CVE-2021-42115: Sensitive Cookie Without 'HttpOnly' Flag

Missing HTTPOnly flag in Web Applications operating on Business-DNA Solutions GmbH’s TopEase® Platform Version = 7.1.27 allows an unauthenticated remote attacker to escalate privileges from unauthenticated to authenticated user via stealing and injecting the session- independent and static cookie...

PT-2021-23539

Name of the Vulnerable Software and Affected Versions TopEase Platform versions prior to 7.1.28 Description The issue concerns a missing HTTPOnly flag in web applications on the TopEase Platform, allowing an unauthenticated remote attacker to escalate privileges by stealing and injecting a static...

PT-2021-12116

Name of the Vulnerable Software and Affected Versions: IBM Security SiteProtector System version 3.1.1 Description: The issue is caused by a missing 'HttpOnly' flag, allowing a remote attacker to obtain sensitive information. A remote attacker could exploit this to obtain sensitive information...

CVE-2020-4146: Incorrect Permission Assignment for Critical Resource

IBM Security SiteProtector System 3.1.1 could allow a remote attacker to obtain sensitive information, caused by missing 'HttpOnly' flag. A remote attacker could exploit this vulnerability to obtain sensitive information. IBM X-Force ID: 174129...

CVE-2021-20526: Incorrect Permission Assignment for Critical Resource

IBM Planning Analytics 2.0 could allow a remote attacker to obtain sensitive information, caused by the failure to set the HTTPOnly flag. A remote attacker could exploit this vulnerability to obtain sensitive information from the cookie. IBM X-Force ID: 198755...

CVE-2021-39210: Sensitive Cookie Without 'HttpOnly' Flag

GLPI is a free Asset and IT management software package. In versions prior to 9.5.6, the cookie used to store the autologin cookie when a user uses the "remember me" feature is accessible by scripts. A malicious plugin that could steal this cookie would be able to use it to autologin. This issue ...

CVE-2021-3706: Sensitive Cookie Without 'HttpOnly' Flag

adminlte is vulnerable to Sensitive Cookie Without 'HttpOnly' Flag...

WS-2021-0642

Sensitive Cookie Without 'HttpOnly' Flag in flatpressblog/flatpress. HTTPOnly attribute is not set for session cookies in the application...

CVE-2021-29247

BTCPay Server through 1.0.7.0 could allow a remote attacker to obtain sensitive information, caused by failure to set the HTTPOnly flag for a cookie...

CVE-2021-29247: Incorrect Permission Assignment for Critical Resource

BTCPay Server through 1.0.7.0 could allow a remote attacker to obtain sensitive information, caused by failure to set the HTTPOnly flag for a cookie...

CVE-2020-28482

This affects the package fastify-csrf before 3.0.0. 1. The generated cookie used insecure defaults, and did not have the httpOnly flag on: cookieOpts: path: '/', sameSite: true 2. The CSRF token was available in the GET query parameter...

PT-2020-18171

Name of the Vulnerable Software and Affected Versions IBM Cloud Pak for Security version 1.3.0.1CP4S Description The issue is caused by the failure to set the HTTPOnly flag, allowing a remote attacker to obtain sensitive information. A remote attacker could exploit this to obtain sensitive...

CVE-2020-27658: Sensitive Cookie Without 'HttpOnly' Flag

Synology Router Manager SRM before 1.2.4-8081 does not include the HTTPOnly flag in a Set-Cookie header for the session cookie, which makes it easier for remote attackers to obtain potentially sensitive information via script access to this cookie...

CVE-2020-6267: Sensitive Cookie Without 'HttpOnly' Flag

Some sensitive cookies in SAP Disclosure Management, version 10.1, are missing HttpOnly flag, leading to sensitive cookie without Http Only flag...

CVE-2019-19003: Improper Neutralization of Input During Web Page Generation

For ABB eSOMS versions 4.0 to 6.0.2, the HTTPOnly flag is not set. This can allow Javascript to access the cookie contents, which in turn might enable Cross Site Scripting...

CVE-2012-0718

IBM Tivoli Endpoint Manager 8 does not set the HttpOnly flag on cookies...

CVE-2019-17104: Reliance on Cookies without Validation and Integrity Checking

In Centreon VM through 19.04.3, the cookie configuration within the Apache HTTP Server does not protect against theft because the HTTPOnly flag is not set...

PT-2019-14567

Name of the Vulnerable Software and Affected Versions Limesurvey versions prior to 3.17.14 Description The issue allows attackers to access a cookie value via a client-side script because Limesurvey uses an anti-CSRF cookie without the HttpOnly flag. Recommendations For versions prior to 3.17.14,...

CVE-2019-16187: Incorrect Permission Assignment for Critical Resource

Limesurvey before 3.17.14 uses an anti-CSRF cookie without the HttpOnly flag, which allows attackers to access a cookie value via a client-side script...

PT-2019-18964

Name of the Vulnerable Software and Affected Versions Gemalto Admin Control Center versions prior to 7.92 Description The issue concerns the Hasplm cookie, which lacks the 'HttpOnly' flag, allowing malicious javascript to steal it. Recommendations For versions prior to 7.92, consider setting the...