Session fixation

IBM Sterling B2B Integrator 5.1 and 5.2 and Sterling File Gateway 2.1 and 2.2 do not set the secure flag for the session cookie in an https session, which makes it easier for remote attackers to capture this cookie by intercepting its transmission within an http session...

CVE-2012-5936: Undefined Security Weakness

IBM Sterling B2B Integrator 5.1 and 5.2 and Sterling File Gateway 2.1 and 2.2 do not set the secure flag for the session cookie in an https session, which makes it easier for remote attackers to capture this cookie by intercepting its transmission within an http session...

PT-2013-1849

Name of the Vulnerable Software and Affected Versions IBM Sterling B2B Integrator versions 5.1 through 5.2 IBM Sterling File Gateway versions 2.1 through 2.2 Description The issue allows remote attackers to capture session cookies by intercepting their transmission within an http session, as the...

CVE-2013-0529

The Browser in IBM Sterling Connect:Direct 1.4 before 1.4.0.11 and 1.5 through 1.5.0.1 does not set the secure flag for the session cookie in an https session, which makes it easier for remote attackers to capture this cookie by intercepting its transmission within an http session...

PT-2013-2406

Name of the Vulnerable Software and Affected Versions IBM Sterling Connect:Direct versions 1.4 through 1.4.0.10 IBM Sterling Connect:Direct versions 1.5 through 1.5.0.1 Description The issue concerns the Browser component in IBM Sterling Connect:Direct, where it fails to set the secure flag for t...

CVE-2013-0529: Undefined Security Weakness

The Browser in IBM Sterling Connect:Direct 1.4 before 1.4.0.11 and 1.5 through 1.5.0.1 does not set the secure flag for the session cookie in an https session, which makes it easier for remote attackers to capture this cookie by intercepting its transmission within an http session...

CVE-2010-5148: Undefined Security Weakness

Websense Web Security and Web Filter before 7.1 Hotfix 21 do not set the secure flag for the Encrypted Session SSL cookie in an https session, which makes it easier for remote attackers to capture this cookie by intercepting its transmission within an http session...

PT-2012-1360

Name of the Vulnerable Software and Affected Versions Websense Web Security and Web Filter versions prior to 7.1 Hotfix 21 Description The issue allows remote attackers to capture the Encrypted Session SSL cookie by intercepting its transmission within an http session, as the secure flag is not s...

CVE-2012-4592

The Portal in McAfee Enterprise Mobility Manager EMM before 10.0 does not set the secure flag for the ASP.NET session cookie in an https session, which makes it easier for remote attackers to capture this cookie by intercepting its transmission within an http session...

PT-2012-5500

Name of the Vulnerable Software and Affected Versions McAfee Enterprise Mobility Manager EMM versions prior to 10.0 Description The issue concerns the Portal in McAfee Enterprise Mobility Manager EMM where the secure flag for the ASP.NET session cookie is not set in an https session. This makes i...

CVE-2012-4592: Undefined Security Weakness

The Portal in McAfee Enterprise Mobility Manager EMM before 10.0 does not set the secure flag for the ASP.NET session cookie in an https session, which makes it easier for remote attackers to capture this cookie by intercepting its transmission within an http session...

CVE-2011-4849

The Control Panel in Parallels Plesk Panel 10.4.4build20111103.18 does not set the secure flag for a cookie in an https session, which makes it easier for remote attackers to capture this cookie by intercepting its transmission within an http session, as demonstrated by cookies used by help.php a...

PT-2011-5140

Name of the Vulnerable Software and Affected Versions Parallels Plesk Panel version 10.4.4 build20111103.18 Description The issue concerns the Control Panel in Parallels Plesk Panel, which fails to set the secure flag for a cookie in an https session. This oversight makes it easier for remote...

CVE-2011-4849: Exposure of Sensitive Information to an Unauthorized Actor

The Control Panel in Parallels Plesk Panel 10.4.4build20111103.18 does not set the secure flag for a cookie in an https session, which makes it easier for remote attackers to capture this cookie by intercepting its transmission within an http session, as demonstrated by cookies used by help.php a...

CVE-2011-4728: Exposure of Sensitive Information to an Unauthorized Actor

The Server Administration Panel in Parallels Plesk Panel 10.2.0build1011110331.18 does not set the secure flag for a cookie in an https session, which makes it easier for remote attackers to capture this cookie by intercepting its transmission within an http session, as demonstrated by cookies us...

PT-2011-5058

Name of the Vulnerable Software and Affected Versions Parallels Plesk Panel version 10.2.0 build1011110331.18 Description The issue concerns the Server Administration Panel in Parallels Plesk Panel, where it fails to set the secure flag for a cookie in an https session. This makes it easier for...

CVE-2009-5051

Hastymail2 before RC 8 does not set the secure flag for the session cookie in an https session, which makes it easier for remote attackers to capture this cookie by intercepting its transmission within an http session...

CVE-2009-5051

Hastymail2 pre-RC8 is vulnerable: in HTTPS sessions the session cookie is not marked Secure, enabling potential interception of the cookie in transit. The OpenVAS entries describe a session-cookie security bypass; no concrete exploit details or patch/version fixes are provided in the supplied doc...

CVE-2009-5051: Undefined Security Weakness

Hastymail2 before RC 8 does not set the secure flag for the session cookie in an https session, which makes it easier for remote attackers to capture this cookie by intercepting its transmission within an http session...

PT-2011-1312

Name of the Vulnerable Software and Affected Versions Hastymail2 versions prior to RC 8 Description The issue allows remote attackers to capture the session cookie by intercepting its transmission within an http session, as the secure flag for the session cookie is not set in an https session...