CVE-2020-4665

CVE-2020-4665 affects IBM Sterling File Gateway versions 2.2.0.0–2.2.6.5 and 6.0.0.0–6.0.3.2. Root cause: the product does not set the secure attribute on authorization tokens or session cookies, enabling cookie values to be exposed when a user clicks an http:// link or visits an attacker-control...

CVE-2020-4665

IBM Sterling File Gateway 2.2.0.0 through 2.2.6.5 and 6.0.0.0 through 6.0.3.2 does not set the secure attribute on authorization tokens or session cookies. Attackers may be able to get the cookie values by sending a http:// link to a user or by planting this link in a site the user goes to. The...

PT-2020-18231

Name of the Vulnerable Software and Affected Versions IBM Sterling File Gateway versions 2.2.0.0 through 2.2.6.5 IBM Sterling File Gateway versions 6.0.0.0 through 6.0.3.2 Description The issue arises because the software does not set the secure attribute on authorization tokens or session cookie...

PT-2020-18194

Name of the Vulnerable Software and Affected Versions IBM Sterling File Gateway versions 2.2.0.0 through 2.2.6.5 IBM Sterling File Gateway versions 6.0.0.0 through 6.0.3.2 Description The issue concerns the failure to set the secure attribute on authorization tokens or session cookies. Attackers...

Security Bulletin: Cookie Vulnerability Affects IBM Sterling File Gateway (CVE-2020-4763)

Summary IBM Sterling File Gateway has addressed a cookie vulnerability. Vulnerability Details CVEID: CVE-2020-4763 DESCRIPTION: IBM Sterling File Gateway does not set the secure attribute on authorization tokens or session cookies. Attackers may be able to get the cookie values by sending a http:...

Security Bulletin: Cookie Vulnerability Affects IBM Sterling File Gateway (CVE-2020-4665)

Summary IBM Sterling File Gateway has addressed a cookie vulnerability. Vulnerability Details CVEID: CVE-2020-4665 DESCRIPTION: IBM Sterling File Gateway does not set the secure attribute on authorization tokens or session cookies. Attackers may be able to get the cookie values by sending a http:...

Security Bulletin: IBM Security Directory Server vulnerable to multiple issues (CVE-2019-4563, CVE-2019-4547)

Summary Multiple security vulnerabilities have been fixed and delivered in IBM Security Directory Server. Vulnerability Details CVEID: CVE-2019-4563 DESCRIPTION: IBM Security Directory Server does not set the secure attribute on authorization tokens or session cookies. Attackers may be able to ge...

Synology Router Manager Information Disclosure Vulnerability (CNVD-2020-60453)

Synology Router Manager SRM is a software for configuring and managing Synology routers from Synology Inc. of Taiwan, China. A security vulnerability exists in Synology Router Manager SRM versions prior to 1.2.4-8081, which stems from not setting a security flag for a session cookie in an HTTPS...

Synology DiskStation Manager Information Disclosure Vulnerability

Synology DiskStation Manager DSM is a product of Synology Inc. of Taiwan, China DSM, etc. Synology DiskStation Manager is a set of operating systems for use on networked storage servers NAS.HTTPS Hypertext Transfer Protocol Secure, etc. are products of HTTPS, a web-based secure transfer protocol,...

CVE-2019-4563

IBM Security Directory Server 6.4.0 does not set the secure attribute on authorization tokens or session cookies. Attackers may be able to get the cookie values by sending a http:// link to a user or by planting this link in a site the user goes to. The cookie will be sent to the insecure link an...

CVE-2019-4563

IBM Security Directory Server 6.4.0 does not set the secure attribute on authorization tokens or session cookies. Attackers may be able to get the cookie values by sending a http:// link to a user or by planting this link in a site the user goes to. The cookie will be sent to the insecure link an...

Authorization

IBM Security Directory Server 6.4.0 does not set the secure attribute on authorization tokens or session cookies. Attackers may be able to get the cookie values by sending a http:// link to a user or by planting this link in a site the user goes to. The cookie will be sent to the insecure link an...

CVE-2019-4563

IBM Security Directory Server 6.4.0 does not set the secure attribute on authorization tokens or session cookies. Attackers may be able to get the cookie values by sending a http:// link to a user or by planting this link in a site the user goes to. The cookie will be sent to the insecure link an...

CVE-2019-4563

The vulnerability CVE-2019-4563 affects IBM Security Directory Server 6.4.0. The underlying issue is that authorization tokens and session cookies are not marked Secure, allowing an attacker to obtain cookie values by luring users to an http:// link or via a site the user visits, enabling traffic...

PT-2020-16747 · Synology · Synology Diskstation Manager

Name of the Vulnerable Software and Affected Versions: Synology DiskStation Manager DSM versions prior to 6.2.3-25426-2 Description: The issue makes it easier for remote attackers to capture session cookies by intercepting their transmission within an HTTP session, as the Secure flag is not set f...

PT-2020-4938

Name of the Vulnerable Software and Affected Versions: Synology Router Manager SRM versions prior to 1.2.4-8081 Description: The issue is related to the absence of the HttpOnly flag in session cookies. This makes it easier for remote attackers to obtain potentially sensitive information via scrip...

CVE-2019-4563: Session Fixation

IBM Security Directory Server 6.4.0 does not set the secure attribute on authorization tokens or session cookies. Attackers may be able to get the cookie values by sending a http:// link to a user or by planting this link in a site the user goes to. The cookie will be sent to the insecure link an...

PT-2020-10971

Name of the Vulnerable Software and Affected Versions IBM Security Directory Server version 6.4.0 Description The issue allows attackers to obtain cookie values by sending a user to an insecure link or by planting such a link in a site the user visits. This can be done because the secure attribut...

CVE-2020-4749

IBM Spectrum Scale 5.0.0 through 5.0.5.2 does not set the secure attribute on authorization tokens or session cookies. Attackers may be able to get the cookie values by sending a http:// link to a user or by planting this link in a site the user goes to. The cookie will be sent to the insecure li...

CVE-2020-4749

IBM Spectrum Scale 5.0.0 through 5.0.5.2 does not set the secure attribute on authorization tokens or session cookies. Attackers may be able to get the cookie values by sending a http:// link to a user or by planting this link in a site the user goes to. The cookie will be sent to the insecure li...