PT-2014-5083

Name of the Vulnerable Software and Affected Versions IBM Jazz Team Server versions prior to 3.0.1.6 iFix 3 Rational Quality Manager versions 3.x before 3.0.1.6 iFix 3 Rational Quality Manager versions 4.x before 4.0.7 Rational Quality Manager versions 5.x before 5.0.1 Description The issue allow...

CVE-2014-3092: Exposure of Sensitive Information to an Unauthorized Actor

IBM Jazz Team Server, as used in Rational Collaborative Lifecycle Management; Rational Quality Manager 3.x before 3.0.1.6 iFix 3, 4.x before 4.0.7, and 5.x before 5.0.1; and other Rational products, does not set the secure flag for the session cookie in an https session, which makes it easier for...

PT-2014-3934

Name of the Vulnerable Software and Affected Versions IBM InfoSphere BigInsights versions 2.0 through 2.1.2 Description The issue makes it easier for remote attackers to capture the LTPA cookie by intercepting its transmission within an http session, as the secure flag is not set for the LTPA...

Session fixation

DDSN Interactive cm3 Acora CMS 6.0.6/1a, 6.0.2/1a, 5.5.7/12b, 5.5.0/1b-p1, and possibly other versions, does not set the secure flag for an unspecified cookie in an https session, which makes it easier for remote attackers to capture this cookie by intercepting its transmission within an http...

CVE-2013-4725: Exposure of Sensitive Information to an Unauthorized Actor

DDSN Interactive cm3 Acora CMS 6.0.6/1a, 6.0.2/1a, 5.5.7/12b, 5.5.0/1b-p1, and possibly other versions, does not set the secure flag for an unspecified cookie in an https session, which makes it easier for remote attackers to capture this cookie by intercepting its transmission within an http...

PT-2014-2727

Name of the Vulnerable Software and Affected Versions IBM Sametime versions 8.x through 8.5.2.1 IBM Sametime versions 9.x through 9.0.0.1 Description The issue concerns the Meeting Server in IBM Sametime, where it fails to set the secure flag for a cookie during an https session. This makes it...

CVE-2013-3984: Exposure of Sensitive Information to an Unauthorized Actor

The Meeting Server in IBM Sametime 8.x through 8.5.2.1 and 9.x through 9.0.0.1 does not set the secure flag for an unspecified cookie in an https session, which makes it easier for remote attackers to capture this cookie by intercepting its transmission within an http session...

IRCCloud: Unsecure cookies, cookie flag secure not set

Since you are running on a secure connection, https, you should be ensuring that everything runs securely on your client's / visitors case. I have check the cookie session of IRCCloud and found out that it is not flag as secure. Whenever a cookie contains sensitive information or is a session...

CVE-2013-4964: Undefined Security Weakness

Puppet Enterprise before 3.0.1 does not set the secure flag for the session cookie in an https session, which makes it easier for remote attackers to capture this cookie by intercepting its transmission within an http session...

PT-2013-1849

Name of the Vulnerable Software and Affected Versions IBM Sterling B2B Integrator versions 5.1 through 5.2 IBM Sterling File Gateway versions 2.1 through 2.2 Description The issue allows remote attackers to capture session cookies by intercepting their transmission within an http session, as the...

CVE-2012-5936: Undefined Security Weakness

IBM Sterling B2B Integrator 5.1 and 5.2 and Sterling File Gateway 2.1 and 2.2 do not set the secure flag for the session cookie in an https session, which makes it easier for remote attackers to capture this cookie by intercepting its transmission within an http session...

PT-2013-2406

Name of the Vulnerable Software and Affected Versions IBM Sterling Connect:Direct versions 1.4 through 1.4.0.10 IBM Sterling Connect:Direct versions 1.5 through 1.5.0.1 Description The issue concerns the Browser component in IBM Sterling Connect:Direct, where it fails to set the secure flag for t...

CVE-2012-2058: Undefined Security Weakness

The Ubercart Payflow module for Drupal does not use a secure token, which allows remote attackers to forge payments via unspecified vectors...

PT-2012-1360

Name of the Vulnerable Software and Affected Versions Websense Web Security and Web Filter versions prior to 7.1 Hotfix 21 Description The issue allows remote attackers to capture the Encrypted Session SSL cookie by intercepting its transmission within an http session, as the secure flag is not s...

CVE-2012-4592: Undefined Security Weakness

The Portal in McAfee Enterprise Mobility Manager EMM before 10.0 does not set the secure flag for the ASP.NET session cookie in an https session, which makes it easier for remote attackers to capture this cookie by intercepting its transmission within an http session...

PT-2012-5500

Name of the Vulnerable Software and Affected Versions McAfee Enterprise Mobility Manager EMM versions prior to 10.0 Description The issue concerns the Portal in McAfee Enterprise Mobility Manager EMM where the secure flag for the ASP.NET session cookie is not set in an https session. This makes i...

CVE-2011-4728: Exposure of Sensitive Information to an Unauthorized Actor

The Server Administration Panel in Parallels Plesk Panel 10.2.0build1011110331.18 does not set the secure flag for a cookie in an https session, which makes it easier for remote attackers to capture this cookie by intercepting its transmission within an http session, as demonstrated by cookies us...

CVE-2011-4849: Exposure of Sensitive Information to an Unauthorized Actor

The Control Panel in Parallels Plesk Panel 10.4.4build20111103.18 does not set the secure flag for a cookie in an https session, which makes it easier for remote attackers to capture this cookie by intercepting its transmission within an http session, as demonstrated by cookies used by help.php a...

PT-2011-5140

Name of the Vulnerable Software and Affected Versions Parallels Plesk Panel version 10.4.4 build20111103.18 Description The issue concerns the Control Panel in Parallels Plesk Panel, which fails to set the secure flag for a cookie in an https session. This oversight makes it easier for remote...

PT-2011-1312

Name of the Vulnerable Software and Affected Versions Hastymail2 versions prior to RC 8 Description The issue allows remote attackers to capture the session cookie by intercepting its transmission within an http session, as the secure flag for the session cookie is not set in an https session...