CVE-2021-40642

Textpattern CMS v4.8.7 and older vulnerability exists through Sensitive Cookie in HTTPS Session Without 'Secure' Attribute via textpattern/lib/txplib_misc.php. The secure flag is not set for txp_login session cookie in the application. If the secure flag is not set, then the cookie will be transmitted in clear-text if the user visits any HTTP URLs within the cookie's scope. An attacker may be able to induce this event by feeding a user suitable links, either directly or via another web site.

• CWE-311

• https://github.com/textpattern/textpattern/commit/211fab0093999f59b0b61682aa988ac7d8337aa9Patch, Third Party Advisory
• https://www.huntr.dev/bounties/aadbe434-a376-443b-876f-2a1cbab7847b/Permissions Required, Third Party Advisory
• https://github.com/textpattern/textpattern/commit/211fab0093999f59b0b61682aa988ac7d8337aa9Patch, Third Party Advisory
• https://www.huntr.dev/bounties/aadbe434-a376-443b-876f-2a1cbab7847b/Permissions Required, Third Party Advisory

Published

Jun 29, 2022

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2021-40633A memory leak (out-of-memory) in gif2rgb in util/gif2rgb.c i…8.8
• CVE-2021-40635OS4ED openSIS 8.0 is affected by SQL injection in ChooseCpSe…7.5
• CVE-2021-40636OS4ED openSIS 8.0 is affected by SQL Injection in CheckDupli…7.5
• CVE-2021-40637OS4ED openSIS 8.0 is affected by cross-site scripting (XSS) …6.1
• CVE-2021-40639Improper access control in Jfinal CMS 5.1.0 allows attackers…7.5
• CVE-2021-4064Use after free in screen capture in Google Chrome on ChromeO…8.8
• CVE-2021-40643EyesOfNetwork before 07-07-2021 has a Remote Code Execution …9.8
• CVE-2021-40644An SQL Injection vulnerability exists in oasys oa_system as …6.5
• CVE-2021-40645An SQL Injection vulnerability exists in glorylion JFinalOA …6.5
• CVE-2021-40647In man2html 1.6g, a specific string being read in from a fil…5.5
• CVE-2021-40648In man2html 1.6g, a filename can be created to overwrite the…5.5
• CVE-2021-40649In Connx Version 6.2.0.1269 (20210623), a cookie can be issu…6.5