共收录 19 条相关情报。
← 返回所有主题CVE-2026-78188
WebDyne versions from 2.014 before 3.022 for Perl issue session cookies without the Secure, HttpOnly and SameSite attrib
CVE-2026-56599
HCL BigFix Service Management is affected by an Insecure Cookie Attribute Configuration vulnerability, which could allow
CVE-2026-66249
iControl is affected by a Missing Secure Attribute vulnerability, which could allow an attacker to intercept cookies tra
CVE-2026-65655
When OAuth authentication is enabled and browser-facing TLS terminates at a reverse proxy that forwards the callback to
CVE-2026-65655
When OAuth authentication is enabled and browser-facing TLS terminates at a reverse proxy that forwards the callback to
CVE-2026-15656
IBM Maximo Application Suite 9.2, 9.1, and 9.0 does not set the secure attribute on authorization tokens or session cook
CVE-2026-48058
nebula-mesh is a self-hosted control plane for Slack Nebula mesh virtual private network. Prior to version 0.3.2, intern
CVE-2026-48058
nebula-mesh is a self-hosted control plane for Slack Nebula mesh virtual private network. Prior to version 0.3.2, intern
CVE-2026-56581
HCL MyCloud was affected with Cookie Attribute Path Not Set. It may increase the risk of unauthorized access to session
CVE-2024-23572
HCL Aftermarket EPC is vulnerable to attack as cookie appears to contain a session token, which may increase the risk as
CVE-2026-57948
Pinpoint through version 3.1.0 contains an insecure session management vulnerability that allows attackers to access the
CVE-2026-57948
Pinpoint through version 3.1.0 contains an insecure session management vulnerability that allows attackers to access the
CVE-2026-46550
NocoDB is software for building databases as spreadsheets. Prior to 2026.04.1, the refresh-token cookie was set with htt
CVE-2026-53661
Boruta is a standalone authorization server that aims to implement OAuth 2.0 and Openid Connect up to decentralized iden
CVE-2026-11956
A vulnerability was determined in TwiN gatus 5.36.0. Impacted is the function setSessionCookie of the file security/oidc
CVE-2026-46398
HAX CMS helps manage microsite universe with PHP or NodeJs backends. Starting in version 25.0.0 and prior to version 26.
CVE-2026-41017
Apache Airflow's `JWTRefreshMiddleware` set the JWT auth cookie without the `Secure` flag, so deployments running the Ai
CVE-2026-43828
Default configurations of Apache Shiro send sensitive cookies in HTTPS session without 'Secure' attribute. This issue
CVE-2026-46550
### Summary The refresh-token cookie was set with `httpOnly: true` but missing both the `secure` flag and the `sameSite