Information disclosure

IBM Cloud Pak for Security 1.3.0.1CP4S could allow a remote attacker to obtain sensitive information, caused by the failure to set the HTTPOnly flag. A remote attacker could exploit this vulnerability to obtain sensitive information from the cookie...

PT-2020-18171

Name of the Vulnerable Software and Affected Versions IBM Cloud Pak for Security version 1.3.0.1CP4S Description The issue is caused by the failure to set the HTTPOnly flag, allowing a remote attacker to obtain sensitive information. A remote attacker could exploit this to obtain sensitive...

CVE-2020-4625: Incorrect Permission Assignment for Critical Resource

IBM Cloud Pak for Security 1.3.0.1CP4S could allow a remote attacker to obtain sensitive information, caused by the failure to set the HTTPOnly flag. A remote attacker could exploit this vulnerability to obtain sensitive information from the cookie...

Security Bulletin: CP4S 1.3.0.1 fails to use HTTPOnly flag (CVE-2020-4625)

Summary IBM Cloud Pak for Security CP4S could allow a remote attacker to obtain sensitive information, caused by the failure to set the HTTPOnly flag. A remote attacker could exploit this vulnerability to obtain sensitive information from the cookie. Vulnerability Details CVEID: CVE-2020-4625...

CVE-2020-4625

IBM Cloud Pak for Security 1.3.0.1CP4S could allow a remote attacker to obtain sensitive information, caused by the failure to set the HTTPOnly flag. A remote attacker could exploit this vulnerability to obtain sensitive information from the cookie...

IBM Cloud Pak for Security Information Leakage Vulnerability

IBM Cloud Pak for Security is an integrated security tool that uses a unified interface to provide deep insight into threats in hybrid multi-cloud environments. An information disclosure vulnerability exists in IBM Cloud Pak for Security 1.3.0.1. The vulnerability stems from the HTTPOnly flag not...

CVE-2020-25473

SimplePHPscripts News Script PHP Pro 2.3 does not properly set the HttpOnly Flag from Session Cookies...

CVE-2020-25473

SimplePHPscripts News Script PHP Pro 2.3 does not properly set the HttpOnly Flag from Session Cookies...

Session fixation

SimplePHPscripts News Script PHP Pro 2.3 does not properly set the HttpOnly Flag from Session Cookies...

CVE-2020-25473

SimplePHPscripts News Script PHP Pro 2.3 does not properly set the HttpOnly Flag from Session Cookies...

CVE-2020-25473

CVE-2020-25473 affects SimplePHPscripts News Script PHP Pro 2.3. The root cause is that HttpOnly is not set on session cookies, potentially exposing session data to client-side access. The NVD notes a network attack vector with low complexity and no authentication required, leading to partial con...

Simplephpscripts News Script PHP Pro Security Vulnerability

Simplephpscripts Simplephpscripts News Script PHP Pro is a Php Mysql based news distribution system by Simplephpscripts Bulgaria. A security vulnerability exists in SimplePHPscripts News Script PHP Pro version 2.3 that stems from not properly setting the HttpOnly flag from the session cookie...

PT-2020-16092

Name of the Vulnerable Software and Affected Versions SimplePHPscripts News Script PHP Pro version 2.3 Description The issue is related to the improper setting of the HttpOnly Flag from Session Cookies. This could potentially allow unauthorized access to session cookies. Recommendations For...

CVE-2020-25473: Undefined Security Weakness

SimplePHPscripts News Script PHP Pro 2.3 does not properly set the HttpOnly Flag from Session Cookies...

Synology Router Manager Information Disclosure Vulnerability (CNVD-2020-60462)

Synology Router Manager SRM is a software for configuring and managing Synology routers from Synology Inc. of Taiwan, China. An information disclosure vulnerability exists in Synology Router Manager SRM versions prior to 1.2.4-8081, which stems from a failure to include the HTTPOnly flag in the...

Synology SRM web interface session cookie HttpOnly flag information disclosure vulnerability

Talos Vulnerability Report TALOS-2020-1086 Synology SRM web interface session cookie HttpOnly flag information disclosure vulnerability October 30, 2020 CVE Number CVE-2020-27658 SUMMARY An exploitable information disclosure vulnerability exists in the web interface session cookie functionality o...

Design/Logic Flaw

Synology Router Manager SRM before 1.2.4-8081 does not include the HTTPOnly flag in a Set-Cookie header for the session cookie, which makes it easier for remote attackers to obtain potentially sensitive information via script access to this cookie...

PT-2020-4938

Name of the Vulnerable Software and Affected Versions: Synology Router Manager SRM versions prior to 1.2.4-8081 Description: The issue is related to the absence of the HttpOnly flag in session cookies. This makes it easier for remote attackers to obtain potentially sensitive information via scrip...

CVE-2020-27658: Sensitive Cookie Without 'HttpOnly' Flag

Synology Router Manager SRM before 1.2.4-8081 does not include the HTTPOnly flag in a Set-Cookie header for the session cookie, which makes it easier for remote attackers to obtain potentially sensitive information via script access to this cookie...

PT-2020-14707

Name of the Vulnerable Software and Affected Versions SolarWinds N-Central versions prior to 12.3 GA Description The issue allows an attacker to influence the cookie with JavaScript, potentially extracting the JSESSIONID. This could be achieved by sending the user to a prepared webpage or by...