514 matches found
PT-2021-20858 · Unknown · Kiwi Syslog Server
Name of the Vulnerable Software and Affected Versions: Kiwi Syslog Server versions 9.7.2 and earlier Description: The Secure flag is not set in the SSL Cookie, which means the cookie can be sent over unencrypted requests if the application is accessible over both HTTP and HTTPS. This poses a risk...
The vulnerability of the Enterprise Resource Planning tool LedgerSMB lies in the absence of the “Secure” attribute being set in the authentication cookie files. This allows attackers to obtain authentication data.
The vulnerability of the enterprise resource planning tool LedgerSMB lies in the absence of the “Secure” attribute being set in the session cookie files during authentication. Exploiting this vulnerability could allow an attacker, operating remotely, to obtain authentication data by intercepting...
CVE-2021-35236
The Secure flag is not set in the SSL Cookie of Kiwi Syslog Server 9.7.2 and previous versions. The Secure attribute tells the browser to only send the cookie if the request is being sent over a secure channel such as HTTPS. This will help protect the cookie from being passed over unencrypted...
Sensitive Cookie in HTTPS Session Without 'Secure' Attribute in siwapp/siwapp
Description Secure flag is not implemented on the application Proof of Concept https://drive.google.com/file/d/1IOglL2LBh8CnvJUI0tRJw2wCJ8ugnws/view Impact The secure flag is an option that can be set by the application server when sending a new cookie to the user within an HTTP Response. The...
The vulnerability of the graphical distributed cross-platform IRC client Quassel, related to errors in information encryption, allows a intruder to gain access to confidential data.
The vulnerability of the graphical distributed cross-platform IRC client Quassel is related to the “--require-ssl” parameter, which is activated without support for SSL or TLS. Exploiting this vulnerability can allow a malicious actor to gain access to confidential data...
Sensitive Cookie in HTTPS Session Without 'Secure' Attribute in openfun/openedx-docker
Description Secure flag is not implemented on the application Proof of Concept https://drive.google.com/file/d/10vEIf77qf1ejR14lL5GZCMn9bZmmbIBd/view?usp=sharing Impact The secure flag is an option that can be set by the application server when sending a new cookie to the user within an HTTP...
Sensitive Cookie in HTTPS Session Without 'Secure' Attribute in filegator/filegator
Description Secure flag is not implemented on the application Proof of Concept https://ibb.co/nLTbftm Impact The secure flag is an option that can be set by the application server when sending a new cookie to the user within an HTTP Response. The purpose of the secure flag is to prevent cookies...
Sensitive Cookie in HTTPS Session Without 'Secure' Attribute in khodakhah/nodcms
Description Implement both Secure flag and httponly flag in the application. Proof of Concept Impact The secure flag is an option that can be set by the application server when sending a new cookie to the user within an HTTP Response. The purpose of the secure flag is to prevent cookies from bein...
Sensitive Cookie in HTTPS Session Without 'Secure' Attribute in kcal-app/kcal
Description Implement both Secure flag and httponly flag in the application. Proof of Concept Impact The secure flag is an option that can be set by the application server when sending a new cookie to the user within an HTTP Response. The purpose of the secure flag is to prevent cookies from bein...
Sensitive Cookie in HTTPS Session Without 'Secure' Attribute in spiral-project/ihatemoney
Description Secure flag is not implemented on the application Proof of Concept https://drive.google.com/file/d/10p4ejCFsLA6LO32nPNTRKqZjlqVHVpUf/view?usp=sharing Impact The secure flag is an option that can be set by the application server when sending a new cookie to the user within an HTTP...
Siemens SINUMERIK 信任管理问题漏洞
Siemens SINUMERIK is a control system from Siemens, Germany. It is used in all areas of production. A trust management issue vulnerability exists in Siemens SINUMERIK due to an error in a third-party dependency where the ssl flag used to set up a TLS connection to a server is incorrectly set to...
Atlassian Jira 8.14.x < 8.15.0 Cookie Without Secure Flag
According to its self-reported version number, the instance of Atlassian Jira hosted on the remote web server is prior to 8.5.12, 8.6.x 8.13.4 or 8.14.x 8.15.0. It is, therefore, affected by a missing cookie secure flag vulnerability in jira.editor.user.mode cookie when Jira is configured with...
Atlassian Jira < 8.5.12 Cookie Without Secure Flag
According to its self-reported version number, the instance of Atlassian Jira hosted on the remote web server is prior to 8.5.12, 8.6.x 8.13.4 or 8.14.x 8.15.0. It is, therefore, affected by a missing cookie secure flag vulnerability in jira.editor.user.mode cookie when Jira is configured with...
CVE-2019-4471
IBM Cognos Analytics 11.0 and 11.1 could allow a remote attacker to obtain sensitive information, caused by the failure to set the secure flag for a sensitive cookie in an HTTPS session. A remote attacker could exploit this vulnerability to obtain sensitive information. IBM X-Force ID: 163780...
Information disclosure
IBM Cognos Analytics 11.0 and 11.1 could allow a remote attacker to obtain sensitive information, caused by the failure to set the secure flag for a sensitive cookie in an HTTPS session. A remote attacker could exploit this vulnerability to obtain sensitive information. IBM X-Force ID: 163780...
CVE-2019-4471
IBM Cognos Analytics 11.0 and 11.1 could allow a remote attacker to obtain sensitive information, caused by the failure to set the secure flag for a sensitive cookie in an HTTPS session. A remote attacker could exploit this vulnerability to obtain sensitive information. IBM X-Force ID: 163780...
CVE-2019-4471: Missing Encryption of Sensitive Data
IBM Cognos Analytics 11.0 and 11.1 could allow a remote attacker to obtain sensitive information, caused by the failure to set the secure flag for a sensitive cookie in an HTTPS session. A remote attacker could exploit this vulnerability to obtain sensitive information. IBM X-Force ID: 163780...
CVE-2021-29248
BTCPay Server through 1.0.7.0 could allow a remote attacker to obtain sensitive information, caused by failure to set the Secure flag for a cookie...
