581 matches found
PT-2019-14567
Name of the Vulnerable Software and Affected Versions Limesurvey versions prior to 3.17.14 Description The issue allows attackers to access a cookie value via a client-side script because Limesurvey uses an anti-CSRF cookie without the HttpOnly flag. Recommendations For versions prior to 3.17.14,...
CVE-2019-16187: Incorrect Permission Assignment for Critical Resource
Limesurvey before 3.17.14 uses an anti-CSRF cookie without the HttpOnly flag, which allows attackers to access a cookie value via a client-side script...
CVE-2019-0341
The session cookie used by SAP Enable Now, version 1902, does not have the HttpOnly flag set. If an attacker runs script code in the context of the application, he could get access to the session cookie. The session cookie could then be abused to gain access to the application...
Design/Logic Flaw
The session cookie used by SAP Enable Now, version 1902, does not have the HttpOnly flag set. If an attacker runs script code in the context of the application, he could get access to the session cookie. The session cookie could then be abused to gain access to the application...
CVE-2019-0341
The CVE-2019-0341 affects SAP Enable Now, version 1902, where the session cookie is missing the HttpOnly flag. This allows script code executed in the application context to access the session cookie and potentially abuse it to gain access to the application. The connected documents corroborate t...
CVE-2019-0341: Incorrect Permission Assignment for Critical Resource
The session cookie used by SAP Enable Now, version 1902, does not have the HttpOnly flag set. If an attacker runs script code in the context of the application, he could get access to the session cookie. The session cookie could then be abused to gain access to the application...
CVE-2019-12927
MailEnable Enterprise Premium 10.23 was vulnerable to stored and reflected cross-site scripting XSS attacks. Because the session cookie did not use the HttpOnly flag, it was possible to hijack the session cookie by exploiting this vulnerability...
CVE-2019-12927
MailEnable Enterprise Premium 10.23 was vulnerable to stored and reflected cross-site scripting XSS attacks. Because the session cookie did not use the HttpOnly flag, it was possible to hijack the session cookie by exploiting this vulnerability...
PT-2019-13027
Name of the Vulnerable Software and Affected Versions MailEnable Enterprise Premium version 10.23 Description The issue allows for stored and reflected cross-site scripting XSS attacks. It is also possible to hijack the session cookie due to the lack of the HttpOnly flag, which can be exploited t...
CVE-2019-12927: Improper Neutralization of Input During Web Page Generation
MailEnable Enterprise Premium 10.23 was vulnerable to stored and reflected cross-site scripting XSS attacks. Because the session cookie did not use the HttpOnly flag, it was possible to hijack the session cookie by exploiting this vulnerability...
CVE-2018-10692
An issue was discovered on Moxa AWK-3121 1.14 devices. The session cookie "Password508" does not have an HttpOnly flag. This allows an attacker who is able to execute a cross-site scripting attack to steal the cookie very easily...
Cross site scripting
An issue was discovered on Moxa AWK-3121 1.14 devices. The session cookie "Password508" does not have an HttpOnly flag. This allows an attacker who is able to execute a cross-site scripting attack to steal the cookie very easily...
CVE-2018-10692
The CVE-2018-10692 issue affects Moxa AWK-3121 devices (version 1.14) where the session cookie Password508 is not HttpOnly, enabling a cross-site scripting attacker to steal the cookie. Connected sources (NVD, CISA/ICS advisory, and Nessus plugin) confirm this vulnerability is tied to the HTTP co...
CVE-2019-8283
Hasplm cookie in Gemalto Admin Control Center, all versions prior to 7.92, does not have 'HttpOnly' flag. This allows malicious javascript to steal it...
Default credentials
Hasplm cookie in Gemalto Admin Control Center, all versions prior to 7.92, does not have 'HttpOnly' flag. This allows malicious javascript to steal it...
CVE-2019-8283
Hasplm cookie in Gemalto Admin Control Center, all versions prior to 7.92, does not have 'HttpOnly' flag. This allows malicious javascript to steal it...
PT-2019-18964
Name of the Vulnerable Software and Affected Versions Gemalto Admin Control Center versions prior to 7.92 Description The issue concerns the Hasplm cookie, which lacks the 'HttpOnly' flag, allowing malicious javascript to steal it. Recommendations For versions prior to 7.92, consider setting the...
CVE-2019-8283: Sensitive Cookie Without 'HttpOnly' Flag
Hasplm cookie in Gemalto Admin Control Center, all versions prior to 7.92, does not have 'HttpOnly' flag. This allows malicious javascript to steal it...
CVE-2018-10692: Improper Neutralization of Input During Web Page Generation
An issue was discovered on Moxa AWK-3121 1.14 devices. The session cookie "Password508" does not have an HttpOnly flag. This allows an attacker who is able to execute a cross-site scripting attack to steal the cookie very easily...