CVE-2019-4563

The vulnerability CVE-2019-4563 affects IBM Security Directory Server 6.4.0. The underlying issue is that authorization tokens and session cookies are not marked Secure, allowing an attacker to obtain cookie values by luring users to an http:// link or via a site the user visits, enabling traffic...

PT-2020-10971

Name of the Vulnerable Software and Affected Versions IBM Security Directory Server version 6.4.0 Description The issue allows attackers to obtain cookie values by sending a user to an insecure link or by planting such a link in a site the user visits. This can be done because the secure attribut...

PT-2020-4938

Name of the Vulnerable Software and Affected Versions: Synology Router Manager SRM versions prior to 1.2.4-8081 Description: The issue is related to the absence of the HttpOnly flag in session cookies. This makes it easier for remote attackers to obtain potentially sensitive information via scrip...

PT-2020-16747 · Synology · Synology Diskstation Manager

Name of the Vulnerable Software and Affected Versions: Synology DiskStation Manager DSM versions prior to 6.2.3-25426-2 Description: The issue makes it easier for remote attackers to capture session cookies by intercepting their transmission within an HTTP session, as the Secure flag is not set f...

CVE-2019-4563: Session Fixation

IBM Security Directory Server 6.4.0 does not set the secure attribute on authorization tokens or session cookies. Attackers may be able to get the cookie values by sending a http:// link to a user or by planting this link in a site the user goes to. The cookie will be sent to the insecure link an...

CVE-2020-4749

IBM Spectrum Scale 5.0.0 through 5.0.5.2 does not set the secure attribute on authorization tokens or session cookies. Attackers may be able to get the cookie values by sending a http:// link to a user or by planting this link in a site the user goes to. The cookie will be sent to the insecure li...

CVE-2020-4749

IBM Spectrum Scale 5.0.0 through 5.0.5.2 does not set the secure attribute on authorization tokens or session cookies. Attackers may be able to get the cookie values by sending a http:// link to a user or by planting this link in a site the user goes to. The cookie will be sent to the insecure li...

CVE-2020-4749

IBM Spectrum Scale 5.0.0 through 5.0.5.2 does not set the secure attribute on authorization tokens or session cookies. Attackers may be able to get the cookie values by sending a http:// link to a user or by planting this link in a site the user goes to. The cookie will be sent to the insecure li...

CVE-2020-4749: Reliance on Cookies without Validation and Integrity Checking

IBM Spectrum Scale 5.0.0 through 5.0.5.2 does not set the secure attribute on authorization tokens or session cookies. Attackers may be able to get the cookie values by sending a http:// link to a user or by planting this link in a site the user goes to. The cookie will be sent to the insecure li...

PT-2020-18242

Name of the Vulnerable Software and Affected Versions IBM Curam Social Program Management versions 7.0.9 through 7.0.10 Description The issue is related to the OOTB build scripts not setting the secure attribute on session cookies. This may allow unauthorized parties to observe cookies...

CVE-2020-8243

A vulnerability in the Pulse Connect Secure 9.1R8.2 admin web interface could allow an authenticated attacker to upload custom template to perform an arbitrary code execution. Recent assessments: wvu-r7 at October 07, 2020 10:52pm UTC reported: Oh dear, another Pulse Secure vuln. Let’s break this...

IBM Business Automation Content Analyzer Cloud Information Disclosure Vulnerability

IBM Business Automation Content Analyzer is a new cloud-based API Web Service from International Business Machines IBM designed to work with the IBM Automation Platform for Digital Business or any non-IBM content/process system. Content Analyzer helps you quickly accelerate the extraction and...

CVE-2020-4315

IBM Business Automation Content Analyzer on Cloud 1.0 does not set the secure attribute on authorization tokens or session cookies. Attackers may be able to get the cookie values by sending a http:// link to a user or by planting this link in a site the user goes to. The cookie will be sent to th...

CVE-2020-4315: Insecure Storage of Sensitive Information

IBM Business Automation Content Analyzer on Cloud 1.0 does not set the secure attribute on authorization tokens or session cookies. Attackers may be able to get the cookie values by sending a http:// link to a user or by planting this link in a site the user goes to. The cookie will be sent to th...

Security Bulletin: IBM Business Automation Content Analyzer is affected by Insecure Cookie vulnerability

Summary IBM Business Automation Content Analyzer has addressed the following vulnerability Vulnerability Details CVEID: CVE-2020-4315 DESCRIPTION: IBM Business Automation Content Analyzer does not set the secure attribute on authorization tokens or session cookies. Attackers may be able to get th...

ElkarBackup Cross-Site Scripting Vulnerability

ElkarBackup is a free open source backup solution based on RSync/RSnapshot. A persistent cross-site scripting vulnerability exists in the Policies action Name parameter in ElkarBackup 1.3.3. An attacker can exploit this vulnerability to steal user session cookies...

CVE-2020-24924

A Persistent Cross-site Scripting vulnerability is found in ElkarBackup v1.3.3, where an attacker can steal the user session cookie using this vulnerability present on Policies action Name Parameter...

CVE-2020-24876

Use of a hard-coded cryptographic key in Pancake versions 4.13.29 allows an attacker to forge session cookies, which may lead to remote privilege escalation...

PT-2020-15847

Name of the Vulnerable Software and Affected Versions Pancake versions prior to 4.13.29 Description The issue involves the use of a hard-coded cryptographic key, allowing an attacker to forge session cookies. This may lead to remote privilege escalation. Recommendations For versions prior to...

CVE-2020-23831

A Reflected Cross-Site Scripting XSS vulnerability in the index.php login-portal webpage of SourceCodester Stock Management System v1.0 allows remote attackers to harvest login credentials and session cookies when an unauthenticated victim clicks on a malicious URL and enters credentials...