CVE-2025-4035

MEDIUM Year: 2025
CVSS v3 Score
4.3
Medium
Weakness Type
CWE-178
View all →

Vulnerability Description

A flaw was found in libsoup. When handling cookies, libsoup clients mistakenly allow cookies to be set for public suffix domains if the domain contains at least two components and includes an uppercase character. This bypasses public suffix protections and could allow a malicious website to set cookies for domains it does not own, potentially leading to integrity issues such as session fixation.

Related Vulnerabilities

CVE-2024-38829

LOW
CVSS:3.7(Low)

A vulnerability in Spring LDAP allows data exposure for case sensitive comparisons.This issue affects Spring LDAP: from 2.4.0 through 2.4.3, from 3.0.0 through 3.0.9, from 3.1.0 through 3.1.7, from 3....

CWE-1782024

CVE-2024-32879

MEDIUM
CVSS:4.9(Medium)

Python Social Auth is a social authentication/registration mechanism. Prior to version 5.4.1, due to default case-insensitive collation in MySQL or MariaDB databases, third-party authentication user I...

CWE-1782024

CVE-2021-0973

MEDIUM
CVSS:5.0(Medium)

In isFileUri of UriUtil.java, there is a possible way to bypass ignoring file://URI attachment due to improper handling of case sensitivity. This could lead to local information disclosure with no add...

CWE-1782021

CVE-2018-8337

MEDIUM
CVSS:5.3(Medium)

A security feature bypass vulnerability exists when Windows Subsystem for Linux improperly handles case sensitivity, aka "Windows Subsystem for Linux Security Feature Bypass Vulnerability." This affec...

CWE-1782018

CVE-2022-22968

MEDIUM
CVSS:5.3(Medium)

In Spring Framework versions 5.3.0 - 5.3.18, 5.2.0 - 5.2.20, and older unsupported versions, the patterns for disallowedFields on a DataBinder are case sensitive which means a field is not effectively...

CWE-1782022

CVE-2024-38820

MEDIUM
CVSS:5.3(Medium)

The fix for CVE-2022-22968 made disallowedFields patterns in DataBinder case insensitive. However, String.toLowerCase() has some Locale dependent exceptions that could potentially result in fields not...

CWE-1782024