Design/Logic Flaw

Red Hat OpenShift Enterprise 2 does not include the HTTPOnly flag in a Set-Cookie header for the GEARID cookie, which makes it easier for remote attackers to obtain potentially sensitive information via script access to the cookies...

CVE-2016-5409

Red Hat OpenShift Enterprise 2 is affected: the GEARID cookie’s Set-Cookie header does not set the HttpOnly flag, which could allow remote attackers to access potentially sensitive information via script. Root cause: missing HttpOnly on the GEARID cookie. Impact: disclosed information with partia...

CVE-2012-0891

Multiple cross-site scripting XSS vulnerabilities in Puppet Dashboard 1.0 before 1.2.5 and Enterprise 1.0 before 1.2.5 and 2.x before 2.0.1 allow remote attackers to inject arbitrary web script or HTML via unspecified fields...