Taipy 安全漏洞

Taipy is an open source application from Avaiga. Designed for data scientists and machine learning engineers building data and artificial intelligence web applications. A security vulnerability existed in Taipy prior to version 4.0.0 that stemmed from session cookies not using the Secure and...

Synology DiskStation Manager Sensitive Cookie in HTTPS Session Without 'Secure' Attribute (CVE-2020-27650)

Synology DiskStation Manager DSM before 6.2.3-25426-2 does not set the Secure flag for the session cookie in an HTTPS session, which makes it easier for remote attackers to capture this cookie by intercepting its transmission within an HTTP session. This plugin only works with Tenable.ot. Please...

Taipy has a Session Cookie without Secure and HTTPOnly flags

Summary Session cookie is without Secure and HTTPOnly flags. Details Please take a look at this part of code PoC screenshot or check code directly provided in Occurrences section below Occurrences: https://github.com/Avaiga/taipy/blob/develop/frontend/taipy-gui/src/components/Taipy/Navigate.tsxL6...

GHSA-R3JQ-4R5C-J9HP Taipy has a Session Cookie without Secure and HTTPOnly flags

Summary Session cookie is without Secure and HTTPOnly flags. Details Please take a look at this part of code PoC screenshot or check code directly provided in Occurrences section below Occurrences: https://github.com/Avaiga/taipy/blob/develop/frontend/taipy-gui/src/components/Taipy/Navigate.tsxL6...

PT-2024-32843 · Taipy · Taipy

Name of the Vulnerable Software and Affected Versions: Taipy versions prior to 4.0.0 Description: The issue concerns session cookies being served without Secure and HTTPOnly flags, which could expose them to interception or tampering if the connection is not secure. The HTTPOnly flag prevents the...

The vulnerability in the web client of IBM Datacap Navigator software for document collection and processing involves the absence of a “Secure” flag in session cookies. This allows an attacker to gain unauthorized access to protected information.

The vulnerability of the IBM Datacap Navigator web client software for document collection and processing lies in the absence of a “Secure” flag in the session cookies. Exploiting this vulnerability can allow an attacker to gain unauthorized access to protected information by intercepting the...

CVE-2024-41684

This vulnerability exists in SyroTech SY-GPON-1110-WDONT Router due to missing secure flag for the session cookies associated with the router's web management interface. An attacker with remote access could exploit this by intercepting transmission within an HTTP session on the vulnerable system...

CVE-2024-41684 Cookie Without Secure Flag Set Vulnerability

This vulnerability exists in SyroTech SY-GPON-1110-WDONT Router due to missing secure flag for the session cookies associated with the router's web management interface. An attacker with remote access could exploit this by intercepting transmission within an HTTP session on the vulnerable system...

The vulnerability of the software for monitoring and analyzing network traffic in industrial networks, SINEC Traffic Analyzer, allows a intruder to gain unauthorized access to protected information.

The vulnerability of the SINEC Traffic Analyzer software for monitoring and analyzing network traffic in industrial networks stems from the absence of the "Secure", "HttpOnly", or "SameSite" flags in session cookie files. Exploiting this vulnerability can allow an unauthorized attacker to gain...

BIT-ESPOCRM-2022-38846

EspoCRM version 7.1.8 is vulnerable to Missing Secure Flag allowing the browser to send plain text cookies over an insecure channel HTTP. An attacker may capture the cookie from the insecure channel using MITM attack...

The vulnerability of Moxa PT-G503 Ethernet switches’ microprogramming software lies in the absence of a “secure” flag in session cookies, allowing attackers to gain unauthorized access to protected information.

The vulnerability of Moxa PT-G503 Ethernet switches’ microprogramming software is related to the absence of a “secure” flag in the session cookie files. Exploiting this vulnerability can allow an attacker operating remotely to gain unauthorized access to protected information...

CVE-2023-5035 Cookie Without Secure Flag

A vulnerability has been identified in PT-G503 Series firmware versions prior to v5.2, where the Secure attribute for sensitive cookies in HTTPS sessions is not set, which could cause the cookie to be transmitted in plaintext over an HTTP session. The vulnerability may lead to security risks,...

Cookie without Secure flag

Description Access and login to the website. Press F12 on your keyboard or right-click on the website to open dev-tool. At Application tab, choose Cookies and there are some sensitive cookies without Secure flag. Proof of Concept...

tomcat: not including the secure attribute causes information disclosure

When using the RemoteIpFilter with requests received from a reverse proxy via HTTP that include the X-Forwarded-Proto header set to https, session cookies created by Apache Tomcat 11.0.0-M1 to 11.0.0.-M2, 10.1.0-M1 to 10.1.5, 9.0.0-M1 to 9.0.71 and 8.5.0 to 8.5.85 did not include the secure...

Important Cookie without Secure flag

Description Cookie accessToken is without Secure flag. Mentioned cookie is responsible for user auth. Proof of Concept Repro steps: As logged in user https://app.vrite.io/ open DevTools and check Cookies table, get value of accessToken cookie. Open other browser, go to app.vrite.io site, open...

Cookie without Secure flag

Description There is a ICMS62EC2566CC4B5 cookie without Secure flag and this is authentication cookie. Proof of Concept Link photo PoC: https://drive.google.com/file/d/1uWsRKMT-KyuRPA01Ra1W3YphQgNmMkuu/view?usp=sharing...

Sensitive Cookie Without Secure Flag

Description Access and login to the demo website: https://demo.openitcockpit.io/ Press F12 on your keyboard or right-click on the website to open dev-tool. At Application tab, choose Cookies and there are some sensitive cookies without Secure flag. CookieAuth, csrfToken Proof of Concept Link imag...

The vulnerability of the ABB eSOMS software for managing production processes allows a hacker to gain unauthorized access to protected information.

The vulnerability of the ABB eSOMS production process management software lies in the absence of a “Secure” flag in the session cookies files. Exploiting this vulnerability could allow an unauthorized attacker to gain unauthorized access to protected information...

Advance Charity Management 1.0 Insecure Settings

Title: Advance Charity Management-1.0 - TLS cookie without secure flag set-PHPSESSID NEVER EXPIRATION-current session-Hijacking Author: nu11secur1ty Date: 06.04.2023 Vendor: https://www.sourcecodester.com/users/aown-shah Software:...

Siemens SCALANCE M-800 & S615 Sensitive Cookie in HTTPS Session Without 'Secure' Attribute (CVE-2016-7090)

The integrated web server on Siemens SCALANCE M-800 and S615 modules with firmware before 4.02 does not set the secure flag for the session cookie in an https session, which makes it easier for remote attackers to capture this cookie by intercepting its transmission within an http session. This...