PT-2020-18194

Name of the Vulnerable Software and Affected Versions IBM Sterling File Gateway versions 2.2.0.0 through 2.2.6.5 IBM Sterling File Gateway versions 6.0.0.0 through 6.0.3.2 Description The issue concerns the failure to set the secure attribute on authorization tokens or session cookies. Attackers...

PT-2020-10971

Name of the Vulnerable Software and Affected Versions IBM Security Directory Server version 6.4.0 Description The issue allows attackers to obtain cookie values by sending a user to an insecure link or by planting such a link in a site the user visits. This can be done because the secure attribut...

CVE-2020-4749: Reliance on Cookies without Validation and Integrity Checking

IBM Spectrum Scale 5.0.0 through 5.0.5.2 does not set the secure attribute on authorization tokens or session cookies. Attackers may be able to get the cookie values by sending a http:// link to a user or by planting this link in a site the user goes to. The cookie will be sent to the insecure li...

CVE-2020-4780

OOTB build scripts does not set the secure attribute on session cookie which may impact IBM Curam Social Program Management 7.0.9 and 7.0,10. The purpose of the 'secure' attribute is to prevent cookies from being observed by unauthorized parties. IBM X-Force ID: 189158...

CVE-2019-4688: Reliance on Cookies without Validation and Integrity Checking

IBM Security Guardium Data Encryption GDE 3.0.0.2 does not set the secure attribute on authorization tokens or session cookies. Attackers may be able to get the cookie values by sending a http:// link to a user or by planting this link in a site the user goes to. The cookie will be sent to the...

PT-2020-11024

Name of the Vulnerable Software and Affected Versions IBM Security Guardium Data Encryption GDE version 3.0.0.2 Description The issue allows attackers to obtain cookie values by sending a http link to a user or by planting this link in a site the user visits. The cookie will be sent to the insecu...

PT-2020-11023

Name of the Vulnerable Software and Affected Versions IBM Security Guardium Data Encryption GDE version 3.0.0.2 Description The issue allows attackers to obtain cookie values by sending a http link to a user or by planting this link in a site the user visits. The cookie will be sent to the insecu...

CVE-2020-4316: Undefined Security Weakness

IBM Publishing Engine 6.0.6, 6.0.6.1, and 7.0 does not set the secure attribute on authorization tokens or session cookies. Attackers may be able to get the cookie values by sending a http:// link to a user or by planting this link in a site the user goes to. The cookie will be sent to the insecu...

CVE-2020-4173: Undefined Security Weakness

IBM Guardium Activity Insights 10.6 and 11.0 does not set the secure attribute on authorization tokens or session cookies. Attackers may be able to get the cookie values by sending a http:// link to a user or by planting this link in a site the user goes to. The cookie will be sent to the insecur...

PT-2020-17896

Name of the Vulnerable Software and Affected Versions IBM Guardium Activity Insights versions 10.6 through 11.0 Description The issue allows attackers to obtain cookie values by sending a http link to a user or by planting this link in a site the user visits. The cookie will be sent to the insecu...

CVE-2019-4638: Reliance on Cookies without Validation and Integrity Checking

IBM Security Secret Server 10.7 does not set the secure attribute on authorization tokens or session cookies. This could allow an attacker to obtain sensitive information using man in the middle techniques. IBM X-Force ID: 170044...

PT-2019-15826

Name of the Vulnerable Software and Affected Versions Octopus Deploy versions prior to 2019.10.7 Octopus Deploy versions 2019.6 prior to 2019.6.14 Octopus Deploy versions 2019.9 prior to 2019.9.8 Description The issue arises in configurations where SSL offloading is enabled, leading to the CSRF...

CVE-2019-4330: Reliance on Cookies without Validation and Integrity Checking

IBM Security Guardium Big Data Intelligence SonarG 4.0 does not set the secure attribute for cookies in HTTPS sessions, which could cause the user agent to send those cookies in plaintext over an HTTP session. IBM X-Force ID: 161210...

PT-2019-9829

Name of the Vulnerable Software and Affected Versions IBM Security Identity Governance and Intelligence versions 5.2 through 5.2.4.1 Virtual Appliance Description The issue allows attackers to obtain cookie values by sending a http link to a user or by planting this link in a site the user visits...

Security Bulletin: IBM Tivoli Federated Identity Manager is affected by a missing secure attribute in the encrypted session (SSL) cookie (CVE-2017-1319)

Summary IBM Tivoli Federated Identity Manager is affected by a vulnerability due to a missing secure attribute in encrypted session SSL cookie. Vulnerability Details CVEID: CVE-2017-1319 DESCRIPTION: IBM Tivoli Federated Identity Manager is affected by a vulnerability due to a missing secure...

CVE-2017-1319: Inadequate Encryption Strength

IBM Tivoli Federated Identity Manager 6.2 is affected by a vulnerability due to a missing secure attribute in encrypted session SSL cookie. IBM X-Force ID: 125731...

PT-2017-12959

Name of the Vulnerable Software and Affected Versions IBM Tivoli Federated Identity Manager version 6.2 Description The issue arises from a missing secure attribute in an encrypted session SSL cookie. Recommendations For IBM Tivoli Federated Identity Manager version 6.2, ensure that the secure...

CVE-2008-2558: Undefined Security Weakness

CRE Loaded 6.2.13.1 and earlier does not set the "Secure" attribute for cookies that are sent over HTTPS, which might allow remote attackers to sniff the cookies if they are sent over HTTP...

CVE-2004-0462: Undefined Security Weakness

The built-in web servers for multiple networking devices do not set the Secure attribute for sensitive cookies in HTTPS sessions, which could cause the user agent to send those cookies in plaintext over an HTTP session with the same server...