CVE-2020-26732

SKYWORTH GN542VF Hardware Version 2.0 and Software Version 2.0.0.16 does not set the Secure flag for the session cookie in an HTTPS session, which makes it easier for remote attackers to capture this cookie by intercepting its transmission within an HTTP session...

Console: HTTPOnly and Secure attributes not set on cookies in Red Hat AMQ

It was found that Hawtio console does not set HTTPOnly or Secure attributes on cookies. An attacker could use this flaw to rerieve an authenticated user's SessionID, and possibly conduct further attacks with the permissions of the authenticated user...

Shopify: Removing parts of URL from jQuery request exposes links for download of Paid Digital Assets of the most recent Order placed by anyone on the store!

Please Note: I found this bug on a website made using Shopify I tried doing the same with my Shopify store but I was not able to buy anything as it was required to add credit card details which I don't have : THE LINKS GIVEN AS THE EXAMPLE ARE NOT VALID LINKS BUT THE BUG WORKS ON EVERY SHOPIFY...

Security Vulnerabilities fixed in Firefox 83 — Mozilla

A parsing and event loading mismatch in Firefox's SVG code could have allowed load events to fire, even after sanitization. An attacker already capable of exploiting an XSS vulnerability in privileged internal pages could have used this attack to bypass our built-in sanitizer. Incorrect bookkeepi...

CVE-2020-4763

IBM Sterling File Gateway 6.0.0.0 through 6.0.3.2 and 2.2.0.0 through 2.2.6.5 does not set the secure attribute on authorization tokens or session cookies. Attackers may be able to get the cookie values by sending a http:// link to a user or by planting this link in a site the user goes to. The...

Authorization

IBM Sterling File Gateway 2.2.0.0 through 2.2.6.5 and 6.0.0.0 through 6.0.3.2 does not set the secure attribute on authorization tokens or session cookies. Attackers may be able to get the cookie values by sending a http:// link to a user or by planting this link in a site the user goes to. The...

CVE-2020-4763

IBM Sterling File Gateway 6.0.0.0 through 6.0.3.2 and 2.2.0.0 through 2.2.6.5 does not set the secure attribute on authorization tokens or session cookies. Attackers may be able to get the cookie values by sending a http:// link to a user or by planting this link in a site the user goes to. The...

IBM Sterling File Gateway Sensitive Information Access Vulnerability

IBM Sterling File Gateway is a centralized management gateway product for file transfers from IBM USA. IBM Sterling File Gateway suffers from a sensitive information acquisition vulnerability that stems from a failure to set a security attribute on an authorization token or session cookie. An...

Synology Router Manager Information Disclosure Vulnerability (CNVD-2020-60462)

Synology Router Manager SRM is a software for configuring and managing Synology routers from Synology Inc. of Taiwan, China. An information disclosure vulnerability exists in Synology Router Manager SRM versions prior to 1.2.4-8081, which stems from a failure to include the HTTPOnly flag in the...

MGASA-2020-0387 Updated php packages fix a security vulnerability

In PHP versions 7.2.x when PHP is processing incoming HTTP cookie values, the cookie names are url-decoded. This may lead to cookies with prefixes like Host confused with cookies that decode to such prefix, thus leading to an attacker being able to forge cookie which is supposed to be secure...

CVE-2020-4780

CVE-2020-4780 affects IBM Cúram Social Program Management (Curam SPM) 7.0.9 and 7.0.10. The root cause is that the OOTB build scripts do not set the secure attribute on the session cookie, enabling potential cookie exposure to unauthorized parties. Impact is described as cookies possibly being ob...

CVE-2019-4688

IBM Security Guardium Data Encryption GDE 3.0.0.2 does not set the secure attribute on authorization tokens or session cookies. Attackers may be able to get the cookie values by sending a http:// link to a user or by planting this link in a site the user goes to. The cookie will be sent to the...

CVE-2019-4688

CVE-2019-4688 affects IBM Guardium Data Encryption (GDE) 3.0.0.2, which does not set the secure attribute on authorization tokens or session cookies. This omission could allow an attacker to obtain cookie values by luring a user to click an http:// link or via a malicious site, enabling cookie sn...

CVE-2020-4316

IBM Publishing Engine is affected by CVE-2020-4316 due to not setting the secure attribute on authorization tokens and session cookies. Impact: cookies may be exposed when a user visits an http link or a site embedding it, allowing eavesdropping of cookie values. Affected versions: IBM Publishing...

PT-2020-19062 · Sap · Sap Disclosure Management

Name of the Vulnerable Software and Affected Versions: SAP Disclosure Management version 10.1 Description: The issue concerns sensitive cookies missing the HttpOnly flag in SAP Disclosure Management, which can lead to sensitive cookies being accessed without the HttpOnly flag. This affects the...

PT-2020-4159 · Microsoft +3 · Asp.Net Core +3

Name of the Vulnerable Software and Affected Versions: ASP.NET Core affected versions not specified Description: A security feature bypass issue exists in the way ASP.NET Core parses encoded cookie names. The ASP.NET Core cookie parser decodes entire cookie strings, which could allow a malicious...

Design/Logic Flaw

An issue was discovered in Mattermost Server before 3.0.0. It does not ensure that a cookie is used over SSL...

TopManage OLK Elevation of Privilege Vulnerability

TopManage OLK is a suite of e-commerce management solutions from TopManage Panama. A security vulnerability exists in TopManage OLK version 2020, which stems from the program's failure to set ReadOnly for session cookies, and can be exploited by an attacker to compromise user and administrator...

CVE-2012-0718

IBM Tivoli Endpoint Manager 8 does not set the HttpOnly flag on cookies...

CVE-2013-3637

ProjectPier 0.8.8 does not use the Secure flag for cookies...