CWE-565 Reliance on Cookies without Validation and Integrity Checking
baseThe product relies on the existence or values of cookies when performing security-critical operations, but it does not properly ensure that the setting is valid for the associated user.
01
übergeordnete Schwächen
Übergeordnete Klassen, zu denen dies gehört.
02
untergeordnete Schwächen
Spezifischere Einträge unterhalb dieses.
03
Schwachstellen (89)
Zugehörige CVEs.
| ID | Schweregrad | ausnutzbar | ||
|---|---|---|---|---|
| CVE-2026-0257US | critical9.1OT kritisch | KEV | ||
Authentication bypass vulnerabilities in the GlobalProtect portal and gateway of Palo Alto Networks PAN-OS® software allows the attacker to bypass security restrictions and establi… | ||||
| CVE-2023-35885US | critical9.8 | Exploit | ||
CloudPanel 2 before 2.3.1 has insecure file-manager cookie authentication. | ||||
| CVE-2008-5784US | critical9.8 | Exploit | ||
V3 Chat - Profiles/Dating Script 3.0.2 allows remote attackers to bypass authentication and gain administrative access by setting the admin cookie to 1. | ||||
| CVE-2026-39324US | critical9.8OT hoch | Exploit | ||
Rack::Session is a session management implementation for Rack. From 2.0.0 to before 2.1.2, Rack::Session::Cookie incorrectly handles decryption failures when configured with secret… | ||||
| CVE-2017-6896US | high8.8 | Exploit | ||
Privilege escalation vulnerability on the DIGISOL DG-HR1400 1.00.02 wireless router enables an attacker to escalate from user privilege to admin privilege just by modifying the Bas… | ||||
| CVE-2019-7266US | critical9.8 | — | ||
Linear eMerge 50P/5000P devices allow Authentication Bypass. | ||||
| CVE-2017-7279US | critical9.8 | — | ||
An unprivileged user of the Unitrends Enterprise Backup before 9.0.0 web server can escalate to root privileges by modifying the "token" cookie issued at login. | ||||
| CVE-2025-59247US | critical9.8 | — | ||
Azure PlayFab Elevation of Privilege Vulnerability | ||||
| CVE-2022-28113US | high7.2 | Exploit | ||
An issue in upload.csp of FANTEC GmbH MWiD25-DS Firmware v2.000.030 allows attackers to write files and reset the user passwords without having a valid session cookie. | ||||
| CVE-2018-20512US | critical9.8 | — | ||
EPON CPE-WiFi devices 2.0.4-X000 are vulnerable to escalation of privileges by sending cooLogin=1, cooUser=admin, and timestamp=-1 cookies. | ||||
| CVE-2018-5455US | critical9.8 | — | ||
A Reliance on Cookies without Validation and Integrity Checking issue was discovered in Moxa OnCell G3100-HSPA Series version 1.4 Build 16062919 and prior. The application allows a… | ||||
| CVE-2026-85181US | critical9.8 | — | ||
CAT uses Java String.hashCode as the sole integrity check for session cookies without server-side keying, allowing attackers to forge valid checksums offline. Attackers can set the… | ||||
| CVE-2023-41084US | critical9.8 | — | ||
Session management within the web application is incorrect and allows attackers to steal session cookies to perform a multitude of actions that the web app allows on the… | ||||
| CVE-2022-38297US | critical9.8 | — | ||
UCMS v1.6.0 contains an authentication bypass vulnerability which is exploited via cookie poisoning. | ||||
| CVE-2021-28171US | critical9.8 | — | ||
The Vangene deltaFlow E-platform does not take properly protective measures. Attackers can obtain privileged permissions remotely by tampering with users’ data in the Cookie. | ||||
| CVE-2018-5190US | critical9.8 | — | ||
PicturesPro Photo Cart 6 and 7 before Security-Patch-2018-B allows remote attackers to access arbitrary customer accounts via a modified cookie, related to pc_head.php, pc_login.ph… | ||||
| CVE-2022-22785US | critical9.1 | — | ||
The Zoom Client for Meetings (for Android, iOS, Linux, MacOS, and Windows) before version 5.10.0 failed to properly constrain client session cookies to Zoom domains. This issue cou… | ||||
| CVE-2012-5631US | high8.8 | — | ||
ipa 3.0 does not properly check server identity before sending credential containing cookies | ||||
| CVE-2023-32725US | high8.8 | — | ||
The website configured in the URL widget will receive a session cookie when testing or executing scheduled reports. The received session cookie can then be used to access the front… | ||||
| CVE-2023-45141US | high8.8 | — | ||
Fiber is an express inspired web framework written in Go. A Cross-Site Request Forgery (CSRF) vulnerability has been identified in the application, which allows an attacker to obta… | ||||
04
Angriffsmuster (3)
CAPEC-Angriffsmuster, die dies ausnutzen.
05
Quelle
Wo diese Definition veröffentlicht ist.
MITREUS
scry
Schwächen wie diese tauchen in realen, ausnutzbaren Angriffsflächen auf. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan