Session Information Disclosure

github.com/grafana/grafana is vulnerable to session information disclosure. Cookies are not generated with the secure flag, this allows malicious actors to steal login session information over insecure connections...

Stellar.org: Session Cookie without HttpOnly and secure flag set

vulnerable URL: www.stellar.org The PHPSESSID cookie does not have the HTTPOnly flag set. When a cookie is set with the HTTPOnly flag, it instructs the browser that the cookie can only accessed by the server and not by client-side scripts. This is an important security protection for session...

Weblate: session id missing secure flag - Hosted Website

Hey folks, Looks like the sessionid cookie handles session id but misses Secure flag. Cookies without this flag will transmitted over unencrypted channel and let's the man in the middle attackers to grab the value. Attack Vector - Attacker passes a http:// hosted website link - Victim clicks the...

CVE-2017-1142

IBM Kenexa LCMS Premier on Cloud 9.x and 10.0 could allow a remote attacker to obtain sensitive information, caused by the failure to set the secure flag for the session cookie in SSL mode. By intercepting its transmission within an HTTP session, an attacker could exploit this vulnerability to...

CVE-2017-1142: Exposure of Sensitive Information to an Unauthorized Actor

IBM Kenexa LCMS Premier on Cloud 9.x and 10.0 could allow a remote attacker to obtain sensitive information, caused by the failure to set the secure flag for the session cookie in SSL mode. By intercepting its transmission within an HTTP session, an attacker could exploit this vulnerability to...

CVE-2016-5958

IBM Security Privileged Identity Manager could allow a remote attacker to obtain sensitive information, caused by the failure to set the secure flag for the session cookie in SSL mode. By intercepting its transmission within an HTTP session, an attacker could exploit this vulnerability to capture...

CVE-2016-0372

IBM Rational Collaborative Lifecycle Management 3.0.1.6 before iFix8, 4.0 before 4.0.7 iFix11, 5.0 before 5.0.2 iFix18, and 6.0 before 6.0.2 iFix5; Rational Quality Manager 3.0.1.6 before iFix8, 4.0 before 4.0.7 iFix11, 5.0 before 5.0.2 iFix18, and 6.0 before 6.0.2 iFix5; Rational Team Concert...

PT-2016-4159

Name of the Vulnerable Software and Affected Versions IBM Security Privileged Identity Manager version 2.0 before 2.0.2 FP8 Description The issue allows remote attackers to capture session cookies by intercepting their transmission within an http session, as the secure flag for the session cookie...

CVE-2016-8672

CVE-2016-8672 concerns the SIMATIC web server delivering cookies without the Secure attribute. Affects SIMATIC CP 343-1 Advanced (incl. SIPLUS NET) < v3.0.53 and CP 443-1 Advanced

PT-2016-7208

Name of the Vulnerable Software and Affected Versions Siemens SCALANCE M-800 and S615 modules versions prior to 4.02 Description The issue concerns the integrated web server's handling of session cookies in https sessions. Specifically, it does not set the secure flag for the session cookie, maki...

Secure Flag not set for Cookies generated by Netscaler if Vserver is part of Persistence Group

We need to have the NSC cookies using the Secure and HttpOnly flag set, however Secure flag is not set by NetScaler...

Session fixation

IBM DataPower Gateway appliances with firmware 6.x before 6.0.0.17, 6.0.1.x before 6.0.1.17, 7.x before 7.0.0.10, 7.1.0.x before 7.1.0.7, and 7.2.x before 7.2.0.1 do not set the secure flag for unspecified cookies in an https session, which makes it easier for remote attackers to capture these...

CVE-2015-7427: Exposure of Sensitive Information to an Unauthorized Actor

IBM DataPower Gateway appliances with firmware 6.x before 6.0.0.17, 6.0.1.x before 6.0.1.17, 7.x before 7.0.0.10, 7.1.0.x before 7.1.0.7, and 7.2.x before 7.2.0.1 do not set the secure flag for unspecified cookies in an https session, which makes it easier for remote attackers to capture these...

PT-2015-7553

Name of the Vulnerable Software and Affected Versions IBM DataPower Gateway appliances versions 6.x before 6.0.0.17 IBM DataPower Gateway appliances versions 6.0.1.x before 6.0.1.17 IBM DataPower Gateway appliances versions 7.x before 7.0.0.10 IBM DataPower Gateway appliances versions 7.1.0.x...

CVE-2015-1993: Undefined Security Weakness

IBM Security QRadar Incident Forensics 7.2.x before 7.2.5 Patch 5 does not set the secure flag for unspecified cookies in an https session, which makes it easier for remote attackers to capture these cookies by intercepting their transmission within an http session...

PT-2015-5537

Name of the Vulnerable Software and Affected Versions IBM Security QRadar Incident Forensics versions 7.2.x through 7.2.5 before Patch 5 Description The issue makes it easier for remote attackers to capture cookies by intercepting their transmission within an http session, as the secure flag is n...

CVE-2015-2025

IBM WebSphere eXtreme Scale 7.1.0 before 7.1.0.3 and 7.1.1 before 7.1.1.1 do not set the secure flag on the session cookie in HTTPS, allowing interception of cookies in HTTP sessions. Affected versions: WebSphere eXtreme Scale 7.1.0 and 7.1.1. Remediation: apply fixes 7.1.0.3 (PI44105) or 7.1.1.1...

PT-2015-5551

Name of the Vulnerable Software and Affected Versions IBM WebSphere eXtreme Scale versions 7.1.0 through 7.1.0.2 IBM WebSphere eXtreme Scale versions 7.1.1 through 7.1.1.0 Description The issue makes it easier for remote attackers to capture the session cookie by intercepting its transmission...

Foreman Information Disclosure Vulnerability

Foreman is a set of lifecycle management tools for use in physical and virtual servers. The tool provides features such as service provisioning, configuration management, and status reporting. A security vulnerability exists in Foreman versions prior to 1.8.1 that stems from the program not setti...

CVE-2015-3155

Foreman before 1.8.1 does not set the secure flag for the sessionid cookie in an https session, which makes it easier for remote attackers to capture this cookie by intercepting its transmission within an http session...