CVE-2021-29248

BTCPay Server (versions up to 1.0.7.0) is affected by an information disclosure vulnerability caused by not setting the Secure flag on a cookie, enabling a remote attacker to obtain sensitive information. The exact vulnerable component/file is the cookie handling, and the available documents do n...

CVE-2021-29248

BTCPay Server through 1.0.7.0 could allow a remote attacker to obtain sensitive information, caused by failure to set the Secure flag for a cookie...

PT-2021-18143

Name of the Vulnerable Software and Affected Versions: BTCPay Server versions 1.0.0 through 1.0.7.0 Description: The issue is caused by the failure to set the Secure flag for a cookie, allowing a remote attacker to obtain sensitive information. Recommendations: For BTCPay Server versions 1.0.0...

CVE-2021-29248: Missing Encryption of Sensitive Data

BTCPay Server through 1.0.7.0 could allow a remote attacker to obtain sensitive information, caused by failure to set the Secure flag for a cookie...

CVE-2020-26732

SKYWORTH GN542VF Hardware Version 2.0 and Software Version 2.0.0.16 does not set the Secure flag for the session cookie in an HTTPS session, which makes it easier for remote attackers to capture this cookie by intercepting its transmission within an HTTP session...

Session fixation

SKYWORTH GN542VF Boa version 0.94.13 does not set the Secure flag for the session cookie in an HTTPS session, which makes it easier for remote attackers to capture this cookie by intercepting its transmission within an HTTP session...

PT-2021-11266 · Skyworth · Skyworth Gn542Vf

Name of the Vulnerable Software and Affected Versions: SKYWORTH GN542VF Hardware Version 2.0 and Software Version 2.0.0.16 SKYWORTH GN542VF Boa version 0.94.13 Description: The issue is related to the session cookie in an HTTPS session not having the Secure flag set, making it easier for remote...

CVE-2020-26732

SKYWORTH GN542VF Hardware Version 2.0 and Software Version 2.0.0.16 does not set the Secure flag for the session cookie in an HTTPS session, which makes it easier for remote attackers to capture this cookie by intercepting its transmission within an HTTP session...

CVE-2020-14248

BigFix Inventory up to v10.0.2 does not set the secure flag for the session cookie in an https session, which can cause the cookie to be sent in http requests and make it easier for remote attackers to capture this cookie...

CVE-2020-14248

BigFix Inventory up to v10.0.2 does not set the secure flag for the session cookie in an https session, which can cause the cookie to be sent in http requests and make it easier for remote attackers to capture this cookie...

IBM BigFix Inventory 代码问题漏洞

IBM BigFix Inventory is a suite of solutions for software control and security risk mitigation from IBM USA. A security vulnerability exists in versions prior to IBM BigFix Inventory v10.0.2 that stems from a failure to set a security flag for a session cookie in an https session, which could...

PT-2020-13951

Name of the Vulnerable Software and Affected Versions BigFix Inventory versions up to 10.0.2 Description The issue is related to BigFix Inventory not setting the secure flag for the session cookie in an https session. This can cause the cookie to be sent in http requests, making it easier for...

Console: HTTPOnly and Secure attributes not set on cookies in Red Hat AMQ

It was found that Hawtio console does not set HTTPOnly or Secure attributes on cookies. An attacker could use this flaw to rerieve an authenticated user's SessionID, and possibly conduct further attacks with the permissions of the authenticated user...

The vulnerability of the Synology Router Manager operating system arises from the absence of a “secure” flag in session cookie files. This allows attackers to gain unauthorized access to the target device.

The vulnerability of the Synology Router Manager operating system is related to the absence of the “secure” flag in session cookies files. Exploiting this vulnerability can allow a malicious actor, operating remotely, to gain unauthorized access to the target device by intercepting session cookie...

CVE-2020-4763

IBM Sterling File Gateway 6.0.0.0 through 6.0.3.2 and 2.2.0.0 through 2.2.6.5 does not set the secure attribute on authorization tokens or session cookies. Attackers may be able to get the cookie values by sending a http:// link to a user or by planting this link in a site the user goes to. The...

CVE-2020-4665

IBM Sterling File Gateway 2.2.0.0 through 2.2.6.5 and 6.0.0.0 through 6.0.3.2 does not set the secure attribute on authorization tokens or session cookies. Attackers may be able to get the cookie values by sending a http:// link to a user or by planting this link in a site the user goes to. The...

Synology Router Manager Information Disclosure Vulnerability (CNVD-2020-60453)

Synology Router Manager SRM is a software for configuring and managing Synology routers from Synology Inc. of Taiwan, China. A security vulnerability exists in Synology Router Manager SRM versions prior to 1.2.4-8081, which stems from not setting a security flag for a session cookie in an HTTPS...

CVE-2020-27651

Synology Router Manager SRM before 1.2.4-8081 does not set the Secure flag for the session cookie in an HTTPS session, which makes it easier for remote attackers to capture this cookie by intercepting its transmission within an HTTP session...

PT-2020-4937

Name of the Vulnerable Software and Affected Versions: Synology Router Manager SRM versions prior to 1.2.4-8081 Description: The issue is related to the absence of the Secure flag in session cookies. This makes it easier for remote attackers to capture the session cookie by intercepting its...

CVE-2020-27650: Sensitive Cookie in HTTPS Session Without 'Secure' Attribute

Synology DiskStation Manager DSM before 6.2.3-25426-2 does not set the Secure flag for the session cookie in an HTTPS session, which makes it easier for remote attackers to capture this cookie by intercepting its transmission within an HTTP session...