79 matches found
CVE-2019-25091: Sensitive Cookie Without 'HttpOnly' Flag
A vulnerability classified as problematic has been found in nsupdate.info. This affects an unknown part of the file src/nsupdate/settings/base.py of the component CSRF Cookie Handler. The manipulation of the argument CSRFCOOKIEHTTPONLY leads to cookie without 'httponly' flag. It is possible to...
nsupdate.info 安全漏洞
nsupdate.info is a free dynamic DNS service in the nsupdate.info development open source. A security vulnerability exists in nsupdate.info, which stems from a mishandling of the parameter CSRFCOOKIEHTTPONLY that results in a cookie without the "httponly" flag...
CVE-2022-22330: Incorrect Permission Assignment for Critical Resource
IBM Control Desk 7.6.1 could allow a remote attacker to obtain sensitive information, caused by the failure to set the HTTPOnly flag. A remote attacker could exploit this vulnerability to obtain sensitive information from the cookie. IBM X-Force ID: 219126...
CVE-2022-32778
An information disclosure vulnerability exists in the cookie functionality of WWBN AVideo 11.6 and dev master commit 3f7c0364. The session cookie and the pass cookie miss the HttpOnly flag, making them accessible via JavaScript. The session cookie also misses the secure flag, which allows the...
CVE-2015-3207
In Openshift Origin 3 the cookies being set in console have no 'secure', 'HttpOnly' attributes...
CVE-2015-3207: Sensitive Cookie in HTTPS Session Without 'Secure' Attribute
In Openshift Origin 3 the cookies being set in console have no 'secure', 'HttpOnly' attributes...
CVE-2021-20355: Incorrect Permission Assignment for Critical Resource
IBM Jazz Team Server 6.0.6, 6.0.6.1, 7.0, 7.0.1, and 7.0.2 could allow a remote attacker to obtain sensitive information, caused by the failure to set the HTTPOnly flag. A remote attacker could exploit this vulnerability to obtain sensitive information from the cookie. IBM X-Force ID: 194891...
CVE-2021-40649
In Connx Version 6.2.0.1269 20210623, a cookie can be issued by the application and not have the HttpOnly flag set...
CVE-2022-25151: Sensitive Cookie in HTTPS Session Without 'Secure' Attribute
Within the Service Desk module of the ITarian platform SAAS and on-premise, a remote attacker can obtain sensitive information, caused by the failure to set the HTTP Only flag. A remote attacker could exploit this vulnerability to gain access to the management interface by using this vulnerabilit...
CVE-2021-27764: Sensitive Cookie in HTTPS Session Without 'Secure' Attribute
Cookie without HTTPONLY flag set. NUMBER cookies was set without Secure or HTTPOnly flags. The images show the cookie with the missing flag. WebUI...
CVE-2021-42115
Missing HTTPOnly flag in Web Applications operating on Business-DNA Solutions GmbH’s TopEase® Platform Version = 7.1.27 allows an unauthenticated remote attacker to escalate privileges from unauthenticated to authenticated user via stealing and injecting the session- independent and static cookie...
CVE-2021-42115
Missing HTTPOnly flag in Web Applications operating on Business-DNA Solutions GmbH’s TopEase® Platform Version = 7.1.27 allows an unauthenticated remote attacker to escalate privileges from unauthenticated to authenticated user via stealing and injecting the session- independent and static cookie...
Design/Logic Flaw
Missing HTTPOnly flag in Web Applications operating on Business-DNA Solutions GmbH’s TopEase® Platform Version = 7.1.27 allows an unauthenticated remote attacker to escalate privileges from unauthenticated to authenticated user via stealing and injecting the session- independent and static...
CVE-2021-42115 Missing HTTPOnly flag on sensitive cookie in TopEase
Missing HTTPOnly flag in Web Applications operating on Business-DNA Solutions GmbH’s TopEase® Platform Version = 7.1.27 allows an unauthenticated remote attacker to escalate privileges from unauthenticated to authenticated user via stealing and injecting the session- independent and static cookie...
PT-2021-23539
Name of the Vulnerable Software and Affected Versions TopEase Platform versions prior to 7.1.28 Description The issue concerns a missing HTTPOnly flag in web applications on the TopEase Platform, allowing an unauthenticated remote attacker to escalate privileges by stealing and injecting a static...
CVE-2021-42115: Sensitive Cookie Without 'HttpOnly' Flag
Missing HTTPOnly flag in Web Applications operating on Business-DNA Solutions GmbH’s TopEase® Platform Version = 7.1.27 allows an unauthenticated remote attacker to escalate privileges from unauthenticated to authenticated user via stealing and injecting the session- independent and static cookie...
CVE-2020-4146: Incorrect Permission Assignment for Critical Resource
IBM Security SiteProtector System 3.1.1 could allow a remote attacker to obtain sensitive information, caused by missing 'HttpOnly' flag. A remote attacker could exploit this vulnerability to obtain sensitive information. IBM X-Force ID: 174129...
PT-2021-12116
Name of the Vulnerable Software and Affected Versions: IBM Security SiteProtector System version 3.1.1 Description: The issue is caused by a missing 'HttpOnly' flag, allowing a remote attacker to obtain sensitive information. A remote attacker could exploit this to obtain sensitive information...
CVE-2021-20526: Incorrect Permission Assignment for Critical Resource
IBM Planning Analytics 2.0 could allow a remote attacker to obtain sensitive information, caused by the failure to set the HTTPOnly flag. A remote attacker could exploit this vulnerability to obtain sensitive information from the cookie. IBM X-Force ID: 198755...