CWE-1004

{
  "affected": [],
  "aliases": [
    "CVE-2025-27223"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-1004"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2025-10-27T17:15:37Z",
    "severity": "HIGH"
  },
  "details": "TRUfusion Enterprise through 7.10.4.0 exposes the encrypted COOKIEID as an authentication mechanism for some endpoints such as /trufusionPortal/getProjectList. However, the application uses a static key to create the encrypted cookie, ultimately allowing anyone to forge cookies and gain access to sensitive internal information.",
  "id": "GHSA-x7xc-36fh-7mvr",
  "modified": "2025-10-28T15:30:42Z",
  "published": "2025-10-27T18:31:12Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-27223"
    },
    {
      "type": "WEB",
      "url": "https://github.com/MrTuxracer/advisories/blob/master/CVEs/CVE-2025-27223.txt"
    },
    {
      "type": "WEB",
      "url": "https://www.rcesecurity.com/2025/09/when-audits-fail-four-critical-pre-auth-vulnerabilities-in-trufusion-enterprise"
    },
    {
      "type": "WEB",
      "url": "https://www.rocketsoftware.com/products/rocket-b2b-supply-chain-integration/rocket-trufusion-enterprise"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2022-4630"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-1004",
      "CWE-732"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2022-12-21T18:15:00Z",
    "severity": "MODERATE"
  },
  "details": "Sensitive Cookie Without \u0027HttpOnly\u0027 Flag in GitHub repository lirantal/daloradius prior to master.",
  "id": "GHSA-xj56-q6pv-vrx6",
  "modified": "2022-12-28T21:30:22Z",
  "published": "2022-12-21T18:30:22Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-4630"
    },
    {
      "type": "WEB",
      "url": "https://github.com/lirantal/daloradius/commit/6878619dc661b3009429777a1aeeb383ddc0166b"
    },
    {
      "type": "WEB",
      "url": "https://huntr.dev/bounties/401661ee-40e6-4ee3-a925-3716b96ece5c"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2023-2876"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-1004",
      "CWE-732"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2023-06-13T04:15:10Z",
    "severity": "MODERATE"
  },
  "details": "Sensitive Cookie Without \u0027HttpOnly\u0027 Flag vulnerability in ABB REX640 PCL1 (firmware modules), ABB REX640 PCL2 (Firmware modules), ABB REX640 PCL3 (firmware modules) allows Cross-Site Scripting (XSS).This issue affects REX640 PCL1: from 1.0;0 before 1.0.8; REX640 PCL2: from 1.0;0 before 1.1.4; REX640 PCL3: from 1.0;0 before 1.2.1.\n\n",
  "id": "GHSA-xxww-73xw-x3fj",
  "modified": "2024-04-04T04:45:06Z",
  "published": "2023-06-13T06:30:14Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-2876"
    },
    {
      "type": "WEB",
      "url": "https://search.abb.com/library/Download.aspx?DocumentID=2NGA001423\u0026LanguageCode=en\u0026DocumentPartId=\u0026Action=Launch"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N",
      "type": "CVSS_V3"
    }
  ]
}