Sensitive Cookie Without 'HttpOnly' Flag

The product uses a cookie to store sensitive information, but the cookie is not marked with the HttpOnly flag.

CVEs (47)

CVE VENDORS PRODUCTS UPDATED PUBLISHED CVSS
CVE-2021-42115 1Businessdnasolutions 1Topease Jun 17, 2026 Nov 30, 2021 N/A· v4 9.1 CRITICAL· v3 6.4 MEDIUM· v2 Missing HTTPOnly flag in Web Applications operating on Business-DNA Solutions GmbH’s TopEase® Platform Version <= 7.1.27 allows an unauthenticated remote attacker to escalate privileges from unauthenticated to authentica...Show more Missing HTTPOnly flag in Web Applications operating on Business-DNA Solutions GmbH’s TopEase® Platform Version <= 7.1.27 allows an unauthenticated remote attacker to escalate privileges from unauthenticated to authenticated user via stealing and injecting the session- independent and static cookie UID.Show less
CVE-2021-39210 1Glpi Project 1Glpi Jun 17, 2026 Sep 15, 2021 N/A· v4 6.5 MEDIUM· v3 3.5 LOW· v2 GLPI is a free Asset and IT management software package. In versions prior to 9.5.6, the cookie used to store the autologin cookie (when a user uses the "remember me" feature) is accessible by scripts. A malicious plugin...Show more GLPI is a free Asset and IT management software package. In versions prior to 9.5.6, the cookie used to store the autologin cookie (when a user uses the "remember me" feature) is accessible by scripts. A malicious plugin that could steal this cookie would be able to use it to autologin. This issue is fixed in version 9.5.6. As a workaround, one may avoid using the "remember me" feature.Show less
CVE-2021-3706 1Pi Hole 1Web Interface Jun 17, 2026 Sep 15, 2021 N/A· v4 7.5 HIGH· v3 5.0 MEDIUM· v2 adminlte is vulnerable to Sensitive Cookie Without 'HttpOnly' Flag
CVE-2021-34563 1Pepperl Fuchs 2Wha Gw F2d2 0 As Z2 Eth.eip Firmware Wha Gw F2d2 0 As Z2 Eth Firmware Jun 17, 2026 Aug 31, 2021 N/A· v4 3.3 LOW· v3 2.1 LOW· v2 In PEPPERL+FUCHS WirelessHART-Gateway 3.0.8 and 3.0.9 the HttpOnly attribute is not set on a cookie. This allows the cookie's value to be read or set by client-side JavaScript.
CVE-2020-27658 1Synology 1Router Manager Jun 17, 2026 Oct 29, 2020 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 Synology Router Manager (SRM) before 1.2.4-8081 does not include the HTTPOnly flag in a Set-Cookie header for the session cookie, which makes it easier for remote attackers to obtain potentially sensitive information via...Show more Synology Router Manager (SRM) before 1.2.4-8081 does not include the HTTPOnly flag in a Set-Cookie header for the session cookie, which makes it easier for remote attackers to obtain potentially sensitive information via script access to this cookie.Show less
CVE-2020-6267 1Sap 1Disclosure Management Jun 17, 2026 Jul 14, 2020 N/A· v4 5.4 MEDIUM· v3 5.8 MEDIUM· v2 Some sensitive cookies in SAP Disclosure Management, version 10.1, are missing HttpOnly flag, leading to sensitive cookie without Http Only flag.
CVE-2019-8283 1Gemalto 1Sentinel Ldk Jun 17, 2026 Jun 7, 2019 N/A· v4 6.5 MEDIUM· v3 4.3 MEDIUM· v2 Hasplm cookie in Gemalto Admin Control Center, all versions prior to 7.92, does not have 'HttpOnly' flag. This allows malicious javascript to steal it.

Previous 1 23