PT-2015-5537

Name of the Vulnerable Software and Affected Versions IBM Security QRadar Incident Forensics versions 7.2.x through 7.2.5 before Patch 5 Description The issue makes it easier for remote attackers to capture cookies by intercepting their transmission within an http session, as the secure flag is n...

CVE-2015-1993: Undefined Security Weakness

IBM Security QRadar Incident Forensics 7.2.x before 7.2.5 Patch 5 does not set the secure flag for unspecified cookies in an https session, which makes it easier for remote attackers to capture these cookies by intercepting their transmission within an http session...

PT-2015-5551

Name of the Vulnerable Software and Affected Versions IBM WebSphere eXtreme Scale versions 7.1.0 through 7.1.0.2 IBM WebSphere eXtreme Scale versions 7.1.1 through 7.1.1.0 Description The issue makes it easier for remote attackers to capture the session cookie by intercepting its transmission...

CVE-2015-3155

Foreman before 1.8.1 does not set the secure flag for the sessionid cookie in an https session, which makes it easier for remote attackers to capture this cookie by intercepting its transmission within an http session...

CVE-2015-2855: Exposure of Sensitive Information to an Unauthorized Actor

The WebUI component in Blue Coat SSL Visibility Appliance SV800, SV1800, SV2800, and SV3800 3.6.x through 3.8.x before 3.8.4 does not set the secure flag for the administrator's cookie in an https session, which makes it easier for remote attackers to capture this cookie by intercepting its...

PT-2015-5940

Name of the Vulnerable Software and Affected Versions Blue Coat SSL Visibility Appliance versions 3.6.x through 3.8.x before 3.8.4 Description The issue concerns the WebUI component, which fails to set the secure flag for the administrator's cookie in an https session. This oversight makes it...

PT-2015-5504

Name of the Vulnerable Software and Affected Versions IBM Tivoli Endpoint Manager for Lifecycle Management versions 9.0.1 before IF6 IBM Tivoli Endpoint Manager for Lifecycle Management versions 9.1.0 before IF6 Description The issue concerns the Endpoint Manager for Remote Control component, whi...

CVE-2015-1848

The pcs daemon pcsd in PCS 0.9.137 and earlier does not set the secure flag for a cookie in an https session, which makes it easier for remote attackers to capture this cookie by intercepting its transmission within an http session. NOTE: this issue was SPLIT per ADT2 due to different vulnerabili...

CVE-2015-1848: Undefined Security Weakness

The pcs daemon pcsd in PCS 0.9.137 and earlier does not set the secure flag for a cookie in an https session, which makes it easier for remote attackers to capture this cookie by intercepting its transmission within an http session. NOTE: this issue was SPLIT per ADT2 due to different vulnerabili...

PT-2015-3585

Name of the Vulnerable Software and Affected Versions noVNC versions prior to 0.5 Description The issue concerns the transmission of a cookie in an https session. Specifically, the cookie does not have the secure flag set, which makes it easier for remote attackers to capture this cookie by...

CVE-2014-6153: Undefined Security Weakness

The Web UI in IBM WebSphere Service Registry and Repository WSRR 6.3.x through 6.3.0.5, 7.0.x through 7.0.0.5, 7.5.x through 7.5.0.4, 8.0.x before 8.0.0.3, and 8.5.x before 8.5.0.1 does not set the secure flag for a cookie in an https session, which makes it easier for remote attackers to capture...

PT-2014-7072

Name of the Vulnerable Software and Affected Versions IBM WebSphere Service Registry and Repository WSRR versions 6.3.x through 6.3.0.5 IBM WebSphere Service Registry and Repository WSRR versions 7.0.x through 7.0.0.5 IBM WebSphere Service Registry and Repository WSRR versions 7.5.x through 7.5.0...

PT-2014-5092

Name of the Vulnerable Software and Affected Versions IBM Rational ClearQuest versions 7.1 through 7.1.2.14 IBM Rational ClearQuest versions 8.0.0 through 8.0.0.11 IBM Rational ClearQuest versions 8.0.1 through 8.0.1.4 Description The issue arises because the Web component in IBM Rational...

CVE-2014-3103: Exposure of Sensitive Information to an Unauthorized Actor

The Web component in IBM Rational ClearQuest 7.1 before 7.1.2.15, 8.0.0 before 8.0.0.12, and 8.0.1 before 8.0.1.5 does not set the secure flag for the session cookie in an https session, which makes it easier for remote attackers to capture this cookie by intercepting its transmission within an...

PT-2014-5083

Name of the Vulnerable Software and Affected Versions IBM Jazz Team Server versions prior to 3.0.1.6 iFix 3 Rational Quality Manager versions 3.x before 3.0.1.6 iFix 3 Rational Quality Manager versions 4.x before 4.0.7 Rational Quality Manager versions 5.x before 5.0.1 Description The issue allow...

CVE-2014-3092: Exposure of Sensitive Information to an Unauthorized Actor

IBM Jazz Team Server, as used in Rational Collaborative Lifecycle Management; Rational Quality Manager 3.x before 3.0.1.6 iFix 3, 4.x before 4.0.7, and 5.x before 5.0.1; and other Rational products, does not set the secure flag for the session cookie in an https session, which makes it easier for...

PT-2014-3934

Name of the Vulnerable Software and Affected Versions IBM InfoSphere BigInsights versions 2.0 through 2.1.2 Description The issue makes it easier for remote attackers to capture the LTPA cookie by intercepting its transmission within an http session, as the secure flag is not set for the LTPA...

Session fixation

DDSN Interactive cm3 Acora CMS 6.0.6/1a, 6.0.2/1a, 5.5.7/12b, 5.5.0/1b-p1, and possibly other versions, does not set the secure flag for an unspecified cookie in an https session, which makes it easier for remote attackers to capture this cookie by intercepting its transmission within an http...

CVE-2013-4725: Exposure of Sensitive Information to an Unauthorized Actor

DDSN Interactive cm3 Acora CMS 6.0.6/1a, 6.0.2/1a, 5.5.7/12b, 5.5.0/1b-p1, and possibly other versions, does not set the secure flag for an unspecified cookie in an https session, which makes it easier for remote attackers to capture this cookie by intercepting its transmission within an http...

PT-2014-2727

Name of the Vulnerable Software and Affected Versions IBM Sametime versions 8.x through 8.5.2.1 IBM Sametime versions 9.x through 9.0.0.1 Description The issue concerns the Meeting Server in IBM Sametime, where it fails to set the secure flag for a cookie during an https session. This makes it...