{"cve":"CVE-2021-35236","nvd":{"published":"2021-10-27T01:15:07.530","modified":"2026-06-17T03:57:21.457","status":"Modified","description":"The Secure flag is not set in the SSL Cookie of Kiwi Syslog Server 9.7.2 and previous versions. The Secure attribute tells the browser to only send the cookie if the request is being sent over a secure channel such as HTTPS. This will help protect the cookie from being passed over unencrypted requests. If the application can be accessed over both HTTP, there is a potential for the cookie can be sent in clear text.","cvss_v4":null,"cvss_v3":{"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","score":5.3},"cwes":["CWE-311","CWE-614"],"references":["https://documentation.solarwinds.com/en/success_center/kss/content/release_notes/kss_9-8_release_notes.htm","https://www.solarwinds.com/trust-center/security-advisories/cve-2021-35236","https://documentation.solarwinds.com/en/success_center/kss/content/release_notes/kss_9-8_release_notes.htm","https://www.solarwinds.com/trust-center/security-advisories/cve-2021-35236"],"products":["solarwinds:kiwi_syslog_server"],"source":"nvd","synced_at":"2026-10-19T21:24:39.218183596+00:00"},"epss":{"cve":"CVE-2021-35236","score":0.00519,"percentile":0.44123,"date":"2026-10-31"},"kev":null,"osv":[],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}