581 matches found
PT-2020-7165
Name of the Vulnerable Software and Affected Versions IBM Tivoli Endpoint Manager version 8 Description The issue is related to the failure of setting the HttpOnly flag on cookies. This flag is a security feature that helps prevent cookies from being accessed by client-side scripts, thereby...
PT-2020-6880 · Abb · Esoms
Name of the Vulnerable Software and Affected Versions: ABB eSOMS versions 4.0 through 6.0.2 Description: The issue is related to the absence of the HttpOnly flag in session cookies, which can allow JavaScript to access the cookie contents. This might enable Cross Site Scripting XSS attacks, where...
CVE-2020-7050
Codologic Codoforum through 4.8.4 allows a DOM-based XSS. While creating a new topic as a normal user, it is possible to add a poll that is automatically loaded in the DOM once the thread/topic is opened. Because session cookies lack the HttpOnly flag, it is possible to steal authentication cooki...
CVE-2020-7050
Codologic Codoforum through 4.8.4 allows a DOM-based XSS. While creating a new topic as a normal user, it is possible to add a poll that is automatically loaded in the DOM once the thread/topic is opened. Because session cookies lack the HttpOnly flag, it is possible to steal authentication cooki...
CVE-2020-7050
Codologic Codoforum through 4.8.4 allows a DOM-based XSS. While creating a new topic as a normal user, it is possible to add a poll that is automatically loaded in the DOM once the thread/topic is opened. Because session cookies lack the HttpOnly flag, it is possible to steal authentication cooki...
CVE-2020-7051
Codologic Codoforum through 4.8.4 allows stored XSS in the login area. This is relevant in conjunction with CVE-2020-5842 because session cookies lack the HttpOnly flag. The impact is account takeover...
Cross site scripting
Codologic Codoforum through 4.8.4 allows stored XSS in the login area. This is relevant in conjunction with CVE-2020-5842 because session cookies lack the HttpOnly flag. The impact is account takeover...
CVE-2013-3636
ProjectPier 0.8.8 has a Remote Information Disclosure Weakness because of the lack of the HttpOnly cookie flag...
CVE-2019-19736: Incorrect Permission Assignment for Critical Resource
MFScripts YetiShare 3.5.2 through 4.5.3 does not set the HttpOnly flag on session cookies, allowing the cookie to be read by script, which can potentially be used by attackers to obtain the cookie via cross-site scripting...
PT-2019-15936
Name of the Vulnerable Software and Affected Versions MFScripts YetiShare versions 3.5.2 through 4.5.3 Description The issue allows attackers to potentially obtain session cookies via cross-site scripting, as the HttpOnly flag is not set on session cookies. This can be exploited by scripts to rea...
Security Bulletin: A cross site scripting security vulnerability has been identified with Case Builder component in IBM Case Manager (CVE-2019-4426)
Summary Case Builder component shipped in IBM Case Manager is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session...
Security Bulletin: A cross site scripting security vulnerability has been identified with Case Builder component shipped with IBM Business Automation Workflow (CVE-2019-4426)
Summary Case Builder component shipped with IBM Business Automation Workflow is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a...
IBM Operations Analytics-Log Analysis Information Disclosure Vulnerability
IBM Operations Analytics-Log Analysis is a set of semi-structured data analysis solutions from IBM USA. The product is mainly used for application log analysis and problem diagnosis and so on. An information disclosure vulnerability exists in IBM Operations Analytics-Log Analysis, which stems fro...
CVE-2019-17104
In Centreon VM through 19.04.3, the cookie configuration within the Apache HTTP Server does not protect against theft because the HTTPOnly flag is not set...
Code injection
In Centreon VM through 19.04.3, the cookie configuration within the Apache HTTP Server does not protect against theft because the HTTPOnly flag is not set...
CVE-2019-17104
In Centreon VM through 19.04.3, the cookie configuration within the Apache HTTP Server does not protect against theft because the HTTPOnly flag is not set...
CVE-2019-17104: Reliance on Cookies without Validation and Integrity Checking
In Centreon VM through 19.04.3, the cookie configuration within the Apache HTTP Server does not protect against theft because the HTTPOnly flag is not set...
PT-2019-4359
Name of the Vulnerable Software and Affected Versions Centreon VM versions prior to 19.04.3 Apache HTTP Server affected versions not specified Description The issue is related to errors in processing cookie files in the Apache HTTP Server within the Centreon VM. This can allow a remote attacker t...
LimeSurvey < 3.17.14 Multiple Vulnerabilities
LimeSurvey is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2019 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...