CWE-565

{
  "affected": [],
  "aliases": [
    "CVE-2021-33842"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-287",
      "CWE-565"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2021-06-09T12:15:00Z",
    "severity": "HIGH"
  },
  "details": "Improper Authentication vulnerability in the cookie parameter of Circutor SGE-PLC1000 firmware version 0.9.2b allows an attacker to perform operations as an authenticated user. In order to exploit this vulnerability, the attacker must be within the network where the device affected is located.",
  "id": "GHSA-vmhr-5qxj-xvcm",
  "modified": "2022-10-26T12:00:32Z",
  "published": "2022-05-24T19:04:40Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-33842"
    },
    {
      "type": "WEB",
      "url": "https://www.incibe-cert.es/en/early-warning/ics-advisories/circutor-sge-plc1000-improper-authentication"
    },
    {
      "type": "WEB",
      "url": "https://www.incibe.es/en/incibe-cert/notices/aviso-sci/circutor-sge-plc1000-improper-authentication"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2018-19224"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-565"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2018-11-12T20:29:00Z",
    "severity": "HIGH"
  },
  "details": "An issue was discovered in LAOBANCMS 2.0. /admin/login.php allows spoofing of the id and guanliyuan cookies.",
  "id": "GHSA-w2m4-xqg7-pfhg",
  "modified": "2022-05-13T01:19:45Z",
  "published": "2022-05-13T01:19:45Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-19224"
    },
    {
      "type": "WEB",
      "url": "https://github.com/AvaterXXX/laobanCMS/blob/master/1.md#unauthorized-access"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [
    {
      "package": {
        "ecosystem": "Packagist",
        "name": "react/http"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0.7.0"
            },
            {
              "fixed": "1.7.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2022-36032"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-20",
      "CWE-565"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2022-09-16T18:48:53Z",
    "nvd_published_at": "2022-09-06T19:15:00Z",
    "severity": "MODERATE"
  },
  "details": "### Impact\n\nIn ReactPHP\u0027s HTTP server component versions below v1.7.0, when ReactPHP is processing incoming HTTP cookie values, the cookie names are url-decoded. This may lead to cookies with prefixes like `__Host-` and `__Secure-` confused with cookies that decode to such prefix, thus leading to an attacker being able to forge cookie which is supposed to be secure. See also CVE-2020-7070 and CVE-2020-8184 for more information. \n\n### Patches\n\n* https://github.com/reactphp/http/commit/663c9a3b77b71463fa7fcb76a6676ffd16979dd6 - Fixed in [reactphp/http `v1.7.0`](https://github.com/reactphp/http/releases/tag/v1.7.0)\n\n### Workarounds\n\nInfrastructure or DevOps can place a reverse proxy in front of the ReactPHP HTTP server to filter out any unexpected `Cookie` request headers.\n\n### References\n\n* CVE-2020-7070, https://bugs.php.net/bug.php?id=79699 and https://github.com/php/php-src/commit/6559fe912661ca5ce5f0eeeb591d928451428ed0\n* CVE-2020-8184, https://hackerone.com/reports/895727 and https://github.com/rack/rack/commit/1f5763de6a9fe515ff84992b343d63c88104654c\n* Originally introduced via https://github.com/reactphp/http/pull/175\n\n### Credits\n\n* Thanks to Marco Squarcina (TU Wien) for reporting this and working with us to coordinate this security advisory\n\n### For more information\n\nIf you have any questions or comments about this advisory:\n\n* [Join the discussion](https://github.com/orgs/reactphp/discussions/465)\n* Email us at support@reactphp.org\n",
  "id": "GHSA-w3w9-vrf5-8mx8",
  "modified": "2022-09-16T18:48:53Z",
  "published": "2022-09-16T18:48:53Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/reactphp/http/security/advisories/GHSA-w3w9-vrf5-8mx8"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-36032"
    },
    {
      "type": "WEB",
      "url": "https://github.com/reactphp/http/pull/175"
    },
    {
      "type": "WEB",
      "url": "https://github.com/reactphp/http/commit/663c9a3b77b71463fa7fcb76a6676ffd16979dd6"
    },
    {
      "type": "WEB",
      "url": "https://github.com/FriendsOfPHP/security-advisories/blob/master/react/http/CVE-2022-36032.yaml"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/reactphp/http"
    },
    {
      "type": "WEB",
      "url": "https://github.com/reactphp/http/releases/tag/v1.7.0"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "ReactPHP\u0027s HTTP server parses encoded cookie names so malicious `__Host-` and `__Secure-` cookies can be sent"
}

{
  "affected": [],
  "aliases": [
    "CVE-2021-40642"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-565"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2022-06-29T11:15:00Z",
    "severity": "MODERATE"
  },
  "details": "Textpattern CMS v4.8.7 and older vulnerability exists through Sensitive Cookie in HTTPS Session Without \u0027Secure\u0027 Attribute via textpattern/lib/txplib_misc.php. The secure flag is not set for txp_login session cookie in the application. If the secure flag is not set, then the cookie will be transmitted in clear-text if the user visits any HTTP URLs within the cookie\u0027s scope. An attacker may be able to induce this event by feeding a user suitable links, either directly or via another web site.",
  "id": "GHSA-w43v-qr8x-xq75",
  "modified": "2022-07-08T00:00:43Z",
  "published": "2022-06-30T00:00:41Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-40642"
    },
    {
      "type": "WEB",
      "url": "https://github.com/textpattern/textpattern/commit/211fab0093999f59b0b61682aa988ac7d8337aa9"
    },
    {
      "type": "WEB",
      "url": "https://www.huntr.dev/bounties/aadbe434-a376-443b-876f-2a1cbab7847b"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2023-35885"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-565"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2023-06-20T20:15:09Z",
    "severity": "CRITICAL"
  },
  "details": "CloudPanel 2 before 2.3.1 has insecure file-manager cookie authentication.",
  "id": "GHSA-wmrx-g8f2-rgwh",
  "modified": "2024-04-04T04:59:06Z",
  "published": "2023-06-20T21:30:56Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-35885"
    },
    {
      "type": "WEB",
      "url": "https://github.com/datackmy/FallingSkies-CVE-2023-35885"
    },
    {
      "type": "WEB",
      "url": "https://www.cloudpanel.io/docs/v2/changelog"
    },
    {
      "type": "WEB",
      "url": "https://www.datack.my/fallingskies-cloudpanel-0-day"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2021-47706"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-565"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2025-12-09T21:15:49Z",
    "severity": "HIGH"
  },
  "details": "COMMAX Biometric Access Control System 1.0.0 contains an authentication bypass vulnerability that allows unauthenticated attackers to access sensitive information and circumvent physical controls in smart homes and buildings by exploiting cookie poisoning. Attackers can forge cookies to bypass authentication and disclose sensitive information.",
  "id": "GHSA-wqx6-ghvg-724j",
  "modified": "2025-12-09T21:31:49Z",
  "published": "2025-12-09T21:31:48Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-47706"
    },
    {
      "type": "WEB",
      "url": "https://www.commax.com"
    },
    {
      "type": "WEB",
      "url": "https://www.commax.com/product"
    },
    {
      "type": "WEB",
      "url": "https://www.exploit-db.com/exploits/50206"
    },
    {
      "type": "WEB",
      "url": "https://www.vulncheck.com/advisories/commax-biometric-access-control-system-authentication-bypass"
    },
    {
      "type": "WEB",
      "url": "https://www.zeroscience.mk/en/vulnerabilities/ZSL-2021-5661.php"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
      "type": "CVSS_V4"
    }
  ]
}

{
  "affected": [
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 0.23.34"
      },
      "package": {
        "ecosystem": "Maven",
        "name": "org.http4s:http4s-client_2.12"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "0.23.35"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 0.23.34"
      },
      "package": {
        "ecosystem": "Maven",
        "name": "org.http4s:http4s-client_2.13"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "0.23.35"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 1.0.0-M46"
      },
      "package": {
        "ecosystem": "Maven",
        "name": "org.http4s:http4s-client_2.13"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "1.0.0-M1"
            },
            {
              "fixed": "1.0.0-M47"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 1.0.0-M46"
      },
      "package": {
        "ecosystem": "Maven",
        "name": "org.http4s:http4s-client_3"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "1.0.0-M1"
            },
            {
              "fixed": "1.0.0-M47"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 0.23.34"
      },
      "package": {
        "ecosystem": "Maven",
        "name": "org.http4s:http4s-client_3"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "0.23.35"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-69214"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-384",
      "CWE-565"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-09-15T20:00:43Z",
    "nvd_published_at": null,
    "severity": "MODERATE"
  },
  "details": "When processing a `Set-Cookie` from a response, the `CookieJar` client middleware trusts the server-supplied `Domain` attribute verbatim, with no check that it domain-matches the host that sent the cookie (RFC6265 \u00a75.3 step 6) and no public suffix check.  A malicious or compromised server can therefore plant a cookie for any domain in the cookie jar, which is subsequently set on the client\u0027s next request to that victim domain, enabling session fixation or overwriting security-relevant cookies.\n\n## Impact\n\nSession fixation and overwrite of security-relevant cookies for arbitrary domains contacted by the same wrapped client.\n\n## Preconditions\n\n- Application uses the `CookieJar` client middleware.\n- Application contacts an attacker-controlled (or compromised) server using the same jar it uses for trusted hosts.\n\n## Workarounds\n\n- Do not share a `CookieJar` across trusted and untrusted targets.\n\n## Note\n\nThis middleware still does not implement public suffix rejection.",
  "id": "GHSA-wv64-j4fq-5f9x",
  "modified": "2026-09-15T20:00:44Z",
  "published": "2026-09-15T20:00:43Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/http4s/http4s/security/advisories/GHSA-wv64-j4fq-5f9x"
    },
    {
      "type": "WEB",
      "url": "https://github.com/http4s/http4s/commit/87535f7288f3baaf6736e2735087e473762b5b2f"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/http4s/http4s"
    },
    {
      "type": "WEB",
      "url": "https://github.com/http4s/http4s/releases/tag/v0.23.35"
    },
    {
      "type": "WEB",
      "url": "https://github.com/http4s/http4s/releases/tag/v1.0.0-M47"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:H/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Http4s: CookieJar middleware accepts arbitrary Set-Cookie domain"
}

{
  "affected": [],
  "aliases": [
    "CVE-2021-20450"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-565"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2024-05-03T17:15:07Z",
    "severity": "MODERATE"
  },
  "details": "IBM Cognos Controller 10.4.1, 10.4.2, and 11.0.0 does not set the secure attribute on authorization tokens or session cookies. Attackers may be able to get the cookie values by sending a http:// link to a user or by planting this link in a site the user goes to. The cookie will be sent to the insecure link and the attacker can then obtain the cookie value by snooping the traffic.  IBM X-Force ID:  196640.",
  "id": "GHSA-wvrv-rpq3-gjq6",
  "modified": "2024-05-03T18:30:37Z",
  "published": "2024-05-03T18:30:37Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-20450"
    },
    {
      "type": "WEB",
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/196640"
    },
    {
      "type": "WEB",
      "url": "https://www.ibm.com/support/pages/node/7149876"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2020-37007"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-352",
      "CWE-565"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-01-29T15:16:07Z",
    "severity": "MODERATE"
  },
  "details": "Liman 0.7 contains a cross-site request forgery vulnerability that allows attackers to manipulate user account settings without proper request validation. Attackers can craft malicious HTML forms to change user passwords or modify account information by tricking logged-in users into submitting unauthorized requests.",
  "id": "GHSA-wx76-4vvv-7j37",
  "modified": "2026-01-29T15:30:28Z",
  "published": "2026-01-29T15:30:28Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-37007"
    },
    {
      "type": "WEB",
      "url": "https://web.archive.org/web/20201109042653/https://github.com/salihciftci/liman"
    },
    {
      "type": "WEB",
      "url": "https://www.exploit-db.com/exploits/48869"
    },
    {
      "type": "WEB",
      "url": "https://www.vulncheck.com/advisories/liman-cross-site-request-forgery-change-password"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
      "type": "CVSS_V4"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2024-9820"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-565",
      "CWE-784"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2024-10-15T02:15:03Z",
    "severity": "MODERATE"
  },
  "details": "The WP 2FA with Telegram plugin for WordPress is vulnerable to Two-Factor Authentication Bypass in versions up to, and including, 3.0. This is due to the two-factor code being stored in a cookie, which makes it possible to bypass two-factor authentication.",
  "id": "GHSA-x23h-whff-jxq7",
  "modified": "2024-10-15T03:30:42Z",
  "published": "2024-10-15T03:30:42Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-9820"
    },
    {
      "type": "WEB",
      "url": "https://plugins.trac.wordpress.org/browser/two-factor-login-telegram/tags/3.0/includes/class-wp-factor-telegram-plugin.php#L228"
    },
    {
      "type": "WEB",
      "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/ccd73030-7185-4302-b3fd-29cbbe716e3e?source=cve"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N",
      "type": "CVSS_V3"
    }
  ]
}