RHEL 5 / 6 : flash-plugin (RHSA-2014:1852)

The remote Redhat Enterprise Linux 5 / 6 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2014:1852 advisory. The flash-plugin package contains a Mozilla Firefox compatible Adobe Flash Player web browser plug-in. This update fixes multiple...

CVE-2014-8525

McAfee Network Data Loss Prevention NDLP before 9.3 does not include the HTTPOnly flag in a Set-Cookie header for the session cookie, which makes it easier for remote attackers to obtain potentially sensitive information via script access to this cookie...

CVE-2014-8525

McAfee Network Data Loss Prevention NDLP before 9.3 does not include the HTTPOnly flag in a Set-Cookie header for the session cookie, which makes it easier for remote attackers to obtain potentially sensitive information via script access to this cookie...

PT-2014-8588

Name of the Vulnerable Software and Affected Versions McAfee Network Data Loss Prevention NDLP versions prior to 9.3 Description The issue makes it easier for remote attackers to obtain potentially sensitive information via script access to the session cookie, as the HTTPOnly flag is not included...

CVE-2013-7408

F5 BIG-IP Analytics 11.x before 11.4.0 uses a predictable session cookie, which makes it easier for remote attackers to have unspecified impact by guessing the value...

Code injection

F5 BIG-IP Analytics 11.x before 11.4.0 uses a predictable session cookie, which makes it easier for remote attackers to have unspecified impact by guessing the value...

CVE-2013-7408

Summary of CVE-2013-7408 (F5 BIG-IP Analytics): 11.x before 11.4.0 uses a predictable analytics session cookie, allowing remote attackers to guess the cookie value with unspecified impact. The vulnerability affects BIG-IP Analytics across multiple sources, with evidence in Red Hat and F5 advisory...

CVE-2013-7408: Undefined Security Weakness

F5 BIG-IP Analytics 11.x before 11.4.0 uses a predictable session cookie, which makes it easier for remote attackers to have unspecified impact by guessing the value...

PT-2014-3423

Name of the Vulnerable Software and Affected Versions F5 BIG-IP Analytics versions 11.x before 11.4.0 Description The issue is related to a predictable session cookie, which could allow remote attackers to have an unspecified impact by guessing the cookie value. Recommendations For F5 BIG-IP...

CVE-2014-4830: Undefined Security Weakness

IBM Security QRadar SIEM QRM 7.1 MR1 and QRM/QVM 7.2 MR2 does not include the HTTPOnly flag in a Set-Cookie header for the session cookie, which makes it easier for remote attackers to obtain potentially sensitive information via script access to this cookie...

PT-2014-6148

Name of the Vulnerable Software and Affected Versions IBM Security QRadar SIEM QRM versions 7.1 MR1 through 7.2 MR2 Description The issue allows remote attackers to obtain potentially sensitive information via script access to a session cookie, as the HTTPOnly flag is not included in the Set-Cook...

IBM Jazz Team Server Session Cookie Information Disclosure

The remote IBM Jazz Team server is using a session cookie without the 'Secure' flag. A failure to set this flag may allow an attacker to intercept the cookie. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. include'deprecatednasllevel.inc'; include'compat.inc'; if description scriptid78066;...

CVE-2014-3060

Unspecified vulnerability on the IBM WebSphere DataPower XC10 appliance 2.5 allows remote attackers to obtain administrative privileges by leveraging access to an eXtreme Scale distributed ObjectGrid network and capturing a session cookie...

Code injection

Unspecified vulnerability on the IBM WebSphere DataPower XC10 appliance 2.5 allows remote attackers to obtain administrative privileges by leveraging access to an eXtreme Scale distributed ObjectGrid network and capturing a session cookie...

PT-2014-5054

Name of the Vulnerable Software and Affected Versions IBM WebSphere DataPower XC10 appliance version 2.5 Description The issue allows remote attackers to gain administrative privileges. This can be achieved by accessing an eXtreme Scale distributed ObjectGrid network and capturing a session cooki...

CVE-2014-3060

Unspecified vulnerability on the IBM WebSphere DataPower XC10 appliance 2.5 allows remote attackers to obtain administrative privileges by leveraging access to an eXtreme Scale distributed ObjectGrid network and capturing a session cookie...

CVE-2014-3060: Undefined Security Weakness

Unspecified vulnerability on the IBM WebSphere DataPower XC10 appliance 2.5 allows remote attackers to obtain administrative privileges by leveraging access to an eXtreme Scale distributed ObjectGrid network and capturing a session cookie...

CVE-2014-3103

The Web component in IBM Rational ClearQuest 7.1 before 7.1.2.15, 8.0.0 before 8.0.0.12, and 8.0.1 before 8.0.1.5 does not set the secure flag for the session cookie in an https session, which makes it easier for remote attackers to capture this cookie by intercepting its transmission within an...

Session fixation

The Web component in IBM Rational ClearQuest 7.1 before 7.1.2.15, 8.0.0 before 8.0.0.12, and 8.0.1 before 8.0.1.5 does not set the secure flag for the session cookie in an https session, which makes it easier for remote attackers to capture this cookie by intercepting its transmission within an...

CVE-2014-3103

The CVE-2014-3103 entry applies to IBM Rational ClearQuest Web. Affected: ClearQuest Web sessions using SSL where the session cookie lacks the Secure attribute, enabling potential interception of cookies transmitted over HTTP. Affected versions include 7.1.x (up to 7.1.2.15), 8.0.x (up to 8.0.0.1...