CVE-2020-27658

Synology Router Manager SRM before 1.2.4-8081 does not include the HTTPOnly flag in a Set-Cookie header for the session cookie, which makes it easier for remote attackers to obtain potentially sensitive information via script access to this cookie...

CVE-2020-27651

Synology Router Manager SRM before 1.2.4-8081 does not set the Secure flag for the session cookie in an HTTPS session, which makes it easier for remote attackers to capture this cookie by intercepting its transmission within an HTTP session...

CVE-2020-27651

CVE-2020-27651 affects Synology SRM (RT2600ac) prior to 1.2.4-8081. The issue is that the web interface session cookie is issued without the Secure flag in HTTPS, enabling an attacker to capture the cookie via MITM in an HTTP session. Talos documentation confirms the vulnerable SRM web interface ...

PT-2020-4937

Name of the Vulnerable Software and Affected Versions: Synology Router Manager SRM versions prior to 1.2.4-8081 Description: The issue is related to the absence of the Secure flag in session cookies. This makes it easier for remote attackers to capture the session cookie by intercepting its...

Synology SRM web interface session cookie secure flag Information Disclosure Vulnerability

Talos Vulnerability Report TALOS-2020-1059 Synology SRM web interface session cookie secure flag Information Disclosure Vulnerability October 29, 2020 CVE Number CVE-2020-27651 SUMMARY An exploitable information disclosure vulnerability exists in the web interface session cookie functionality of...

CVE-2020-27650: Sensitive Cookie in HTTPS Session Without 'Secure' Attribute

Synology DiskStation Manager DSM before 6.2.3-25426-2 does not set the Secure flag for the session cookie in an HTTPS session, which makes it easier for remote attackers to capture this cookie by intercepting its transmission within an HTTP session...

CVE-2020-27658: Sensitive Cookie Without 'HttpOnly' Flag

Synology Router Manager SRM before 1.2.4-8081 does not include the HTTPOnly flag in a Set-Cookie header for the session cookie, which makes it easier for remote attackers to obtain potentially sensitive information via script access to this cookie...

Cross-site Session Transfer

modauthmellon before 0.13.1 is vulnerable to a Cross-Site Session Transfer attack, where a user with access to one web site running on a server can copy their session cookie to a different web site on the same server to get access to that site...

projectworlds car rental management system cross-site scripting vulnerability

projectworlds car rental management system is a car rental management system from projectworlds. projectworlds car rental management system is vulnerable to a cross-site scripting vulnerability, which could be exploited to obtain an administrative login session cookie and steal an administrative...

CVE-2020-27606

BigBlueButton before 2.2.28 or earlier does not set the secure flag for the session cookie in an https session, which makes it easier for remote attackers to capture this cookie by intercepting its transmission within an http session...

CVE-2020-27606

BigBlueButton before 2.2.28 or earlier does not set the secure flag for the session cookie in an https session, which makes it easier for remote attackers to capture this cookie by intercepting its transmission within an http session...

CVE-2020-27606

BigBlueButton before 2.2.28 or earlier does not set the secure flag for the session cookie in an https session, which makes it easier for remote attackers to capture this cookie by intercepting its transmission within an http session...

CVE-2020-27606

BigBlueButton is affected pre-2.2.28: the session cookie is not marked Secure in HTTPS, enabling cookie capture if an attacker can observe HTTP traffic. Affected product: BigBlueButton; vulnerable component: session cookie handling; root cause: absence of Secure flag on the cookie in HTTPS sessio...

CVE-2020-27606: Undefined Security Weakness

BigBlueButton before 2.2.28 or earlier does not set the secure flag for the session cookie in an https session, which makes it easier for remote attackers to capture this cookie by intercepting its transmission within an http session...

PT-2020-16716

Name of the Vulnerable Software and Affected Versions BigBlueButton versions prior to 2.2.28 Description The issue concerns the failure to set the secure flag for the session cookie in an https session. This makes it easier for remote attackers to capture the cookie by intercepting its transmissi...

PT-2020-14707

Name of the Vulnerable Software and Affected Versions SolarWinds N-Central versions prior to 12.3 GA Description The issue allows an attacker to influence the cookie with JavaScript, potentially extracting the JSESSIONID. This could be achieved by sending the user to a prepared webpage or by...

CVE-2020-4749

IBM Spectrum Scale 5.0.0 through 5.0.5.2 does not set the secure attribute on authorization tokens or session cookies. Attackers may be able to get the cookie values by sending a http:// link to a user or by planting this link in a site the user goes to. The cookie will be sent to the insecure li...

CVE-2020-4780

OOTB build scripts does not set the secure attribute on session cookie which may impact IBM Curam Social Program Management 7.0.9 and 7.0,10. The purpose of the 'secure' attribute is to prevent cookies from being observed by unauthorized parties. IBM X-Force ID: 189158...

CVE-2020-4780

OOTB build scripts does not set the secure attribute on session cookie which may impact IBM Curam Social Program Management 7.0.9 and 7.0,10. The purpose of the 'secure' attribute is to prevent cookies from being observed by unauthorized parties. IBM X-Force ID: 189158...

Buffer overflow

OOTB build scripts does not set the secure attribute on session cookie which may impact IBM Curam Social Program Management 7.0.9 and 7.0,10. The purpose of the 'secure' attribute is to prevent cookies from being observed by unauthorized parties. IBM X-Force ID: 189158...