CVE-2021-39210: Sensitive Cookie Without 'HttpOnly' Flag

GLPI is a free Asset and IT management software package. In versions prior to 9.5.6, the cookie used to store the autologin cookie when a user uses the "remember me" feature is accessible by scripts. A malicious plugin that could steal this cookie would be able to use it to autologin. This issue ...

CVE-2021-3706: Sensitive Cookie Without 'HttpOnly' Flag

adminlte is vulnerable to Sensitive Cookie Without 'HttpOnly' Flag...

WS-2021-0642

Sensitive Cookie Without 'HttpOnly' Flag in flatpressblog/flatpress. HTTPOnly attribute is not set for session cookies in the application...

CVE-2021-29247

BTCPay Server through 1.0.7.0 could allow a remote attacker to obtain sensitive information, caused by failure to set the HTTPOnly flag for a cookie...

BTCPay Server 信息泄露漏洞

BTCPay Server is a self-hosted open source cryptocurrency payment processor. It is secure, private, uncensored and free. A cross-site scripting vulnerability exists in BTCPay Server 1.0.7.0 and earlier versions. The vulnerability stems from a failure to set the HTTPOnly flag for cookies. An...

CVE-2021-29247: Incorrect Permission Assignment for Critical Resource

BTCPay Server through 1.0.7.0 could allow a remote attacker to obtain sensitive information, caused by failure to set the HTTPOnly flag for a cookie...

CVE-2020-28482

This affects the package fastify-csrf before 3.0.0. 1. The generated cookie used insecure defaults, and did not have the httpOnly flag on: cookieOpts: path: '/', sameSite: true 2. The CSRF token was available in the GET query parameter...

Fastify Fastify-csrf Cross-Site Request Forgery Vulnerability

Fastify Fastify-csrf is a Javascript-based plugin that provides CSRF protection for Fastify in the Fastify community. A security vulnerability exists in fastify-csrf before 3.0.0 due to an insecure default value being used in the generated cookie, no httpOnly, and CSRF tokens being available in t...

PT-2021-11545

Name of the Vulnerable Software and Affected Versions: fastify-csrf versions prior to 3.0.0 Description: The issue affects the fastify-csrf package, where the generated cookie uses insecure defaults and lacks the httpOnly flag, as seen in cookieOpts: path: '/', sameSite: true . Additionally, the...

PT-2020-18171

Name of the Vulnerable Software and Affected Versions IBM Cloud Pak for Security version 1.3.0.1CP4S Description The issue is caused by the failure to set the HTTPOnly flag, allowing a remote attacker to obtain sensitive information. A remote attacker could exploit this to obtain sensitive...

CVE-2020-27658: Sensitive Cookie Without 'HttpOnly' Flag

Synology Router Manager SRM before 1.2.4-8081 does not include the HTTPOnly flag in a Set-Cookie header for the session cookie, which makes it easier for remote attackers to obtain potentially sensitive information via script access to this cookie...

CVE-2020-6267: Sensitive Cookie Without 'HttpOnly' Flag

Some sensitive cookies in SAP Disclosure Management, version 10.1, are missing HttpOnly flag, leading to sensitive cookie without Http Only flag...

CVE-2019-19003: Improper Neutralization of Input During Web Page Generation

For ABB eSOMS versions 4.0 to 6.0.2, the HTTPOnly flag is not set. This can allow Javascript to access the cookie contents, which in turn might enable Cross Site Scripting...

CVE-2012-0718

IBM Tivoli Endpoint Manager 8 does not set the HttpOnly flag on cookies...

CVE-2019-17104: Reliance on Cookies without Validation and Integrity Checking

In Centreon VM through 19.04.3, the cookie configuration within the Apache HTTP Server does not protect against theft because the HTTPOnly flag is not set...

PT-2019-14567

Name of the Vulnerable Software and Affected Versions Limesurvey versions prior to 3.17.14 Description The issue allows attackers to access a cookie value via a client-side script because Limesurvey uses an anti-CSRF cookie without the HttpOnly flag. Recommendations For versions prior to 3.17.14,...

CVE-2019-16187: Incorrect Permission Assignment for Critical Resource

Limesurvey before 3.17.14 uses an anti-CSRF cookie without the HttpOnly flag, which allows attackers to access a cookie value via a client-side script...

PT-2019-18964

Name of the Vulnerable Software and Affected Versions Gemalto Admin Control Center versions prior to 7.92 Description The issue concerns the Hasplm cookie, which lacks the 'HttpOnly' flag, allowing malicious javascript to steal it. Recommendations For versions prior to 7.92, consider setting the...

CVE-2018-10692: Improper Neutralization of Input During Web Page Generation

An issue was discovered on Moxa AWK-3121 1.14 devices. The session cookie "Password508" does not have an HttpOnly flag. This allows an attacker who is able to execute a cross-site scripting attack to steal the cookie very easily...

PT-2019-8889

Name of the Vulnerable Software and Affected Versions Seagate NAS OS version 4.3.15.1 Description The issue concerns a missing HTTPOnly flag on session cookies in the web application of Seagate NAS OS, which allows attackers to steal session tokens via cross-site scripting. Recommendations For...