Advisories · Weakness
CWE-1004.
Every Advisory and CVE whose sources give the weakness CWE-1004, newest first.
-
WebDyne versions from 2.014 before 3.022 for Perl issue session cookies without the Secure, HttpOnly and SameSite attributes
- CWE-614
- CWE-1004
- CVSS 2.1 Low
Sensitive cookies without 'Secure' and 'HttpOnly' attributes in KNIME Business Hub
- KNIME Business Hub
- CWE-614
- CWE-1004
- CVSS 6.3 Medium
AIOHTTP: Secure attribute not enforced for shared cookie
- Weak cryptography or TLS
- CWE-1004
<3.14.4 · fixed in 3.14.4
GHSA-494j-54xm-rwp3 · CVE-2026-111063 - CVSS 6.3 Medium
sambitraj Student-Management-System session_start cookie httponly flag
- sambitraj Student-Management-System
- Broken access control
- CWE-1004
- CVSS 5.4 Medium
HCL Hive is affected by multiple security vulnerabilities.
- HCL Software Hive
- CWE-1004
- CVSS 7.4 High
OpenAM Insecure SSO Cookie Initialization
- CWE-1004
- CWE-1188
<16.1.1 · fixed in 16.1.1
GHSA-fpmh-vx4h-xc33 · CVE-2026-53660 - CVSS 7.6 High
Pinpoint - Insecure Session Cookie Attributes in pinpointJwt
- pinpoint
- CWE-614
- CWE-1004
- CVSS 6.3 Medium
TwiN gatus OIDC Session Cookie oidc.go setSessionCookie missing secure attribute
- TwiN gatus
- CWE-614
- CWE-1004
- CVSS 8.1 High
Budibase auth session cookies are set with httpOnly:false — any XSS can lead to full account takeover
- CWE-1004
<3.35.10 · fixed in 3.35.10
GHSA-4f9j-vr4p-642r · CVE-2026-42239 - CVSS 8.6 High
ChurchCRM has Blind XSS via Global Search – Administrative Cookie Session Exfiltration
- CRM
- Cross-site scripting (XSS)
- CWE-1004
- CVSS 8.0 High
ChurchCRM has Stored XSS in Group Name
- CRM
- Cross-site scripting (XSS)
- CWE-1004
- CVSS 6.1 Medium
Rucio WebUI has a Stored Cross-site Scripting (XSS) Vulnerability in its Custom RSE Attribute
- Cross-site scripting (XSS)
- CWE-1004
<35.8.3 || >=36.0.0rc1, <38.5.4 || >=39.0.0rc1, <39.3.1 · fixed in 35.8.3, 38.5.4, 39.3.1
GHSA-fq4f-4738-rqxm · CVE-2026-25736 - CVSS 6.1 Medium
Rucio WebUI has a Stored Cross-site Scripting (XSS) vulnerability its Identity Name
- Cross-site scripting (XSS)
- CWE-1004
<35.8.3 || >=36.0.0rc1, <38.5.4 || >=39.0.0rc1, <39.3.1 · fixed in 35.8.3, 38.5.4, 39.3.1
GHSA-8wpv-6x3f-3rm5 · CVE-2026-25735 - CVSS 6.1 Medium
Rucio WebUI has Stored Cross-site Scripting (XSS) in RSE Metadata
- Cross-site scripting (XSS)
- CWE-1004
<35.8.3 || >=36.0.0rc1, <38.5.4 || >=39.0.0rc1, <39.3.1 · fixed in 35.8.3, 38.5.4, 39.3.1
GHSA-h9fp-p2p9-873q · CVE-2026-25734 - CVSS 7.3 High
Rucio WebUI Vulnerable to Stored Cross-site Scripting (XSS) through Custom Rule Function
- Cross-site scripting (XSS)
- CWE-1004
<35.8.3 || >=36.0.0rc1, <38.5.4 || >=39.0.0rc1, <39.3.1 · fixed in 35.8.3, 38.5.4, 39.3.1
GHSA-rwj9-7j48-9f7q · CVE-2026-25733 - CVSS 8.1 High
Rucio WebUI has a Reflected Cross-site Scripting Vulnerability
- Cross-site scripting (XSS)
- CWE-1004
<35.8.3 || >=36.0.0rc1, <38.5.4 || >=39.0.0rc1, <39.3.1 · fixed in 35.8.3, 38.5.4, 39.3.1
GHSA-h79m-5jjm-jm4q · CVE-2026-25136 - CVSS 6.5 Medium
Session Cookies Missing HttpOnly Attribute
- ConnectWise PSA
- CWE-1004
- CVSS 8.8 High
Cookie without HTTPOnly Flag Vulnerability in Tenda Wireless Routers
- Tenda 300Mbps Wireless Router F3 and N300 Easy Setup Router
- CWE-1004
- CVSS 7.5 High
TRUfusion Enterprise through 7.10.4.0 exposes the encrypted COOKIEID as an authentication mechanism for some endpoints such as /trufusionPortal/getProjectList.
- CWE-1004
- CVSS 5.3 Medium
HTTP Security Misconfiguration - Lacking Secure and HTTPOnly Attribute
- Azure Access Technology BLU-IC2
- Azure Access Technology BLU-IC4
- CWE-1004
- CVSS 3.0 Low
Security Misconfiguration vulnerability in SAP Cloud Appliance Library Appliances
- SAP_SE SAP Cloud Appliance Library Appliances
- CWE-1004
- CVSS 7.3 High
A stored cross-site scripting (XSS) vulnerability exists in the MyCourts v3 application within the LTA number profile field.
- Cross-site scripting (XSS)
- CWE-1004
- CVSS 8.7 High
Insecure Cookie Flags Vulnerability in Digisol DG-GR6821AC Router
- Digisol XPON ONU Wi-Fi Router (DG-GR6821AC)
- CWE-614
- CWE-1004
- CVSS 5.3 Medium
CVE-2025-27453
- Endress+Hauser MEAC300-FNADE4
- CWE-1004
- CVSS 5.3 Medium
Cookie missing HttpOnly flag
- SICK AG SICK Media Server
- CWE-1004
- CVSS 6.3 Medium
Stored XSS in CE Phoenix Cart Testimonials Allows Account Takeover if Missing HttpOnly Flag
- PhoenixCart
- CWE-1004
- CVSS 9.8 CriticalCritical · CVSS 9+
An issue was discovered in Znuny through 7.1.3.
- CWE-1004
- CVSS 5.9 Medium
Dario Health USB-C Blood Glucose Monitoring System Starter Kit Android Application Sensitive Cookie Without 'HttpOnly' Flag
- Dario Health Dario Application Database and Internet-based Server Infrastructure
- CWE-1004
- CVSS 8.6 High
Security Misconfiguration Vulnerability in CP Plus Router
- CP Plus CP-XR-DE21-S Router
- CWE-614
- CWE-1004
- CVSS 3.7 Low
IBM Aspera Console information disclosure
- IBM Aspera Console
- CWE-1004
- CVSS 6.3 Medium
Taipy has a Session Cookie without Secure and HTTPOnly flags
- Weak cryptography or TLS
- CWE-614
<4.0.0 · fixed in 4.0.0
GHSA-r3jq-4r5c-j9hp · CVE-2024-47833 - CVSS 3.7 Low
IBM Security Directory Integrator information disclosure
- IBM Security Directory Integrator
- IBM Security Verify Directory Integrator
- CWE-1004
- CVSS 6.9 Medium
Cookie Without HTTPOnly Flag Set Vulnerability
- SyroTech SY-GPON-1110-WDONT router
- CWE-1004
- CVSS 5.3 Medium
Openfind MailGates and MailAudit - Sensitive Cookie Without 'HttpOnly' Flag
- Openfind MailGates
- Openfind MailAudit
- CWE-1004
- CVSS 8.1 High
TYPO3 Security Misconfiguration in Install Tool Cookie
- CWE-1004
>=7.0.0, <7.6.32 || >=8.0.0, <8.7.21 || >=9.0.0, <9.5.2 · fixed in 7.6.32, 8.7.21, 9.5.2
GHSA-f777-f784-36gm - CVSS 7.5 High
TYPO3 Security Misconfiguration in Install Tool Cookie
- CWE-1004
>=7.0.0, <7.6.32 || >=8.0.0, <8.7.21 || >=9.0.0, <9.5.2 · fixed in 7.6.32, 8.7.21, 9.5.2
GHSA-ppvg-hw62-6ph9 - CVSS 3.1 Low
Session cookies attribute not set properly
- Moxa PT-G503 Series
- CWE-1004
- CVSS 3.1 Low
ioLogik 4000 Series: Session Cookies Attribute Not Set Properly
- Moxa ioLogik 4000 Series
- CWE-1004
- CVSS 3.1 Low
Session cookie exposure for client side script
- ABB REX640 PCL1
- ABB REX640 PCL2
- CWE-1004
- CVSS 7.5 High
Sensitive cookie without 'HttpOnly' flag in System Configuration Tool (SCT)
- Johnson Controls System Configuration Tool (SCT)
- CWE-1004
- CVSS 3.7 Low
nsupdate.info has Sensitive Cookie Without 'HttpOnly' Flag
- CWE-1004
<=0.12.0 · no fixed version yet
GHSA-mwvp-qr62-cvjx · CVE-2019-25091 - CVSS 5.3 Medium
Sensitive Cookie Without 'HttpOnly' Flag in lirantal/daloradius
- lirantal/daloradius
- CWE-1004
-
Apache Tomcat has cookies without HTTPOnly flag in Set-Cookie header
- CWE-1004
>=6.0.0, <6.0.35 · fixed in 6.0.35
GHSA-pvjh-7h8q-q56r · CVE-2010-4312 - CVSS 7.5 High
InHand Networks InRouter302: An information disclosure vulnerability exists in the web interface session cookie…
- InHand Networks InRouter302
- CWE-1004
- CVSS 8.1 High
Missing HTTPOnly flag on sensitive cookie in TopEase
- Business-DNA Solutions GmbH TopEase
- CWE-1004
- CVSS 6.5 Medium
Autologin cookie accessible by scripts
- glpi
- CWE-1004
- CVSS 7.4 High
Sensitive Cookie Without 'HttpOnly' Flag in pi-hole/adminlte
- pi-hole/adminlte
- CWE-1004
- CVSS 3.3 Low
In WirelessHART-Gateway versions 3.0.8 and 3.0.9 the HttpOnly flag is missing in a cookie which allows client-side javascript to modify it
- Phoenix Contact WHA-GW-F2D2-0-AS- Z2-ETH
- Phoenix Contact WHA-GW-F2D2-0-AS- Z2-ETH.EIP
- CWE-1004
- CVSS 7.1 High
Synology Router Manager (SRM): Synology Router Manager (SRM) before 1.2.4-8081 does not include the HTTPOnly flag in a…
- Synology Router Manager (SRM)
- CWE-1004
- CVSS 6.3 Medium
SAP SE SAP Disclosure Management: Some sensitive cookies in SAP Disclosure Management, version 10.1…
- SAP SE SAP Disclosure Management
- CWE-1004
-
Hasplm cookie in Gemalto Admin Control Center, all versions prior to 7.92, does not have 'HttpOnly' flag.
- Sentinel LDK RTE
- CWE-1004