Scanguard versions through 2019-11-12 on Windows has insecure permissions for the installation directory, leading to privilege escalation via a trojan horse executable file.

VLC for iOS was vulnerable to an unauthenticated insecure direct object reference vulnerability allowing for an attacker to compromise media. This issue was patched in the March, 2020 release.

XMB - eXtreme Message Board version 1.9.11.13 suffers from weak crypto and insecure password storage vulnerabilities.

UPLoad version 7.0 suffers from an insecure cookie handling vulnerability.

Newbie CMS suffers from an insecure cookie handling vulnerability.

CuteNews version 1.4.6 suffers from an insecure cookie handling vulnerability.

Islamic Voice suffers from an insecure cookie handling vulnerability.

Denapars Shop Script suffers from administrative bypass, shell upload, and insecure cookie handling vulnerabilities.

velBox version 1.2 suffers from an insecure cookie handling vulnerability.

Memorial Web Site Script suffers from password reset and insecure cookie handling vulnerabilities.

[whem]-UPLoad version 7.0 suffers from an insecure cookie handling vulnerability.

My Book suffers from an insecure cookie handling vulnerability.

AV Arcade version 3 suffers from insecure cookie and SQL injection vulnerabilities.

Open Cart version 0.6.5 suffers from an insecure cookie handling vulnerability.

Tornado version 1.0 suffers from an insecure cookie vulnerability.

Aleza Portal version 1.6 suffers from an insecure cookie handling vulnerability that allows for SQL injection.

xWeblog version 2.2 suffers from an insecure cookie handling vulnerability.

PHP Hosting Directory version 2.0 suffers from an insecure cookie vulnerability that allows for administrative bypass.

WikiWebHelp version 0.3.3 suffers from an insecure cookie handling vulnerability.

Babil CMS suffers from an insecure cookie handling vulnerability.

web.go suffers from an insecure cookie vulnerability. Their cookie is modeled after Tornado which had the same issue reported on in 2010.

PHPDirector version 0.30 suffers from an insecure cookie handling vulnerability that allows for privilege escalation.

Paddelberg Topsite Script version 1.2.3 suffers from an authentication bypass vulnerability due to insecure cookie handling.

ResourceSpace suffers from cross site scripting, html injection, insecure cookie handling, and remote SQL injection vulnerabilities. Versions 6.4.5976 and below are affected.

Totaljs CMS version 12.0 mints an insecure cookie that can be used to crack the administrator password.

Neowise CarbonFTP version 1.4 suffers from an insecure proprietary password encryption implementation. Second version of this exploit that is updated to work with Python 3.

Linux versions 5.3 and above appear to have an issue where io_uring suffers from insecure handling of the root directory for path lookups.

Juniper Secure Access suffers from a cross site scripting vulnerability. SA Appliances running Juniper IVE OS 6.0 or higher are affected.

Juniper Secure Access software suffers from a reflective cross site scripting vulnerability.

Certain Secure Access SA Series SSL VPN products (originally developed by Juniper Networks but now sold and supported by Pulse Secure, LLC) allow privilege escalation, as demonstrated by Secure Access SSL VPN SA-4000 5.1R5 (build 9627) 4.2 Release (build 7631). This occurs because appropriate controls are not performed.

Whitepaper called DevSecOps: A Secure Approach.

QRadar Community Edition version 7.3.1.6 suffers from a local privilege escalation due to insecure file permissions with run-result-reader.sh.

Cisco AnyConnect Secure Mobility Client for Windows version 4.8.01090 suffer from a privilege escalation vulnerability due to insecure handling of path names.

SolarWinds MSP PME Cache Service versions prior to 1.1.15 suffer from insecure file permission and code execution vulnerabilities.

Max Secure Anti Virus Plus version 19.0.4.020 suffers from an insecure permission vulnerability.

This Metasploit module exploits a command injection vulnerability in Imperva SecureSphere version 13.x. The vulnerability exists in the PWS service, where Python CGIs did not properly sanitize user supplied command parameters and directly passes them to corresponding CLI utility, leading to command injection. Agent registration credential is required to exploit SecureSphere in gateway mode. This module was successfully tested on Imperva SecureSphere 13.0/13.1/13.2 in pre-ftl mode and unsealed gateway mode.

Last week, the Hawaiian Electric Companies began Hawai‘i’s largest procurement effort for renewable energy resources to end the use of coal and reduce reliance on imported oil for power generation, moving the state closer to its goal of using 100 percent renewable energy by 2045.