS allows attackers to steal cookies via a crafted payload inserted into the First Name field.
- Product
- Icehrm
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 25, 2022In JetBrains TeamCity before 2021.2, a logout action didn't remove a Remember Me cookie.CVE-2022-24332 · Other software · Jetbrains · reported by MITREMedium 5.3
In JetBrains TeamCity before 2021.2, a logout action didn't remove a Remember Me cookie.
- Product
- Teamcity
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordblog.jetbrains.comblog.jetbrains.com
Feb 14, 2022An Incorrect Access Control vulnerability exists in zzcms 8.2, which lets a malicious user bypass authentication by changing the user name in the cookie to use CVE-2021-45347 · Other software · Zzcms · reported by MITREHigh 7.5
An Incorrect Access Control vulnerability exists in zzcms 8.2, which lets a malicious user bypass authentication by changing the user name in the cookie to use any password.
- Product
- Zzcms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 9, 2022An issue exsits in Gitea through 1.15.7, which could let a malicious user gain privileges due to client side cookies not being deleted and the session remains vCVE-2021-45330 · Other software · Gitea · reported by MITRECritical 9.8
An issue exsits in Gitea through 1.15.7, which could let a malicious user gain privileges due to client side cookies not being deleted and the session remains valid on the server side for reuse.
- Product
- Gitea
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 2, 2022SQL Injection vulnerability discovered in Unified Office Total Connect Now that would allow an attacker to extract sensitive information through a cookie parameCVE-2022-24121 · Other software · Unifiedoffice · reported by MITREHigh 7.5
SQL Injection vulnerability discovered in Unified Office Total Connect Now that would allow an attacker to extract sensitive information through a cookie parameter.
- Product
- Total Connect NOW
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordunifiedoffice.comcoresecurity.com
Jan 25, 2022On BIG-IP AFM version 16.x before 16.1.0, 15.1.x before 15.1.5, 14.1.x before 14.1.4.5, and all versions of 13.1.x, when global AFM SYN cookie protection (TCP HCVE-2022-23028 · Network & remote access · F5 · reported by f5sirt@f5.comMedium 5.3
On BIG-IP AFM version 16.x before 16.1.0, 15.1.x before 15.1.5, 14.1.x before 14.1.4.5, and all versions of 13.1.x, when global AFM SYN cookie protection (TCP Half Open flood vector) is activated in the AFM Device Dos or DOS profile, certain types of TCP connections will fail. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
- Product
- Big-ip Advanced Firewall Manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.f5.comsupport.f5.com
Jan 24, 2022Cookie Notification Plugin for: Does not sanitise or escape the id GET parameter before using it in a SQL statementCVE-2021-24858 · WordPress plugins & themes · reported by WPScanHigh 7.2
The Cookie Notification Plugin for WordPress plugin before 1.0.9 does not sanitise or escape the id GET parameter before using it in a SQL statement, when retrieving the setting to edit in the admin dashboard, leading to an authenticated SQL Injection
- Product
- Cookie Notification Plugin for
- Fixed in
- 1.0.9
- What to do
- Update Cookie Notification Plugin for to 1.0.9 or newer.
Jan 21, 2022Sensitive endpoints in Fresenius Kabi Agilia Link+ v3.0 and prior can be accessed without any authentication information such as the session cookie.CVE-2021-23233 · Other software · Fresenius Kabi · reported by ics-cert@hq.dhs.govHigh 7.3
Sensitive endpoints in Fresenius Kabi Agilia Link+ v3.0 and prior can be accessed without any authentication information such as the session cookie. An attacker can send requests to sensitive endpoints as an unauthenticated user to perform critical actions or modify critical configuration parameters.
- Product
- Agilia Link+
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 6, 2022In Vehicle Service Management System 1.0 an attacker can steal the cookies leading to Full Account Takeover.CVE-2021-46067 · Other software · Vehicle Service Management System Project · reported by MITRECritical 9.8
In Vehicle Service Management System 1.0 an attacker can steal the cookies leading to Full Account Takeover.
- Product
- Vehicle Service Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 1, 2022CGI::Cookie.parse in Ruby through 2.6.8 mishandles security prefixes in cookie names.CVE-2021-41819 · Other software · Ruby-lang · reported by MITREHigh 7.5
CGI::Cookie.parse in Ruby through 2.6.8 mishandles security prefixes in cookie names. This also affects the CGI gem through 0.3.0 for Ruby.
- Product
- CGI
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordhackerone.comlists.fedoraproject.org
Dec 21, 2021Mesa Labs AmegaView Versions 3.0 uses default cookies that could be set to bypass authentication to the web application, which may allow an attacker to gain accCVE-2021-27453 · Other software · Mesa Labs · reported by ics-cert@hq.dhs.govHigh 7.3
Mesa Labs AmegaView Versions 3.0 uses default cookies that could be set to bypass authentication to the web application, which may allow an attacker to gain access.
- Product
- AmegaView
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordus-cert.cisa.govus-cert.cisa.gov
Dec 21, 2021A cross-site scripting (XSS) vulnerability in the system bulletin component of WUZHI CMS v4.1.0 allows attackers to steal the admin's cookie.CVE-2020-19770 · Other software · Wuzhicms · reported by MITREMedium 5.4
A cross-site scripting (XSS) vulnerability in the system bulletin component of WUZHI CMS v4.1.0 allows attackers to steal the admin's cookie.
- Product
- Wuzhicms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 20, 2021Multiple Stored Authenticated Cross-Site Scripting (XSS) vulnerabilities were discovered in tarteaucitron.js – Cookies legislation & GDPR WordPress plugin (versCVE-2021-36889 · WordPress plugins & themes · reported by PatchstackLow 3.4
Multiple Stored Authenticated Cross-Site Scripting (XSS) vulnerabilities were discovered in tarteaucitron.js – Cookies legislation & GDPR WordPress plugin (versions <= 1.6).
- Affected
- up to 1.6
- What to do
- Affects up to 1.6. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.comwordpress.org
Dec 20, 2021Cross-Site Request Forgery (CSRF) vulnerability leading to Cross-Site Scripting (XSS) discovered in tarteaucitron.js – Cookies legislation & GDPR WordPress plugCVE-2021-36887 · WordPress plugins & themes · reported by PatchstackMedium 6.1
Cross-Site Request Forgery (CSRF) vulnerability leading to Cross-Site Scripting (XSS) discovered in tarteaucitron.js – Cookies legislation & GDPR WordPress plugin (versions <= 1.5.4), vulnerable parameters "tarteaucitronEmail" and "tarteaucitronPass".
- Affected
- up to 1.5.4
- What to do
- Affects up to 1.5.4. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.comwordpress.org
Dec 8, 2021PineApp - Mail Secure - Attacker sending a request to :/blocking.php?url=<script>alert(1)</script> and stealing cookies .CVE-2021-36720 · Other software · Cybonet · reported by cna@cyber.gov.ilMedium 6.1
PineApp - Mail Secure - Attacker sending a request to :/blocking.php?url=<script>alert(1)</script> and stealing cookies .
- Product
- PineApp - Mail Secure
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 19, 20214MOSAn GCB Doctor’s login page has improper validation of Cookie, which allows an unauthenticated remote attacker to bypass authentication by code injection in CVE-2021-42338 · Other software · 4MOSAn · reported by twcert@cert.org.twCritical 9.8
4MOSAn GCB Doctor’s login page has improper validation of Cookie, which allows an unauthenticated remote attacker to bypass authentication by code injection in cookie, and arbitrarily manipulate the system or interrupt services by upload and execution of arbitrary files.
- Product
- GCB Doctor
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtwcert.org.twtwcert.org.tw
Nov 15, 2021IBM Tivoli Key Lifecycle Manager 3.0, 3.0.1, 4.0, and 4.1 does not set the secure attribute on authorization tokens or session cookies.CVE-2021-38977 · Other software · IBM · reported by psirt@us.ibm.comMedium 4.3
IBM Tivoli Key Lifecycle Manager 3.0, 3.0.1, 4.0, and 4.1 does not set the secure attribute on authorization tokens or session cookies. Attackers may be able to get the cookie values by sending a http:// link to a user or by planting this link in a site the user goes to. The cookie will be sent to the insecure link and the attacker can then obtain the cookie value by snooping the traffic. IBM X-Force ID: 212782.
- Product
- Security Key Lifecycle Manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexchange.xforce.ibmcloud.comibm.com
Nov 15, 2021This vulnerability could allow an attacker to send malicious Javascript code resulting in hijacking of the user’s cookie/session tokens, redirecting the user toCVE-2021-42703 · Other software · Advantech · reported by ics-cert@hq.dhs.govMedium 5.4
This vulnerability could allow an attacker to send malicious Javascript code resulting in hijacking of the user’s cookie/session tokens, redirecting the user to a malicious webpage, and performing unintended browser action.
- Product
- HMI Designer
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordus-cert.cisa.govus-cert.cisa.gov
Nov 5, 2021The affected product is vulnerable to cookie information being transmitted as cleartext over HTTP.CVE-2021-42699 · Other software · AzeoTech · reported by ics-cert@hq.dhs.govMedium 5.7
The affected product is vulnerable to cookie information being transmitted as cleartext over HTTP. An attacker can capture network traffic, obtain the user’s cookie and take over the account.
- Product
- DAQFactory
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordus-cert.cisa.govus-cert.cisa.gov
Oct 26, 2021The Secure flag is not set in the SSL Cookie of Kiwi Syslog Server 9.7.2 and previous versions.CVE-2021-35236 · Other software · SolarWinds · reported by psirt@solarwinds.comLow 3.1
The Secure flag is not set in the SSL Cookie of Kiwi Syslog Server 9.7.2 and previous versions. The Secure attribute tells the browser to only send the cookie if the request is being sent over a secure channel such as HTTPS. This will help protect the cookie from being passed over unencrypted requests. If the application can be accessed over both HTTP, there is a potential for the cookie can be sent in clear text.
- Product
- Kiwi Syslog Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocumentation.solarwinds.comsolarwinds.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.