CVE-2019-14849

A vulnerability was found in 3scale before version 2.6, did not set the HTTPOnly attribute on the user session cookie. An attacker could use this to conduct cross site scripting attacks and gain access to unauthorized information...

Red Hat 3scale Cross-Site Scripting Vulnerability

Red Hat 3scale is a suite of API Application Programming Interface lifecycle management software from Red Hat. A cross-site scripting vulnerability exists in Red Hat 3scale, which stems from a user session cookie that fails to set HTTPOnly, and can be exploited by an attacker to conduct cross-sit...

Centreon VM Memory Corruption Vulnerability

Centreon Merethis Centreon is a set of open source system monitoring tools from the French company Centreon . The product mainly provides monitoring capabilities for network, system and application resources.Centreon VM is the virtual machine version of Centreon. A security vulnerability exists i...

CVE-2019-8283

Hasplm cookie in Gemalto Admin Control Center, all versions prior to 7.92, does not have 'HttpOnly' flag. This allows malicious javascript to steal it...

Retrieval of HTTP-only cookies

More info at https://www.passbolt.com/incidents/20190211multiplevulnerabilities...

Console: HTTPOnly and Secure attributes not set on cookies in Red Hat AMQ

It was found that Hawtio console does not set HTTPOnly or Secure attributes on cookies. An attacker could use this flaw to rerieve an authenticated user's SessionID, and possibly conduct further attacks with the permissions of the authenticated user...

Mozilla Firefox Information Disclosure Vulnerability (CNVD-2018-02232)

Mozilla Firefox is an open source web browser developed by the Mozilla Foundation in the United States. A security vulnerability exists in versions prior to Mozilla Firefox 58. The vulnerability can be exploited by an attacker to access cookie values when an existing cookie is set to HttpOnly...

UBUNTU-CVE-2018-5114

If an existing cookie is changed to be "HttpOnly" while a document is open, the original value remains accessible through script until that document is closed. Network requests correctly use the changed HttpOnly cookie. This vulnerability affects Firefox 58...

CVE-2015-2156

Netty before 3.9.8.Final, 3.10.x before 3.10.3.Final, 4.0.x before 4.0.28.Final, and 4.1.x before 4.1.0.Beta5 and Play Framework 2.x before 2.3.9 might allow remote attackers to bypass the httpOnly flag on cookies and obtain sensitive information by leveraging improper validation of cookie name a...

DEBIAN-CVE-2015-2156

Netty before 3.9.8.Final, 3.10.x before 3.10.3.Final, 4.0.x before 4.0.28.Final, and 4.1.x before 4.1.0.Beta5 and Play Framework 2.x before 2.3.9 might allow remote attackers to bypass the httpOnly flag on cookies and obtain sensitive information by leveraging improper validation of cookie name a...

CVE-2016-5409

Red Hat OpenShift Enterprise 2 does not include the HTTPOnly flag in a Set-Cookie header for the GEARID cookie, which makes it easier for remote attackers to obtain potentially sensitive information via script access to the cookies...

CVE-2016-2304

Ecava IntegraXor before 5.0 build 4522 does not include the HTTPOnly flag in a Set-Cookie header for the session cookie, which makes it easier for remote attackers to obtain potentially sensitive information via script access to this cookie...

ownCloud: owncloud.com: Cross Site Tracing

REQUEST: TRACE / HTTP/1.0 Host: owncloud.com Cookie: 74b33b43fa RESPONSE: HTTP/1.1 200 OK Date: Wed, 19 Aug 2015 06:59:31 GMT Server: Apache/2.2.17 Linux/SUSE Connection: close Content-Type: message/http TRACE / HTTP/1.0 Host: owncloud.com Cookie: 74b33b43fa; wordpresstestcookie=WP+Cookie+check;...

foreman: the _session_id cookie is issued without the Secure flag

It was found that Foreman did not set the HttpOnly flag on session cookies. This could allow a malicious script to access the session cookie...

Red Hat PCS Backend Program Set-Cookie Header Information Disclosure Vulnerability

Red Hat is an operating system based on the linux kernel. An information disclosure vulnerability exists in the Set-Cookie header of the PCSD backend program in Red Hat PCS, which allows remote attackers to exploit the vulnerability to gain access to sensitive information via a scripted access...

Red Hat oVirt Engine Information Disclosure Vulnerability

Red Hat oVirt Engine is an open source virtualization management platform, an open source version of RHEV Platform for Enterprise Virtualization, consisting of an oVirt-node client and an overt-engine manager. A security vulnerability exists in Red Hat oVirt Engine 3.4.4 and earlier versions, whe...

PT-2015-3597 · Ovirt · Ovirt Engine

Name of the Vulnerable Software and Affected Versions: oVirt Engine versions prior to 3.5.0 Description: The issue allows remote attackers to obtain potentially sensitive information via script access to session IDs due to the missing HTTPOnly flag in the Set-Cookie header. Recommendations: For...

cumin: session cookies lack httponly setting

It was found that Cumin did not set the HttpOnly flag on session cookies. This could allow a malicious script to access the session cookie...

cumin: session cookies lack httponly setting

It was found that Cumin did not set the HttpOnly flag on session cookies. This could allow a malicious script to access the session cookie...

Mastery OA contents of the log stored XSS can get the cookie-vulnerability warning-the black bar safety net

Mastery OA2013 and 2 0 1 0 version, Office Anywhere 2 0 1 3 work log edit page there is the storage typeXSS, and their superiors view the log after you can steal the cookie 1, the work log edit page source code to bypass the bypass a character can be constructedXSS! ! ! 1, the interception to giv...