CWE-614: Sensitive Cookie in HTTPS Session Without 'Secure' Attribute
The Secure attribute for sensitive cookies in HTTPS sessions is not set.
A kind of CWE-319 Cleartext Transmission of Sensitive Information.
From the CWE List. © The MITRE Corporation.
Newest
- No product listed WebDyne versions from 2.014 before 3.022 for Perl issue session cookies without the Secure, HttpOnly and SameSite attributes 5.4 Medium
- knime business hub Sensitive cookies without 'Secure' and 'HttpOnly' attributes in KNIME Business Hub 2.1 Low
- hcl software bigfix service management HCL BigFix Service Management is affected by multiple security vulnerabilities. 2.2 Low
- hcl icontrol HCL iControl is affected by a Missing Secure Attribute vulnerability 3.1 Low
- temporal technologies, inc. ui server Temporal UI Server may set OAuth credential cookies without Secure behind a TLS-terminating reverse proxy 2.3 Low
- ibm maximo application suite IBM MAS uses axios-1.15.2, protobufjs-8.0.1 and undici-7.26 which is vulnerable to multiple CVEs, and contains vulnerabilities related to missing Secure attribute on mas-redirect-uri cookie and weak H… 4.3 Medium
- hcl software mycloud, hcltech dryice mycloud +1 more HCL MyCloud was affected with Cookie Attribute Path Not Set 2.6 Low
- hcl software aftermarket epc HCL Aftermarket EPC is vulnerable to attack as cookie appears to contain a session token, which... 4.2 Medium
- pinpoint-apm pinpoint Pinpoint - Insecure Session Cookie Attributes in pinpointJwt 7.6 High
- malach-it boruta-server boruta-server sent sensitive session cookies without the Secure attribute 8.8 High
- twin gatus TwiN gatus OIDC Session Cookie oidc.go setSessionCookie missing secure attribute 6.3 Medium
- juev nebula-mesh nebula-mesh: Session and OIDC state cookies lack the Secure attribute 4.6 Medium
- haxtheweb haxcms-php HAX CMS Missing Secure Flag on Cookie 8.8 High
- hcl icontrol HCL iControl was affected by Missing Cookie Attributes vulnerability. 3.1 Low
- apache airflow Apache Airflow: JWT cookie missing Secure flag in JWTRefreshMiddleware behind HTTPS-terminating proxy 5.9 Medium
- apache shiro Apache Shiro: Shiro's native session and rememberMe cookies do not have secure flag set by default 5.9 Medium
- nocodb NocoDB: Refresh Token Cookie Set Without `Secure` and `SameSite` Flags 5.4 Medium
- eaton intelligent power protector, ipp software +1 more Eaton Intelligent Power Protector (IPP) uses an insecure cookie configuration, which could allow... 5.7 Medium
- ibm maximo application suite IBM Maximo Application Suite was vulnerable to because Cookie ltpatoken2_<workspace_name> was not set with secure flag 4.3 Medium
-
@grackle-ai/servernpm @grackle-ai/server has a Missing Secure Flag on Session Cookie 2.3 Low - jetbrains datalore In JetBrains Datalore before 2026.1 session hijacking was possible due to missing secure... 6.3 Medium
- arcinfo pcvue Use of unsecure cookies for GraphicalData web service and WebClient web app 5.3 Medium
- kentico xperience Kentico Xperience <= 13.0.164 Cookie Security Configuration 6.9 Medium
- ibm jazz for service management IBM Jazz for Service Management is vulnerable to "filter" cookie not sent over SSL 3.7 Low
- hcl software unica platform, hcltech unica +1 more HCL Unica Platform is affected by a Cookie without HTTPOnly Flag Set vulnerability 3.5 Low
- hcl aion HCL AION is susceptible to Missing Secure Attribute in Encrypted Session (SSL) Cookie vulnerability 6.5 Medium
- ibm jazz for service management IBM Jazz for Service Management information disclosure 4.3 Medium
- mozilla firefox, thunderbird +1 more Nameless cookies shadow secure cookies 9.1 Critical
- digisol xpon onu wi-fi router (dg-gr6821ac) Insecure Cookie Flags Vulnerability in Digisol DG-GR6821AC Router 8.7 High
- endress+hauser meac300-fnade4, endress meac300-fnade4 firmware +1 more CVE-2025-27450 6.5 Medium
- ibm datacap, datacap navigator +1 more IBM Datacap information disclosure 4.3 Medium
- phpipam, phpipam phpipam/phpipam +1 more Cookie without Secure attribute in phpipam/phpipam 5.3 Medium
- misskey Misskey CSRF vulnerability due to insecure configuration of authentication cookie attributes 8.2 High
-
org.openmrs.module:addresshierarchyMaven,org.openmrs.module:attachmentsMaven,org.openmrs.module:idgenMaven +3 more +5 more General OpenMRS Security Advisory, January 2025: Penetration Testing Results and Patches No score - otrs ag otrs Missing Cookie Flags 6.8 Medium
- ibm security directory integrator, security verify directory integrator +1 more IBM Security Directory Integrator information disclosure 4.8 Medium
- ibm security directory integrator, security verify directory integrator +1 more IBM Security Directory Integrator information disclosure 4.8 Medium
- cp plus cp-xr-de21-s router Security Misconfiguration Vulnerability in CP Plus Router 8.6 High
- ibm i, powerha system mirror +1 more IBM PowerHA SystemMirror for i information disclosure 4.3 Medium
- hcl software bigfix compliance HCL BigFix Compliance is affected by a missing secure flag on a cookie 3.8 Low
- ibm concert IBM Concert information disclosure 4.3 Medium
- avaiga taipy Session Cookie without Secure and HTTPOnly flags in taipy 6.3 Medium
- syrotech sy-gpon-1110-wdont router, sy-gpon-1110-wdont firmware +1 more Cookie Without Secure Flag Set Vulnerability 6.9 Medium
- ibm datacap, datacap navigator +1 more IBM Datacap Navigator information disclosure 4.3 Medium
- ibm security qradar edr IBM Security ReaQta information disclosure 5.3 Medium
- siemens sinec traffic analyzer A vulnerability has been identified in SINEC Traffic Analyzer (6GK8822-1BG01-0BA0) (All versions ... 6.8 Medium
- hitachi ops center analyzer, alaxala +1 more Session Hijacking Vulnerability in Hitachi Ops Center Analyzer 7.5 High
- ibm secure proxy, sterling secure proxy +1 more IBM Secure Proxy information disclosure 4.3 Medium
- ibm sterling b2b integrator IBM Sterling B2B Integrator information disclosure 4.3 Medium
- engineers online portal project online portal, sourcecodester engineers online portal +1 more SourceCodester Engineers Online Portal missing secure attribute 3.7 Low
- Show olderLoading…