https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sat, 03 Oct 2026 08:40:29 +0000 https://cve.radiocsirt.org/vuln/certfr-2024-avi-0958 certfr-2024-avi-0958 https://cve.radiocsirt.org/vuln/certfr-2024-avi-0958 https://cve.radiocsirt.org/vuln/cleanstart-2026-nq54168 <p><strong>Affected:</strong> CleanStart: argo-workflows</p> <p>Security vulnerability affects the argo-workflows package. This issue is resolved in later releases. See references for vulnerability details.</p> <p><strong>Affected:</strong> CleanStart: argo-workflows</p> <p>Security vulnerability affects the argo-workflows package. This issue is resolved in later releases. See references for vulnerability details.</p> https://cve.radiocsirt.org/vuln/cleanstart-2026-nq54168 https://cve.radiocsirt.org/vuln/euvd-2026-193015 EUVD-2026-193015 https://cve.radiocsirt.org/vuln/euvd-2026-193015 https://cve.radiocsirt.org/vuln/fkie_cve-2024-47764 <p>cookie is a basic HTTP cookie parser and serializer for HTTP servers. The cookie name could be used to set other fields of the cookie, resulting in an unexpected cookie value. A similar escape can be used for path and domain, which could be abused to alter other fields of the cookie. Upgrade to 0.7.0, which updates the validation for name, path, and domain.</p> <p>cookie is a basic HTTP cookie parser and serializer for HTTP servers. The cookie name could be used to set other fields of the cookie, resulting in an unexpected cookie value. A similar escape can be used for path and domain, which could be abused to alter other fields of the cookie. Upgrade to 0.7.0, which updates the validation for name, path, and domain.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2024-47764 https://cve.radiocsirt.org/vuln/ghsa-pxg6-pf52-xh8x <p><strong>Affected:</strong> npm: cookie</p> <p>### Impact</p> <p>The cookie name could be used to set other fields of the cookie, resulting in an unexpected cookie value. For example, `serialize(&#34;userName=&lt;script&gt;alert(&#39;XSS3&#39;)&lt;/script&gt;; Max-Age=2592000; a&#34;, value)` would result in `&#34;userName=&lt;script&gt;alert(&#39;XSS3&#39;)&lt;/script&gt;; Max-Age=2592000; a=test&#34;`, setting `userName` cookie to `&lt;script&gt;` and ignoring `value`.</p> <p>A similar escape can be used for `path` and `domain`, which could be abused to alter other fields of the cookie.</p> <p>### Patches</p> <p>Upgrade to 0.7.0, which updates the validation for `name`, `path`, and `domain`.</p> <p>### Workarounds</p> <p>Avoid passing untrusted or arbitrary values for these fields, ensure they are set by the application instead of user input.</p> <p>### References</p> <p>* https://github.com/jshttp/cookie/pull/167</p> <p><strong>Affected:</strong> npm: cookie</p> <p>### Impact</p> <p>The cookie name could be used to set other fields of the cookie, resulting in an unexpected cookie value. For example, `serialize(&#34;userName=&lt;script&gt;alert(&#39;XSS3&#39;)&lt;/script&gt;; Max-Age=2592000; a&#34;, value)` would result in `&#34;userName=&lt;script&gt;alert(&#39;XSS3&#39;)&lt;/script&gt;; Max-Age=2592000; a=test&#34;`, setting `userName` cookie to `&lt;script&gt;` and ignoring `value`.</p> <p>A similar escape can be used for `path` and `domain`, which could be abused to alter other fields of the cookie.</p> <p>### Patches</p> <p>Upgrade to 0.7.0, which updates the validation for `name`, `path`, and `domain`.</p> <p>### Workarounds</p> <p>Avoid passing untrusted or arbitrary values for these fields, ensure they are set by the application instead of user input.</p> <p>### References</p> <p>* https://github.com/jshttp/cookie/pull/167</p> https://cve.radiocsirt.org/vuln/ghsa-pxg6-pf52-xh8x https://cve.radiocsirt.org/vuln/msrc_cve-2024-47764 msrc_CVE-2024-47764 https://cve.radiocsirt.org/vuln/msrc_cve-2024-47764 https://cve.radiocsirt.org/vuln/ubuntu-cve-2024-47764 <p><strong>Affected:</strong> Ubuntu:16.04:LTS: node-cookie, Ubuntu:18.04:LTS: node-cookie, Ubuntu:20.04:LTS: node-cookie, Ubuntu:22.04:LTS: node-cookie, Ubuntu:24.04:LTS: node-cookie</p> <p>cookie is a basic HTTP cookie parser and serializer for HTTP servers. The cookie name could be used to set other fields of the cookie, resulting in an unexpected cookie value. A similar escape can be used for path and domain, which could be abused to alter other fields of the cookie. Upgrade to 0.7.0, which updates the validation for name, path, and domain.</p> <p><strong>Affected:</strong> Ubuntu:16.04:LTS: node-cookie, Ubuntu:18.04:LTS: node-cookie, Ubuntu:20.04:LTS: node-cookie, Ubuntu:22.04:LTS: node-cookie, Ubuntu:24.04:LTS: node-cookie</p> <p>cookie is a basic HTTP cookie parser and serializer for HTTP servers. The cookie name could be used to set other fields of the cookie, resulting in an unexpected cookie value. A similar escape can be used for path and domain, which could be abused to alter other fields of the cookie. Upgrade to 0.7.0, which updates the validation for name, path, and domain.</p> https://cve.radiocsirt.org/vuln/ubuntu-cve-2024-47764 https://cve.radiocsirt.org/vuln/wid-sec-w-2025-0034 <p>Ein entfernter, anonymer Angreifer kann eine Schwachstelle in IBM App Connect Enterprise ausnutzen, um Sicherheitsvorkehrungen zu umgehen.</p> <p>Ein entfernter, anonymer Angreifer kann eine Schwachstelle in IBM App Connect Enterprise ausnutzen, um Sicherheitsvorkehrungen zu umgehen.</p> https://cve.radiocsirt.org/vuln/wid-sec-w-2025-0034