CWE-1004
Sensitive Cookie Without 'HttpOnly' Flag
Description
The product uses a cookie to store sensitive information, but the cookie is not marked with the HttpOnly flag.
Hierarchy (View 1000)
Parents
Children
none
CVEs mapped to this weakness (44)
page 3 of 3| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2026-57948 | Med | 0.00 | 6.8 | 0.00 | Jun 29, 2026 | Pinpoint through version 3.1.0 contains an insecure session management vulnerability that allows attackers to access the pinpointJwt session cookie due to missing HttpOnly and Secure attributes, enabling JavaScript access via document.cookie and cleartext transmission over HTTP.… | ||
| CVE-2022-4630 | Med | 0.00 | 5.3 | 0.01 | Dec 21, 2022 | Sensitive Cookie Without 'HttpOnly' Flag in GitHub repository lirantal/daloradius prior to master. | ||
| CVE-2021-3706 | Hig | 0.00 | 7.5 | 0.01 | Sep 15, 2021 | adminlte is vulnerable to Sensitive Cookie Without 'HttpOnly' Flag | ||
| CVE-2010-4312 | 0.00 | — | 0.02 | Nov 26, 2010 | The default configuration of Apache Tomcat 6.x does not include the HTTPOnly flag in a Set-Cookie header, which makes it easier for remote attackers to hijack a session via script access to a cookie. |
- risk 0.00cvss 6.8epss 0.00
Pinpoint through version 3.1.0 contains an insecure session management vulnerability that allows attackers to access the pinpointJwt session cookie due to missing HttpOnly and Secure attributes, enabling JavaScript access via document.cookie and cleartext transmission over HTTP.…
- risk 0.00cvss 5.3epss 0.01
Sensitive Cookie Without 'HttpOnly' Flag in GitHub repository lirantal/daloradius prior to master.
- risk 0.00cvss 7.5epss 0.01
adminlte is vulnerable to Sensitive Cookie Without 'HttpOnly' Flag
- CVE-2010-4312Nov 26, 2010risk 0.00cvss —epss 0.02
The default configuration of Apache Tomcat 6.x does not include the HTTPOnly flag in a Set-Cookie header, which makes it easier for remote attackers to hijack a session via script access to a cookie.