Design/Logic Flaw

For ABB eSOMS versions 4.0 to 6.0.2, the Secure Flag is not set in the HTTP response header. Unencrypted connections might access the cookie information, thus making it susceptible to eavesdropping...

CVE-2019-19090: Missing Encryption of Sensitive Data

For ABB eSOMS versions 4.0 to 6.0.2, the Secure Flag is not set in the HTTP response header. Unencrypted connections might access the cookie information, thus making it susceptible to eavesdropping...

PT-2020-6882 · Abb · Abb Esoms

Name of the Vulnerable Software and Affected Versions: ABB eSOMS versions 4.0 to 6.0.2 Description: The issue is related to the absence of the Secure Flag in the HTTP response header, which may allow unencrypted connections to access cookie information, making it susceptible to eavesdropping. Thi...

CVE-2013-3637

ProjectPier 0.8.8 does not use the Secure flag for cookies...

PT-2020-7458

Name of the Vulnerable Software and Affected Versions: ProjectPier version 0.8.8 Description: The issue is related to the insecure use of cookies. ProjectPier 0.8.8 does not set the Secure flag for cookies, which could potentially expose sensitive information. Recommendations: For ProjectPier...

CVE-2013-3637: Improper Neutralization of Input During Web Page Generation

ProjectPier 0.8.8 does not use the Secure flag for cookies...

PT-2020-7792

Name of the Vulnerable Software and Affected Versions: IBM Workflow for Bluemix affected versions not specified Description: The issue is related to the session cookie in an https session. Specifically, the secure flag for the session cookie is not set, which makes it easier for remote attackers ...

CVE-2019-19739

MFScripts YetiShare 3.5.2 through 4.5.3 does not set the Secure flag on session cookies, allowing the cookie to be sent over cleartext channels...

PT-2019-15939

Name of the Vulnerable Software and Affected Versions MFScripts YetiShare versions 3.5.2 through 4.5.3 Description The issue allows session cookies to be sent over cleartext channels because the Secure flag is not set on these cookies. Recommendations For versions 3.5.2 through 4.5.3, ensure that...

CVE-2019-19739: Missing Encryption of Sensitive Data

MFScripts YetiShare 3.5.2 through 4.5.3 does not set the Secure flag on session cookies, allowing the cookie to be sent over cleartext channels...

IBM Operations Analytics-Log Analysis Information Disclosure Vulnerability

IBM Operations Analytics-Log Analysis is a set of semi-structured data analysis solutions from IBM USA. The product is mainly used for application log analysis and problem diagnosis and so on. An information disclosure vulnerability exists in IBM Operations Analytics-Log Analysis, which stems fro...

Stripo Inc: SSL cookie without secure flag set

Issue background If the secure flag is set on a cookie, then browsers will not submit the cookie in any requests that use an unencrypted HTTP connection, thereby preventing the cookie from being trivially intercepted by an attacker monitoring network traffic. If the secure flag is not set, then t...

CVE-2019-4171

IBM Cognos Controller 10.3.0, 10.3.1, 10.4.0, and 10.4.1 does not set the secure attribute on authorization tokens or session cookies. This could allow an attacker to obtain sensitive information using man in the middle techniques. IBM X-Force ID: 158876...

CVE-2018-5482

NetApp SnapCenter Server prior to 4.1 does not set the secure flag for a sensitive cookie in an HTTPS session which can allow the transmission of the cookie in plain text over an unencrypted channel...

CVE-2018-5482: Missing Encryption of Sensitive Data

NetApp SnapCenter Server prior to 4.1 does not set the secure flag for a sensitive cookie in an HTTPS session which can allow the transmission of the cookie in plain text over an unencrypted channel...

PT-2019-10986

Name of the Vulnerable Software and Affected Versions: NetApp SnapCenter Server versions prior to 4.1 Description: The issue concerns the transmission of a sensitive cookie in plain text over an unencrypted channel due to the lack of a secure flag in an HTTPS session. Recommendations: For version...

UBUNTU-CVE-2018-1340

Prior to 1.0.0, Apache Guacamole used a cookie for client-side storage of the user's session token. This cookie lacked the "secure" flag, which could allow an attacker eavesdropping on the network to intercept the user's session token if unencrypted HTTP requests are made to the same domain...

Code injection

Prior to 1.0.0, Apache Guacamole used a cookie for client-side storage of the user's session token. This cookie lacked the "secure" flag, which could allow an attacker eavesdropping on the network to intercept the user's session token if unencrypted HTTP requests are made to the same domain...

CVE-2018-1340

Prior to 1.0.0, Apache Guacamole used a cookie for client-side storage of the user's session token. This cookie lacked the "secure" flag, which could allow an attacker eavesdropping on the network to intercept the user's session token if unencrypted HTTP requests are made to the same domain...

CVE-2018-1340

Prior to 1.0.0, Apache Guacamole used a cookie for client-side storage of the user's session token. This cookie lacked the "secure" flag, which could allow an attacker eavesdropping on the network to intercept the user's session token if unencrypted HTTP requests are made to the same domain...