The vulnerability of the Apache Tomcat application server arises from the absence of the “Secure” flag in session cookie files. This allows attackers to access confidential information.

The vulnerability of the Apache Tomcat application server is related to the absence of the “Secure” flag in session cookie files. Exploiting this vulnerability can allow a remote attacker to gain access to confidential information...

The vulnerability of Mozilla Firefox, Firefox ESR, and the email client Thunderbird lies in the absence of a “Secure” flag in HTTPS session cookie files. This allows attackers to compromise the privacy and integrity of the protected information.

The vulnerability of Mozilla Firefox, Firefox ESR, and the email client Thunderbird lies in the absence of a “Secure” flag in the HTTPS session cookie files. Exploiting this vulnerability allows a remote attacker to compromise the confidentiality and integrity of the protected information...

The vulnerability in the web client of IBM Datacap Navigator software, which is used for collecting and processing documents with IBM Datacap, allows a perpetrator to compromise the confidentiality of the protected information.

The vulnerability of the IBM Datacap Navigator web client software for document collection and processing lies in the absence of a “Secure” flag in the session cookies. Exploiting this vulnerability could allow an attacker to compromise the confidentiality of the protected information...

Digisol DG-GR6821AC Router 安全漏洞

Digisol DG-GR6821AC Router is a WiFi router from Digisol India. A security vulnerability exists in the Digisol DG-GR6821AC Router, which stems from the session cookie not being configured with the Secure and HttpOnly flags, which could lead to a remote attacker obtaining sensitive information...

CVE-2022-38846

EspoCRM version 7.1.8 is vulnerable to Missing Secure Flag allowing the browser to send plain text cookies over an insecure channel HTTP. An attacker may capture the cookie from the insecure channel using MITM attack...

CVE-2021-29248

BTCPay Server through 1.0.7.0 could allow a remote attacker to obtain sensitive information, caused by failure to set the Secure flag for a cookie...

CVE-2020-27606

BigBlueButton before 2.2.28 or earlier does not set the secure flag for the session cookie in an https session, which makes it easier for remote attackers to capture this cookie by intercepting its transmission within an http session...

CVE-2020-14248

BigFix Inventory up to v10.0.2 does not set the secure flag for the session cookie in an https session, which can cause the cookie to be sent in http requests and make it easier for remote attackers to capture this cookie...

CVE-2019-19090

For ABB eSOMS versions 4.0 to 6.0.2, the Secure Flag is not set in the HTTP response header. Unencrypted connections might access the cookie information, thus making it susceptible to eavesdropping...

CVE-2019-19739

MFScripts YetiShare 3.5.2 through 4.5.3 does not set the Secure flag on session cookies, allowing the cookie to be sent over cleartext channels...

Security Bulletin: Provision to add https and Secure Flag to bayeux_browser cookie for IBM Control Desk.

Summary BAYEUXBROWSER cookie is generated from Cometd Server and it remains live with the session. In older versions of cometd server, BAYEUXBROWSER cookie was neither true for https nor for secure. But in the current version ie. 5.0.3, there is a provision to make the cookie true for https and...

Cross-site Scripting (XSS)

Overview open-webui is an Open WebUI Affected versions of this package are vulnerable to Cross-site Scripting XSS. An attacker with a user-level account can manipulate session cookies to hijack administrator sessions, leading to unauthorized actions and potential system compromise by embedding a...

CVE-2025-22493

Secure flag not set and SameSIte was set to Lax in the Foreseer Reporting Software FRS. Absence of this secure flag could lead into the session cookie being transmitted over unencrypted HTTP connections. This security issue has been resolved in the latest version of FRS v1.5.100...

CVE-2025-22493

CVE-2025-22493 affects Foreseer Reporting Software (FRS). The issue stems from the secure flag not being set and SameSite configured to Lax, allowing session cookies to be transmitted over unencrypted HTTP connections. The Red Hat and NVD/NIST records confirm the vulnerability description and ind...

CVE-2025-22493 Improper cookie attributes in Foreseer Reporting Software (FRS)

Secure flag not set and SameSIte was set to Lax in the Foreseer Reporting Software FRS. Absence of this secure flag could lead into the session cookie being transmitted over unencrypted HTTP connections. This security issue has been resolved in the latest version of FRS v1.5.100...

CVE-2025-22493 Improper cookie attributes in Foreseer Reporting Software (FRS)

Secure flag not set and SameSIte was set to Lax in the Foreseer Reporting Software FRS. Absence of this secure flag could lead into the session cookie being transmitted over unencrypted HTTP connections. This security issue has been resolved in the latest version of FRS v1.5.100...

CVE-2025-22493: Cleartext Transmission of Sensitive Information

Secure flag not set and SameSIte was set to Lax in the Foreseer Reporting Software FRS. Absence of this secure flag could lead into the session cookie being transmitted over unencrypted HTTP connections. This security issue has been resolved in the latest version of FRS v1.5.100...

The vulnerability of the IBM Security Directory Integrator and the IBM Security Verify Directory Integrator data integration tools lies in the absence of a “Secure” flag in the session cookies. This allows attackers to gain unauthorized access to protected information.

The vulnerability of the IBM Security Directory Integrator and the IBM Security Verify Directory Integrator data integration tools is related to the absence of the “Secure” flag in the session cookies. Exploiting this vulnerability can allow a malicious actor, operating remotely, to gain...

The vulnerability of the IBM Security Directory Integrator and the IBM Security Verify Directory Integrator data integration tools lies in the absence of a “Secure” flag in the session cookies. This allows attackers to gain unauthorized access to protected information.

The vulnerability of the IBM Security Directory Integrator and the IBM Security Verify Directory Integrator data integration tools is related to the absence of the “Secure” flag in the session cookies. Exploiting this vulnerability can allow a malicious actor, operating remotely, to gain...

The vulnerability of the OTRS order processing proxy server allows a hacker to execute a type of attack known as hijacking.

The vulnerability of the OTRS order processing proxy server is related to the absence of the “Secure” flag in session cookie files. Exploiting this vulnerability allows a remote attacker to carry out a hijacking attack...