Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
1,566 results · page 29 of 32
Mar 19, 2006admin.php in Himpfen Consulting Company PHP SimpleNEWS 1.0.0 allows remote attackers to bypass authentication by setting the admin parameter in a cookie.CVE-2006-1276 · Other software · Himpfen Consulting · reported by MITREHigh 10
admin.php in Himpfen Consulting Company PHP SimpleNEWS 1.0.0 allows remote attackers to bypass authentication by setting the admin parameter in a cookie.
- Product
- PHP Simplenews
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 9, 2006SQL injection vulnerability in D2KBlog 1.0.3 and earlier allows remote attackers to execute arbitrary SQL commands via the memName parameter in a cookie.CVE-2006-1123 · Other software · D2ksoft · reported by MITREHigh 10
SQL injection vulnerability in D2KBlog 1.0.3 and earlier allows remote attackers to execute arbitrary SQL commands via the memName parameter in a cookie.
- Product
- D2kblog
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecunia.comsecurityreason.com
Mar 2, 2006SQL injection vulnerability in vuBB 0.2 allows remote attackers to execute arbitrary SQL commands via the pass parameter in a cookie.CVE-2006-0962 · Other software · Vubb · reported by MITREHigh 7.5
SQL injection vulnerability in vuBB 0.2 allows remote attackers to execute arbitrary SQL commands via the pass parameter in a cookie.
- Product
- Vubb
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecunia.comsecurityfocus.com
Feb 28, 2006Archangel Weblog 0.90.02 allows remote attackers to bypass authentication by setting the ba_admin cookie to 1.CVE-2006-0944 · Other software · Archangelmgt · reported by MITREHigh 7.5
Archangel Weblog 0.90.02 allows remote attackers to bypass authentication by setting the ba_admin cookie to 1.
- Product
- Weblog
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecuritytracker.comosvdb.org
Feb 28, 2006Melange Chat Server (aka M-Chat), when accessed via a web browser, automatically sends cookies and other sensitive information for a server to any port specifieCVE-2006-0917 · Other software · Melange · reported by MITRELow 2.1
Melange Chat Server (aka M-Chat), when accessed via a web browser, automatically sends cookies and other sensitive information for a server to any port specified in the associated link, which allows local users on that server to read the cookies from HTTP headers and possibly gain sensitive information, such as credentials, by setting up a listening port and reading the credentials when the victim clicks on the link.
- Product
- Melange Chat System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecunia.comsecurityreason.com
Feb 23, 2006filescan in Global Hauri ViRobot 2.0 20050817 does not verify the Cookie HTTP header, which allows remote attackers to gain administrative privileges via an arbCVE-2006-0864 · Other software · Hauri · reported by MITREHigh 10
filescan in Global Hauri ViRobot 2.0 20050817 does not verify the Cookie HTTP header, which allows remote attackers to gain administrative privileges via an arbitrary cookie value.
- Product
- Virobot
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecunia.comsecuritytracker.com
Feb 13, 2006check.php in Hinton Design phpht Topsites 1.3 does not validate passwords when using cookies, which allows remote attackers to bypass authentication via unspeciCVE-2006-0654 · Other software · Hinton Design · reported by MITREHigh 7.5
check.php in Hinton Design phpht Topsites 1.3 does not validate passwords when using cookies, which allows remote attackers to bypass authentication via unspecified cookies.
- Product
- Phpht Topsites
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 8, 2006check.php in Hinton Design phphd 1.0 does not check passwords when certain cookies are provided, which allows remote attackers to bypass authentication.CVE-2006-0607 · Other software · Hinton Design · reported by MITREHigh 7.5
check.php in Hinton Design phphd 1.0 does not check passwords when certain cookies are provided, which allows remote attackers to bypass authentication.
- Product
- Phphd
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 8, 2006check.php in Hinton Design phphg Guestbook 1.2 does not check the user password when authenticating via cookies, which allows remote attackers to gain unauthoriCVE-2006-0604 · Other software · Hinton Design · reported by MITREHigh 7.5
check.php in Hinton Design phphg Guestbook 1.2 does not check the user password when authenticating via cookies, which allows remote attackers to gain unauthorized access.
- Product
- Phphg Guestbook
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 7, 2006phpstatus 1.0 does not require passwords when using cookies to identify a user, which allows remote attackers to bypass authentication.CVE-2006-0572 · Other software · Hinton Design · reported by MITREHigh 7.5
phpstatus 1.0 does not require passwords when using cookies to identify a user, which allows remote attackers to bypass authentication.
- Product
- Phpstatus
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 25, 2006claro_init_local.inc.php in Claroline 1.7.2 uses guessable session cookies (MD5 hash of connection time), which allows remote attackers to hijack sessions and pCVE-2006-0411 · Other software · Claroline · reported by MITREHigh 10
claro_init_local.inc.php in Claroline 1.7.2 uses guessable session cookies (MD5 hash of connection time), which allows remote attackers to hijack sessions and possibly gain administrative privileges.
- Product
- Claroline
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecunia.comsecurityfocus.com
Jan 13, 2006Multiple HTTP response splitting vulnerabilities in PHP 5.1.1 allow remote attackers to inject arbitrary HTTP headers via a crafted Set-Cookie header, related tCVE-2006-0207 · Websites & servers · PHP · reported by MITREMedium 5
Multiple HTTP response splitting vulnerabilities in PHP 5.1.1 allow remote attackers to inject arbitrary HTTP headers via a crafted Set-Cookie header, related to the (1) session extension (aka ext/session) and the (2) header function.
- Product
- PHP
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlists.suse.desecunia.com
Jan 12, 2006login.php in ACal Calendar Project 2.2.5 allows remote attackers to bypass authentication by setting the ACalAuthenticate cookie variable to "inside".CVE-2006-0182 · Other software · Acal · reported by MITREHigh 7.5
login.php in ACal Calendar Project 2.2.5 allows remote attackers to bypass authentication by setting the ACalAuthenticate cookie variable to "inside".
- Product
- Calendar Project
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 10, 2006427BB 2.2 and 2.2.1 verifies authentication credentials based on the username, authenticated, and usertype cookies, which allows remote attackers to bypass authCVE-2006-0153 · Other software · 427bb · reported by MITREHigh 7.5
427BB 2.2 and 2.2.1 verifies authentication credentials based on the username, authenticated, and usertype cookies, which allows remote attackers to bypass authentication by using a valid username and usertype and setting the authenticated cookie.
- Product
- Fourtwosevenbb
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 31, 2005login.php in PCXP/TOPPE CMS allows remote attackers to bypass authentication and gain privileges by modifying the cookie to match the target userid.CVE-2005-2464 · Other software · Pcxp Toppe CMS · reported by MITREHigh 7.5
login.php in PCXP/TOPPE CMS allows remote attackers to bypass authentication and gain privileges by modifying the cookie to match the target userid.
- Product
- Pcxp Toppe CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 31, 2005Unspecified vulnerability in mroovca stats (mroovcastats) before 0.4.5b has unknown attack vectors and impact, related to cookies.CVE-2005-4692 · Other software · Mroovca · reported by MITREHigh 7.5
Unspecified vulnerability in mroovca stats (mroovcastats) before 0.4.5b has unknown attack vectors and impact, related to cookies.
- Product
- Mroovca Stats
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsourceforge.netosvdb.org
Dec 31, 2005Six Apart Movable Type 3.16 stores account names and password hashes in a cookie, which allows remote attackers to login to an account by sniffing the cookie.CVE-2005-4689 · Other software · reported by MITREMedium 5
Six Apart Movable Type 3.16 stores account names and password hashes in a cookie, which allows remote attackers to login to an account by sniffing the cookie.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordarchives.neohapsis.comsixapart.com
Dec 31, 2005Firefox and Mozilla can associate a cookie with multiple domains when the DNS resolver has a non-root domain in its search list, which allows remote attackers tCVE-2005-4685 · Computers, phones & browsers · Mozilla · reported by MITREMedium 6.4
Firefox and Mozilla can associate a cookie with multiple domains when the DNS resolver has a non-root domain in its search list, which allows remote attackers to trick a user into accepting a cookie for a hostname formed via search-list expansion of the hostname entered by the user, or steal a cookie for an expanded hostname, as demonstrated by an attacker who operates an ap1.com Internet web site to steal cookies associated with an ap1.com.example.com intranet web site.
- Product
- Firefox
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordarchives.neohapsis.comsecurityfocus.com
Dec 31, 2005The Next action in PEAR HTML_QuickForm_Controller 1.0.4 includes the SID in the URL even when session.use_only_cookies is configured, which allows remote attackCVE-2005-4731 · Other software · The PHP Group · reported by MITREMedium 5
The Next action in PEAR HTML_QuickForm_Controller 1.0.4 includes the SID in the URL even when session.use_only_cookies is configured, which allows remote attackers to obtain the SID via an HTTP Referer field and possibly other vectors.
- Product
- Pear Html Quickform Controller
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpear.php.netpear.php.net
Dec 31, 2005Konqueror can associate a cookie with multiple domains when the DNS resolver has a non-root domain in its search list, which allows remote attackers to trick a CVE-2005-4684 · Other software · KDE · reported by MITREMedium 6.4
Konqueror can associate a cookie with multiple domains when the DNS resolver has a non-root domain in its search list, which allows remote attackers to trick a user into accepting a cookie for a hostname formed via search-list expansion of the hostname entered by the user, or steal a cookie for an expanded hostname, as demonstrated by an attacker who operates an ap1.com Internet web site to steal cookies associated with an ap1.com.example.com intranet web site.
- Product
- Konqueror
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordarchives.neohapsis.comsecurityfocus.com
Dec 14, 2005SQL injection vulnerability in mod.php in phpCOIN 1.2.2 allows remote attackers to execute arbitrary SQL commands via the phpcoinsessid cookie.CVE-2005-4213 · Other software · Coinsoft Technologies · reported by MITREHigh 7.5
SQL injection vulnerability in mod.php in phpCOIN 1.2.2 allows remote attackers to execute arbitrary SQL commands via the phpcoinsessid cookie.
- Product
- Phpcoin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordforums.phpcoin.comrgod.altervista.org
Nov 18, 2005Directory traversal vulnerability in GNU Gnump3d before 2.9.8 has unknown impact via "CGI parameters, and cookie values".CVE-2005-3355 · Other software · GNU · reported by Red HatMedium 6.4
Directory traversal vulnerability in GNU Gnump3d before 2.9.8 has unknown impact via "CGI parameters, and cookie values".
- Product
- Gnump3d
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecunia.comsecunia.com
Nov 3, 2005Ar-blog 5.2 and earlier allows remote attackers to bypass authentication by modifying cookies.CVE-2005-3495 · Other software · Ar-blog · reported by MITREHigh 7.5
Ar-blog 5.2 and earlier allows remote attackers to bypass authentication by modifying cookies.
- Product
- Ar-blog
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlists.grok.org.uksecunia.com
Nov 2, 2005Rockliffe MailSite Express before 6.1.22, with the option to save login information enabled, saves user passwords in plaintext in cookies, which allows local usCVE-2005-3429 · Other software · Rockliffe · reported by MITREMedium 4.3
Rockliffe MailSite Express before 6.1.22, with the option to save login information enabled, saves user passwords in plaintext in cookies, which allows local users to obtain passwords by reading the cookie file, or remote attackers to obtain the cookies via cross-site scripting (XSS) vulnerabilities.
- Product
- Mailsite Express
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordarchives.neohapsis.commarc.info
Nov 1, 2005phpBB 2.0.17 and earlier allows remote attackers to bypass protection mechanisms that deregister global variables by setting both a GET/POST/COOKIE (GPC) variabCVE-2005-3415 · Websites & servers · Phpbb Group · reported by MITREHigh 7.5
phpBB 2.0.17 and earlier allows remote attackers to bypass protection mechanisms that deregister global variables by setting both a GET/POST/COOKIE (GPC) variable and a GLOBALS[] variable with the same name, which causes phpBB to unset the GLOBALS[] variable but not the GPC variable.
- Product
- Phpbb
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 27, 2005SQL injection vulnerability in admin.php in SEO-Board 1.0.2 allows remote attackers to execute arbitrary SQL commands via the user_pass_sha1 value in a cookie.CVE-2005-3082 · Other software · reported by MITREHigh 7.5
SQL injection vulnerability in admin.php in SEO-Board 1.0.2 allows remote attackers to execute arbitrary SQL commands via the user_pass_sha1 value in a cookie.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordforum.ghc.ruforums.seo-board.com
Sep 14, 2005setcookie.php in PBLang 4.65, and possibly earlier versions, allows remote attackers to obtain sensitive information via a %00 (a null byte) in the u parameter,CVE-2005-2895 · Other software · Pblang · reported by MITREMedium 5
setcookie.php in PBLang 4.65, and possibly earlier versions, allows remote attackers to obtain sensitive information via a %00 (a null byte) in the u parameter, which reveals the path in an error message.
- Product
- Pblang
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmarc.infosecuritytracker.com
Sep 14, 2005Directory traversal vulnerability in setcookie.php in PBLang 4.65, and possibly earlier versions, allows remote attackers to read arbitrary files via ".." sequeCVE-2005-2892 · Other software · Pblang · reported by MITREMedium 5
Directory traversal vulnerability in setcookie.php in PBLang 4.65, and possibly earlier versions, allows remote attackers to read arbitrary files via ".." sequences and "%00" (trailing null byte) in the u parameter.
- Product
- Pblang
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 14, 2005Direct static code injection vulnerability in setcookie.php in PBLang 4.65, and possibly earlier versions, allows remote attackers to execute arbitrary PHP codeCVE-2005-2893 · Other software · Pblang · reported by MITREHigh 7.5
Direct static code injection vulnerability in setcookie.php in PBLang 4.65, and possibly earlier versions, allows remote attackers to execute arbitrary PHP code via the username (u parameter), which is directly injected into a file that is later executed upon login.
- Product
- Pblang
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 30, 2005SQL injection vulnerability in auth.php in PaFileDB 3.1, when authmethod is set to cookies, allows remote attackers to execute arbitrary SQL commands via the usCVE-2005-2723 · Websites & servers · PHP Arena · reported by MITREHigh 7.5
SQL injection vulnerability in auth.php in PaFileDB 3.1, when authmethod is set to cookies, allows remote attackers to execute arbitrary SQL commands via the username value in the pafiledbcookie cookie.
- Product
- Pafiledb
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 13, 2005PhpAuction 2.5 allows remote attackers to bypass authentication and gain privileges as another user by setting the PHPAUCTION_RM_ID cookie to the user ID.CVE-2005-2252 · Other software · Gianluca Baldo · reported by MITREHigh 7.5
PhpAuction 2.5 allows remote attackers to bypass authentication and gain privileges as another user by setting the PHPAUCTION_RM_ID cookie to the user ID.
- Product
- Phpauction
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecunia.comsecuritytracker.com
Jul 11, 2005eRoom does not set an expiration for Cookies, which allows remote attackers to capture cookies and conduct replay attacks.CVE-2005-2185 · Other software · EMC · reported by MITREHigh 7.5
eRoom does not set an expiration for Cookies, which allows remote attackers to capture cookies and conduct replay attacks.
- Product
- Eroom
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 6, 2005IMail stores usernames and passwords in cleartext in a cookie, which allows remote attackers to obtain sensitive information.CVE-2005-2160 · Other software · Ipswitch · reported by MITREHigh 7.5
IMail stores usernames and passwords in cleartext in a cookie, which allows remote attackers to obtain sensitive information.
- Product
- Imail
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 29, 2005Infopop UBB.Threads before 6.5.2 Beta allows remote attackers to include arbitrary files via the language parameter in a cookie followed by a null (%00) byte.CVE-2005-2061 · Other software · Ubbcentral · reported by MITREMedium 5
Infopop UBB.Threads before 6.5.2 Beta allows remote attackers to include arbitrary files via the language parameter in a cookie followed by a null (%00) byte.
- Product
- Ubb.threads
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 15, 2005Buffer overflow in addschup in HAURI ViRobot 2.0, and possibly other products, allows remote attackers to execute arbitrary code via a long ViRobot_ID cookie (HCVE-2005-2041 · Other software · Hauri · reported by MITREMedium 5
Buffer overflow in addschup in HAURI ViRobot 2.0, and possibly other products, allows remote attackers to execute arbitrary code via a long ViRobot_ID cookie (HTTP_COOKIE).
- Product
- Virobot Linux Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 24, 2005Cookie Cart allows remote attackers to read the Order Notification list via the testmycgi and path parameters to testmy.cgi.CVE-2005-1732 · Other software · Metro Marketing · reported by MITREMedium 5
Cookie Cart allows remote attackers to read the Order Notification list via the testmycgi and path parameters to testmy.cgi.
- Product
- Cookie Cart
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 24, 2005Cookie Cart stores the password file under the web document root with insufficient access control, which allows remote attackers to obtain usernames and encryptCVE-2005-1733 · Other software · Metro Marketing · reported by MITREMedium 5
Cookie Cart stores the password file under the web document root with insufficient access control, which allows remote attackers to obtain usernames and encrypted passwords via a direct request to passwd.txt.
- Product
- Cookie Cart
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmarc.infosecuritytracker.com
May 24, 2005The cluster cookie parsing code in BEA WebLogic Server 7.0 through Service Pack 5 attempts to contact any host or port specified in a cookie, even when it is noCVE-2005-1746 · Websites & servers · BEA · reported by MITREMedium 5
The cluster cookie parsing code in BEA WebLogic Server 7.0 through Service Pack 5 attempts to contact any host or port specified in a cookie, even when it is not in the cluster, which allows remote attackers to cause a denial of service (cluster slowdown) via modified cookies.
- Product
- Weblogic Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddev2dev.bea.comsecunia.com
May 16, 2005SQL injection vulnerability in Invision Power Board (IPB) 2.0.3 and earlier allows remote attackers to execute arbitrary SQL commands via a crafted cookie passwCVE-2005-1598 · Other software · Invision Power Services · reported by MITREHigh 7.5
SQL injection vulnerability in Invision Power Board (IPB) 2.0.3 and earlier allows remote attackers to execute arbitrary SQL commands via a crafted cookie password hash (pass_hash) that modifies the internal $pid variable.
- Product
- Invision Board
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordforums.invisionpower.commarc.info
May 11, 2005PwsPHP 1.2.2 allows remote attackers to bypass authentication and post arbitrary comments via the Pseudo cookie.CVE-2005-1511 · Other software · Pwsphp · reported by MITREHigh 7.5
PwsPHP 1.2.2 allows remote attackers to bypass authentication and post arbitrary comments via the Pseudo cookie.
- Product
- Pwsphp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 11, 2005The web module in Neteyes Nexusway allows remote attackers to bypass authentication and gain administrator privileges by setting the cyclone500_auth cookie.CVE-2005-1558 · Other software · Neteyes · reported by MITREHigh 7.5
The web module in Neteyes Nexusway allows remote attackers to bypass authentication and gain administrator privileges by setting the cyclone500_auth cookie.
- Product
- Nexusway
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordarchives.neohapsis.commarc.info
May 11, 2005ArticleLive 2005 allows remote attackers to gain privileges by modifying the (1) auth and (2) userId fields in a cookie.CVE-2005-1482 · Other software · Interspire · reported by MITREHigh 7.5
ArticleLive 2005 allows remote attackers to gain privileges by modifying the (1) auth and (2) userId fields in a cookie.
- Product
- Articlelive
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 3, 2005The confirm add-on in SmartList 3.15 and earlier allows attackers to subscribe arbitrary e-mail addresses by using a valid cookie that specifies an address otheCVE-2005-0157 · Other software · Smartlist · reported by MITREHigh 7.5
The confirm add-on in SmartList 3.15 and earlier allows attackers to subscribe arbitrary e-mail addresses by using a valid cookie that specifies an address other than the address for which the cookie was assigned.
- Product
- Smartlist
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 2, 2005inc_login_check.asp ACS Blog 0.8 through 1.1.3 allows remote attackers to gain administrator privileges via the "in" value in a cookie.CVE-2005-1288 · Other software · ASP Press · reported by MITREHigh 7.5
inc_login_check.asp ACS Blog 0.8 through 1.1.3 allows remote attackers to gain administrator privileges via the "in" value in a cookie.
- Product
- ACS Blog
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 2, 2005sessions.php in phpBB 2.0.12 and earlier allows remote attackers to gain administrator privileges via the autologinid value in a cookie.CVE-2005-0614 · Websites & servers · Phpbb Group · reported by MITREHigh 7.5
sessions.php in phpBB 2.0.12 and earlier allows remote attackers to gain administrator privileges via the autologinid value in a cookie.
- Product
- Phpbb
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 8, 2005Race condition in Squid 2.5.STABLE7 to 2.5.STABLE9, when using the Netscape Set-Cookie recommendations for handling cookies in caches, may cause Set-Cookie headCVE-2005-0626 · Other software · Squid · reported by Red HatLow 2.6
Race condition in Squid 2.5.STABLE7 to 2.5.STABLE9, when using the Netscape Set-Cookie recommendations for handling cookies in caches, may cause Set-Cookie headers to be sent to other users, which allows attackers to steal the related cookies.
- Product
- Squid
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordfedoranews.orgredhat.com
Mar 7, 2005The export_index action in myadmin.php for Aztek Forum 4.0 allows remote attackers to obtain database files, possibly by setting the ATK_ADMIN cookie.CVE-2005-0700 · Other software · Aztek Forum · reported by MITREMedium 5
The export_index action in myadmin.php for Aztek Forum 4.0 allows remote attackers to obtain database files, possibly by setting the ATK_ADMIN cookie.
- Product
- Aztek Forum
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordfrsirt.comsecurityfocus.com
Feb 15, 2005Thunderbird 0.6 through 0.9 and Mozilla 1.7 through 1.7.3 does not obey the network.cookie.disableCookieForMailNews preference, which could allow remote attackeCVE-2005-0149 · Computers, phones & browsers · Mozilla · reported by MITREMedium 5
Thunderbird 0.6 through 0.9 and Mozilla 1.7 through 1.7.3 does not obey the network.cookie.disableCookieForMailNews preference, which could allow remote attackers to bypass the user's intended privacy and security policy by using cookies in e-mail messages.
- Product
- Mozilla
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecunia.commozilla.org
Feb 14, 2005CitrusDB 0.3.6 and earlier generates easily predictable MD5 hashes of the user name for the id_hash cookie, which allows remote attackers to bypass authenticatiCVE-2005-0408 · Other software · Citrusdb · reported by MITRECritical 9.8
CitrusDB 0.3.6 and earlier generates easily predictable MD5 hashes of the user name for the id_hash cookie, which allows remote attackers to bypass authentication and gain privileges by calculating the MD5 checksum of the user name combined with the "boogaadeeboo" string, which is hard-coded in the $hidden_hash variable.
- Product
- Citrusdb
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlists.grok.org.ukredteam-pentesting.de
Dec 31, 2004SQL injection vulnerability in the valid function in fr_left.php in PlaySMS 0.7 and earlier allows remote attackers to modify SQL statements via the vc2 cookie.CVE-2004-2263 · Other software · Playsms · reported by MITREHigh 7.5
SQL injection vulnerability in the valid function in fr_left.php in PlaySMS 0.7 and earlier allows remote attackers to modify SQL statements via the vc2 cookie.
- Product
- Playsms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecuritytracker.comsourceforge.net
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.