CWE-1004: Sensitive Cookie Without 'HttpOnly' Flag
The product uses a cookie to store sensitive information, but the cookie is not marked with the HttpOnly flag.
A kind of CWE-732 Incorrect Permission Assignment for Critical Resource.
From the CWE List. © The MITRE Corporation.
Newest
- No product listed WebDyne versions from 2.014 before 3.022 for Perl issue session cookies without the Secure, HttpOnly and SameSite attributes 5.4 Medium
- knime business hub Sensitive cookies without 'Secure' and 'HttpOnly' attributes in KNIME Business Hub 2.1 Low
- aio-libs aiohttp AIOHTTP: Secure attribute not enforced for shared cookie 6.3 Medium
- cyber-iii student-management-system sambitraj Student-Management-System session_start cookie httponly flag 6.3 Medium
- adenhq hive HCL Hive is affected by multiple security vulnerabilities. 5.4 Medium
- openidentityplatform openam OpenAM Insecure SSO Cookie Initialization 7.4 High
- pinpoint-apm pinpoint Pinpoint - Insecure Session Cookie Attributes in pinpointJwt 7.6 High
- twin gatus TwiN gatus OIDC Session Cookie oidc.go setSessionCookie missing secure attribute 6.3 Medium
- budibase Budibase auth session cookies are set with httpOnly:false — any XSS can lead to full account takeover 8.1 High
- churchcrm, churchcrm crm +1 more ChurchCRM has Blind XSS via Global Search – Administrative Cookie Session Exfiltration 8.6 High
- churchcrm, churchcrm crm +1 more ChurchCRM has Stored XSS in Group Name 8.0 High
- cern rucio Rucio WebUI has a Stored Cross-site Scripting (XSS) Vulnerability in its Custom RSE Attribute 6.1 Medium
- cern rucio Rucio WebUI has a Stored Cross-site Scripting (XSS) vulnerability its Identity Name 6.1 Medium
- cern rucio Rucio WebUI has Stored Cross-site Scripting (XSS) in RSE Metadata 6.1 Medium
- cern rucio Rucio WebUI Vulnerable to Stored Cross-site Scripting (XSS) through Custom Rule Function 7.3 High
- cern rucio Rucio WebUI has a Reflected Cross-site Scripting Vulnerability 8.1 High
- connectwise psa, professional service automation +1 more Session Cookies Missing HttpOnly Attribute 6.5 Medium
- tenda 300mbps wireless router f3 and n300 easy setup router Cookie without HTTPOnly Flag Vulnerability in Tenda Wireless Routers 8.8 High
- rocketsoftware trufusion enterprise TRUfusion Enterprise through 7.10.4.0 exposes the encrypted COOKIEID as an authentication... 7.5 High
- azure access technology blu-ic2, blu-ic4, azure-access blu-ic2 firmware +1 more +3 more HTTP Security Misconfiguration - Lacking Secure and HTTPOnly Attribute 5.3 Medium
- sap se cloud appliance library appliances Security Misconfiguration vulnerability in SAP Cloud Appliance Library Appliances 3.0 Low
- No product listed A stored cross-site scripting (XSS) vulnerability exists in the MyCourts v3 application within... 7.3 High
- digisol xpon onu wi-fi router (dg-gr6821ac) Insecure Cookie Flags Vulnerability in Digisol DG-GR6821AC Router 8.7 High
- endress meac300-fnade4 firmware, endress+hauser meac300-fnade4 +1 more CVE-2025-27453 5.3 Medium
- sick media server Cookie missing HttpOnly flag 5.3 Medium
- phoenixcart ce phoenix cart, ce-phoenixcart phoenixcart +1 more Stored XSS in CE Phoenix Cart Testimonials Allows Account Takeover if Missing HttpOnly Flag 6.3 Medium
- znuny An issue was discovered in Znuny through 7.1.3. A cookie is set without the HttpOnly flag. 9.8 Critical
- dario health application database and internet-based server infrastructure Dario Health USB-C Blood Glucose Monitoring System Starter Kit Android Application Sensitive Cookie Without 'HttpOnly' Flag 5.9 Medium
- cp plus cp-xr-de21-s router Security Misconfiguration Vulnerability in CP Plus Router 8.6 High
- ibm aspera console IBM Aspera Console information disclosure 3.7 Low
- avaiga taipy Session Cookie without Secure and HTTPOnly flags in taipy 6.3 Medium
- ibm security directory integrator, security verify directory integrator +1 more IBM Security Directory Integrator information disclosure 3.7 Low
- syrotech sy-gpon-1110-wdont router, sy-gpon-1110-wdont firmware +1 more Cookie Without HTTPOnly Flag Set Vulnerability 6.9 Medium
- openfind mailaudit, mailgates +1 more Openfind MailGates and MailAudit - Sensitive Cookie Without 'HttpOnly' Flag 5.3 Medium
-
typo3/cmsPackagist TYPO3 Security Misconfiguration in Install Tool Cookie 8.1 High -
typo3/cms-corePackagist TYPO3 Security Misconfiguration in Install Tool Cookie 7.5 High - moxa pt-g503 series, eds-g503 firmware +1 more Session cookies attribute not set properly 3.1 Low
- moxa iologik 4000 series, iologik e4200 firmware +1 more ioLogik 4000 Series: Session Cookies Attribute Not Set Properly 3.1 Low
- abb rex640 pcl1, rex640 pcl2, rex640 pcl3 +3 more +5 more Session cookie exposure for client side script 3.1 Low
- johnson controls system configuration tool (sct), johnsoncontrols metasys system configuration tool +1 more Sensitive cookie without 'HttpOnly' flag in System Configuration Tool (SCT) 7.5 High
- nsupdate nsupdate.info nsupdate.info CSRF Cookie base.py cookie httponly flag 3.7 Low
- daloradius, lirantal lirantal/daloradius +1 more Sensitive Cookie Without 'HttpOnly' Flag in lirantal/daloradius 5.3 Medium
- inhand networks inrouter302, inhandnetworks ir302 firmware +1 more An information disclosure vulnerability exists in the web interface session cookie functionality... 7.5 High
- business-dna solutions gmbh topease Missing HTTPOnly flag on sensitive cookie in TopEase 8.1 High
- glpi-project glpi Autologin cookie accessible by scripts 6.5 Medium
- pi-hole pi-hole/adminlte, web interface +1 more Sensitive Cookie Without 'HttpOnly' Flag in pi-hole/adminlte 7.4 High
- pepperl-fuchs wha-gw-f2d2-0-as-z2-eth.eip firmware, wha-gw-f2d2-0-as-z2-eth firmware, phoenix contact wha-gw-f2d2-0-as- z2-eth +1 more +3 more In WirelessHART-Gateway versions 3.0.8 and 3.0.9 the HttpOnly flag is missing in a cookie which allows client-side javascript to modify it 3.3 Low
- synology router manager, router manager (srm) +1 more Synology Router Manager (SRM) before 1.2.4-8081 does not include the HTTPOnly flag in a Set... 7.1 High
- sap disclosure management Some sensitive cookies in SAP Disclosure Management, version 10.1, are missing HttpOnly flag,... 6.3 Medium
- gemalto sentinel ldk Hasplm cookie in Gemalto Admin Control Center, all versions prior to 7.92, does not have ... 6.5 Medium
- Show olderLoading…