CVE-2018-12302: Improper Neutralization of Input During Web Page Generation

Missing HTTPOnly flag on session cookies in the Seagate NAS OS version 4.3.15.1 web application allows attackers to steal session tokens via cross-site scripting...

PT-2018-13140

Name of the Vulnerable Software and Affected Versions BTITeam XBTIT version 2.5.4 Description An issue was discovered where the password hash of a user is rehashed using a predictable salt and stored in the pass cookie, which is not flagged as HTTPOnly. This allows an attacker who steals the cook...

Security Bulletin: IBM QRadar Incident Forensics is vulnerable to session highjacking. (CVE-2015-1994)

Summary IBM QRadar incident forensics authorization cookie is missing the httponly attribute. Vulnerability Details CVE-ID: CVE-2015-1994 Description: IBM Qradar Incident Forensics could allow a remote attacker to obtain sensitive information, caused by the failure to set the httponly attribute f...

PT-2017-6378

Name of the Vulnerable Software and Affected Versions Jenkins versions prior to 1.586 Description The issue makes it easier for remote attackers to obtain potentially sensitive information via script access to cookies, as the HttpOnly flag is not set in a Set-Cookie header for session cookies whe...

PT-2017-18962

Name of the Vulnerable Software and Affected Versions Cisco DPC3939 versions dpc3939-P20-18-v303r20421733-160420a-CMCST through dpc3939-P20-18-v303r20421746-170221a-CMCST Cisco DPC3939B version dpc3939b-v303r204217-150321a-CMCST Cisco DPC3941T version DPC3941 2.5s3 PROD sey Arris TG1682G version...

QNAP QTS < 4.2.4 Build 20170313 Multiple Vulnerabilities - Active Check

QNAP QTS web user interface is prone to multiple vulnerabilities SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/o:qnap:qts";...

CVE-2016-6344: Exposure of Sensitive Information to an Unauthorized Actor

Red Hat JBoss BPM Suite 6.3.x does not include the HTTPOnly flag in a Set-Cookie header for session cookies, which makes it easier for remote attackers to obtain potentially sensitive information via script access to the cookies...

PT-2015-6428

Name of the Vulnerable Software and Affected Versions Blue Coat SSL Visibility Appliance versions 3.6.x through 3.8.x before 3.8.4 Description The issue concerns the WebUI component, which fails to include the HTTPOnly flag in a Set-Cookie header for the administrator's cookie. This omission make...

CVE-2015-3983: Undefined Security Weakness

The pcs daemon pcsd in PCS 0.9.137 and earlier does not include the HTTPOnly flag in a Set-Cookie header, which makes it easier for remote attackers to obtain potentially sensitive information via script access to this cookie. NOTE: this issue was SPLIT from CVE-2015-1848 per ADT2 due to differen...

PT-2015-6371

Name of the Vulnerable Software and Affected Versions PCS versions 0.9.137 and earlier Description The issue allows remote attackers to obtain potentially sensitive information via script access to a cookie, as the HTTPOnly flag is not included in a Set-Cookie header. Recommendations For versions...

PT-2015-6147

Name of the Vulnerable Software and Affected Versions Hotspot Express hotEx Billing Manager version 73 Description The issue makes it easier for remote attackers to obtain potentially sensitive information via script access to a cookie, as the HTTPOnly flag is not included in a Set-Cookie header...

PT-2014-8904

Name of the Vulnerable Software and Affected Versions Zenoss Core versions through 5 Beta 3 Description The issue makes it easier for remote attackers to obtain credential information via script access to the authentication cookie, as the HTTPOnly flag is not included in the Set-Cookie header...

CVE-2014-8775: Exposure of Sensitive Information to an Unauthorized Actor

MODX Revolution 2.x before 2.2.15 does not include the HTTPOnly flag in a Set-Cookie header for the session cookie, which makes it easier for remote attackers to obtain potentially sensitive information via script access to this cookie...

CVE-2014-0174: Exposure of Sensitive Information to an Unauthorized Actor

Cumin aka MRG Management Console, as used in Red Hat Enterprise MRG 2.5, does not include the HTTPOnly flag in a Set-Cookie header for the session cookie, which makes it easier for remote attackers to obtain potentially sensitive information via script access to this cookie...

PT-2014-6058

Name of the Vulnerable Software and Affected Versions pfSense versions prior to 2.1.4 Description The issue allows remote attackers to obtain potentially sensitive information via script access to the session cookie, as the HTTPOnly flag is not included in the Set-Cookie header for the session...

PT-2014-2854

Name of the Vulnerable Software and Affected Versions DDSN Interactive cm3 Acora CMS versions 5.5.0/1b-p1 through 6.0.6/1a Description The issue allows remote attackers to obtain potentially sensitive information via script access to an unspecified cookie, as the HTTPOnly flag is not included in...

PT-2012-3581

Name of the Vulnerable Software and Affected Versions IBM Tivoli Endpoint Manager versions prior to 8.2 Description The issue concerns the webreports, post/create-role, and post/update-role programs in IBM Tivoli Endpoint Manager. These programs do not include the HTTPOnly flag in a Set-Cookie...

PT-2011-5059

Name of the Vulnerable Software and Affected Versions Parallels Plesk Panel version 10.2.0 build1011110331.18 Description The issue concerns the Server Administration Panel in Parallels Plesk Panel, where the HTTPOnly flag is not included in a Set-Cookie header for a cookie. This omission makes i...

PT-2011-5095

Name of the Vulnerable Software and Affected Versions Parallels Plesk Small Business Panel version 10.2.0 Description The issue concerns the Site Editor feature in Parallels Plesk Small Business Panel, where the HTTPOnly flag is not included in a Set-Cookie header for a cookie. This omission make...