DEBIAN-CVE-2013-7436

noVNC before 0.5 does not set the secure flag for a cookie in an https session, which makes it easier for remote attackers to capture this cookie by intercepting its transmission within an http session...

UBUNTU-CVE-2013-7436

noVNC before 0.5 does not set the secure flag for a cookie in an https session, which makes it easier for remote attackers to capture this cookie by intercepting its transmission within an http session...

X (Formerly Twitter): Headers Missing

Hellow Twiiter, i found that some of the headers are missing on the domain ads.twitter,com! Name Actual Value My Recommendation strict-transport-security max-age=631138519 Use 'max-age=31536000; includeSubDomains' set-cookie guestid=v1%3A141600...ov-2016 23:50:40 UTC Add 'secure; httponly;'...

SA-CONTRIB-2014-004 - Secure Cookie Data - Faulty Hashing

This module allows for storing data securely in a cookie through implementing the Secure Cookie Protocol. Ability to alter trusted data in the cookie The module did an incorrect comparison of the HMAC value, allowing a bypass of the HMAC verification which allows changing the cookie value. Known...

Google Chrome Secure Cookie Security Bypass Vulnerability - Mac OS X

Google Chrome is prone to a security bypass vulnerability. SPDX-FileCopyrightText: 2011 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Google Chrome Secure Cookie Security Bypass Vulnerability - Windows

Google Chrome is prone to a security bypass vulnerability. SPDX-FileCopyrightText: 2011 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Apple Safari Secure Cookie Security Bypass Vulnerability - Mac OS X

Apple Safari web browser is prone to a security bypass vulnerability. SPDX-FileCopyrightText: 2011 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

Apple Safari Secure Cookie Security Bypass Vulnerability (Mac OS X)

The host is installed with Apple Safari web browser and is prone to security bypass vulnerability. OpenVAS Vulnerability Test $Id: gbapplesafaricookiesecbypassvulnmacosx.nasl 7015 2017-08-28 11:51:24Z teissa $ Apple Safari Secure Cookie Security Bypass Vulnerability Mac OS X Authors: Sooraj KS...

Apple Safari Secure Cookie Security Bypass Vulnerability - Windows

Apple Safari web browser is prone to a security bypass vulnerability. SPDX-FileCopyrightText: 2011 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

[BMSA-2011-01] Insecure secure cookie in web.go

BLUE MOON SECURITY ADVISORY 2011-01 =================================== :Title: Insecure secure cookie in web.go :Severity: Low :Reporter: Blue Moon Consulting :Products: web.go :Fixed in: -- Description ----------- web.go is the simplest way to write web applications in the Go programming...

Option to disable "secure" cookie when using HTTPS just for login page

Confluence's "remember me" tickbox doesn't work if the login page is secure, but the rest of the application is unsecured. Seraph's CookieUtils.setCookie method create a secure cookie ref|http://www.apps.ietf.org/rfc/rfc2965.htmlpage-7 if the request had a secure URL, and this cookie isn't sent b...

Option to disable "secure" cookie when using HTTPS just for login page

Confluence's "remember me" tickbox doesn't work if the login page is secure, but the rest of the application is unsecured. Seraph's CookieUtils.setCookie method create a secure cookie ref|http://www.apps.ietf.org/rfc/rfc2965.htmlpage-7 if the request had a secure URL, and this cookie isn't sent b...

Technical note: under some conditions, it's possible to steal HTTP credentials using Flash

Technical note: under some conditions, it's possible to steal HTTP credentials using Flash requires IE + some transparent proxies or virtual hosting The method described here is pretty simple. It works though only on HTTP not HTTPS credentials. Also, it works only when the client browses using IE...

Multiple networking devices fail to set the "Secure" attribute of a cookie

Overview Multiple vendors' networking devices fail to set the "Secure" cookie attribute and could disclose sensitive information about a user's HTTP session. Description Many networking devices provide a built-in web server, which may support the HTTPS protocol. When a user logs into the device...

Secure cookie access in Knoqueror

Cookie with secure flag may be sent via unsecured channel...

KDE Security Advisory: Secure Cookie Vulnerability

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 KDE Security Advisory: Secure Cookie Vulnerability Original Release Date: 2002-09-08 URL: http://www.kde.org/info/security/advisory-20020908-1.txt 0. References None. 1. Systems affected: Konqueror in KDE 3.0, KDE 3.0.1 and KDE 3.0.2. KDE 2.2.2 and KD...

Проблемы с Secure Session Id в IIS

При использовании защищенного соединения не генируется Secure Cookie для передачи Session Id, вместо это используется тот же ID что и для незащищенного соединения, что позволяет перехватить защищенное соединение...