cve.bz

CWE-614: Sensitive Cookie in HTTPS Session Without 'Secure' Attribute, page 2

Filter

The Secure attribute for sensitive cookies in HTTPS sessions is not set.

What the weakness is: CWE-614 at MITRE. OWASP Top 10: A02:2025 Security Misconfiguration

Related attack patterns (CAPEC): 1
  • CAPEC-102 Session Sidejacking Likelihood: High · Severity: High

The attack patterns MITRE's CAPEC relates to CWE-614, as MITRE names them. Credits.

Ask an AI about CWE-614

ChatGPTClaudeGoogle AI Mode

Show the promptExplain CWE-614: Sensitive Cookie in HTTPS Session Without 'Secure' Attribute and how to prevent and detect it in code. Use https://cwe.mitre.org/data/definitions/614.html and https://cve.bz/cve/cwe/614?via=ask-ai-copy for recent CVEs with this weakness. Cite the sources.

Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this weakness's id and public links.

  1. 3.5CVE-2023-4654EPSS 0.3%

    Sensitive Cookie in HTTPS Session Without 'Secure' Attribute in GitHub repository instantsoft/icms2 prior to 2.16.1.

  2. 4.6CVE-2023-3520EPSS 0.3%

    Sensitive Cookie in HTTPS Session Without 'Secure' Attribute in GitHub repository it-novum/openitcockpit prior to 4.6.6.

  3. 6.1CVE-2022-21940EPSS 0.4%

    Sensitive Cookie in HTTPS Session Without 'Secure' Attribute vulnerability in Johnson Controls System Configuration Tool (SCT) version 14 prior to 14.2.3 and version 15 prior to 15.0.3 could allow access to the cookie.

  4. 5.3CVE-2023-0055EPSS 0.5%

    Sensitive Cookie in HTTPS Session Without 'Secure' Attribute in GitHub repository pyload/pyload prior to 0.5.0b3.dev32.

  5. 7.5CVE-2018-25060EPSS 0.6%

    A vulnerability was found in Macaron csrf and classified as problematic. Affected by this issue is some unknown functionality of the file csrf.go. The manipulation of the argument Generate leads to sensitive cookie without secure attribute…

  6. 6.5CVE-2022-4683EPSS 0.4%

    Sensitive Cookie in HTTPS Session Without 'Secure' Attribute in GitHub repository usememos/memos prior to 0.9.0.

  7. 7.5CVE-2022-4409EPSS 0.5%

    Sensitive Cookie in HTTPS Session Without 'Secure' Attribute in GitHub repository thorsten/phpmyfaq prior to 3.1.9.

  8. 5.3CVE-2022-3251EPSS 0.7%

    Sensitive Cookie in HTTPS Session Without 'Secure' Attribute in GitHub repository ikus060/minarca prior to 4.2.2.

  9. 5.3CVE-2022-3250EPSS 0.5%

    Sensitive Cookie in HTTPS Session Without 'Secure' Attribute in GitHub repository ikus060/rdiffweb prior to 2.4.6.

  10. 7.5CVE-2022-3174EPSS 0.7%

    Sensitive Cookie in HTTPS Session Without 'Secure' Attribute in GitHub repository ikus060/rdiffweb prior to 2.4.2.

  11. 5.3CVE-2015-3207EPSS 0.7%

    In Openshift Origin 3 the cookies being set in console have no 'secure', 'HttpOnly' attributes.

  12. 7.5CVE-2022-25151EPSS 0.8%

    Within the Service Desk module of the ITarian platform (SAAS and on-premise), a remote attacker can obtain sensitive information, caused by the failure to set the HTTP Only flag. A remote attacker could exploit this vulnerability to gain a…

  13. 6.5CVE-2022-24045EPSS 0.6%

    A vulnerability has been identified in Desigo DXR2 (All versions < V01.21.142.5-22), Desigo PXC3 (All versions < V01.21.142.4-18), Desigo PXC4 (All versions < V02.20.142.10-10884), Desigo PXC5 (All versions < V02.20.142.10-10884). The appl…

  14. 6.5CVE-2021-27764EPSS 0.6%

    Cookie without HTTPONLY flag set. NUMBER cookie(s) was set without Secure or HTTPOnly flags. The images show the cookie with the missing flag. (WebUI)

  15. 5.3CVE-2021-35236EPSS 0.5%

    The Secure flag is not set in the SSL Cookie of Kiwi Syslog Server 9.7.2 and previous versions. The Secure attribute tells the browser to only send the cookie if the request is being sent over a secure channel such as HTTPS. This will help…

  16. 6.8CVE-2021-3882EPSS 1.1%

    LedgerSMB does not set the 'Secure' attribute on the session authorization cookie when the client uses HTTPS and the LedgerSMB server is behind a reverse proxy. By tricking a user to use an unencrypted connection (HTTP), an attacker may be…

  17. 5.3CVE-2020-29024EPSS 0.5%

    Sensitive Cookie in HTTPS Session Without 'Secure' Attribute vulnerability in (GTA) GoToAppliance of Secomea GateManager could allow an attacker to gain access to sensitive cookies. This issue affects: Secomea GateManager all versions prio…

  18. 8.1CVE-2020-27651EPSS 0.8%

    Synology Router Manager (SRM) before 1.2.4-8081 does not set the Secure flag for the session cookie in an HTTPS session, which makes it easier for remote attackers to capture this cookie by intercepting its transmission within an HTTP sess…

  19. 3.7CVE-2020-27650EPSS 0.6%

    Synology DiskStation Manager (DSM) before 6.2.3-25426-2 does not set the Secure flag for the session cookie in an HTTPS session, which makes it easier for remote attackers to capture this cookie by intercepting its transmission within an H…