CWE-1275.

WebDyne versions from 2.014 before 3.022 for Perl issue session cookies without the Secure, HttpOnly and SameSite attributes

• CWE-614
• CWE-1004

AsyncHttpClient: Cookie Domain attribute is not checked against the public suffix list, so a cookie can be set for co.uk

• CWE-1275

>=3.0.0, <3.0.13 || >=2.0.0, <2.16.1 · fixed in 3.0.13, 2.16.1

AsyncHttpClient: Incomplete origin checks in the default cookie store allow cookie tossing onto public-suffix and IP-address hosts

• AsyncHttpClient async-http-client
• Authentication bypass
• CWE-1275

Hatchet - Unauthenticated OAuth state CSRF / login-CSRF via empty-state collision in ValidateOAuthState

• Authentication bypass
• Cross-site request forgery (CSRF)

<0.91.1 · fixed in 0.91.1

Http4s: CookieJar middleware matches by substring, leaking cookies cross-origin

• CWE-565
• CWE-1275

<0.23.35 · fixed in 0.23.35

@hono/oauth-providers: OAuth state check fails open on omitted state, enabling login CSRF and forced account linking

• Cross-site request forgery (CSRF)
• CWE-1275

<0.8.6 · fixed in 0.8.6

Spring Framework sameSite Attribute Dropped in JettyCoreServerHttpResponse

• Spring Framework
• CWE-1275

AsyncHttpClient stores cookie for an unrelated domain (cookie tossing) via ThreadSafeCookieStore

• CWE-1275

>=3.0.0.Beta1, <3.0.11 || >=2.0.0, <2.16.0 · fixed in 3.0.11, 2.16.0

OpenAM Insecure SSO Cookie Initialization

• CWE-1004
• CWE-1188

<16.1.1 · fixed in 16.1.1

Emlog: Missing CSRF protection in AI Assistant execute_tool leads to full database compromise and admin account takeover

• emlog
• Cross-site request forgery (CSRF)
• Hard-coded credentials

Concrete CMS is vulnerable to Cross Site Request Forgery (CSRF) at concrete/controllers/dialog/express/association/reorder

• Cross-site request forgery (CSRF)
• CWE-1275

>=9.0.0RC1, <9.5.1 · fixed in 9.5.1

Concrete CMS is vulnerable to Cross Site Request Forgery (CSRF) at concrete/controllers/dialog/logs/bulk/delete

• Cross-site request forgery (CSRF)
• CWE-1275

>=9.0.0RC1, <9.5.1 · fixed in 9.5.1

Concrete CMS is vulnerable to Cross Site Request Forgery (CSRF) at concrete/controllers/dialog/page/bulk/cache

• Cross-site request forgery (CSRF)
• CWE-1275

>=9.0.0RC1, <9.5.1 · fixed in 9.5.1

Concrete CMS is vulnerable to Cross Site Request Forgery (CSRF) at concrete/controllers/backend/file addFavoriteFolder($id)

• Cross-site request forgery (CSRF)
• CWE-1275

>=9.0.0RC1, <9.5.1 · fixed in 9.5.1

Concrete CMS is vulnerable to Cross Site Request Forgery (CSRF) at concrete/controllers/dialog/page/bulk/design

• Cross-site request forgery (CSRF)
• CWE-1275

>=9.0.0RC1, <9.5.1 · fixed in 9.5.1

Concrete CMS is vulnerable to Cross Site Request Forgery (CSRF) at concrete/controllers/dialog/event/duplicate

• Cross-site request forgery (CSRF)
• CWE-1275

>=9.0.0RC1, <9.5.1 · fixed in 9.5.1

Concrete CMS is vulnerable to Cross Site Request Forgery (CSRF) at concrete/controllers/backend/file star()

• Cross-site request forgery (CSRF)
• CWE-1275

>=9.0.0RC1, <9.5.1 · fixed in 9.5.1

Concrete CMS is vulnerable to Cross Site Request Forgery (CSRF) at concrete/controllers/dialog/page/bulk/delete

• Cross-site request forgery (CSRF)
• CWE-1275

>=9.0.0RC1, <9.5.1 · fixed in 9.5.1

Concrete CMS is vulnerable to Cross Site Request Forgery (CSRF) at concrete/controllers/backend/file rescanMultiple()

• Cross-site request forgery (CSRF)
• CWE-1275

>=9.0.0RC1, <9.5.1 · fixed in 9.5.1

Concrete CMS is vulnerable to Cross Site Request Forgery (CSRF) at concrete/controllers/backend/file rescan()

• Cross-site request forgery (CSRF)
• CWE-1275

>=9.0.0RC1, <9.5.1 · fixed in 9.5.1

Concrete CMS is vulnerable to Cross Site Request Forgery (CSRF) at concrete/controllers/backend/file removeFavoriteFolder($id)

• Cross-site request forgery (CSRF)
• CWE-1275

>=9.0.0RC1, <9.5.1 · fixed in 9.5.1

Concrete CMS is vulnerable to Cross Site Request Forgery (CSRF) at concrete/controllers/dialog/logs/delete

• Cross-site request forgery (CSRF)
• CWE-1275

>=9.0.0RC1, <9.5.1 · fixed in 9.5.1

Concrete CMS is vulnerable to Cross Site Request Forgery (CSRF) at concrete/controllers/backend/file approveVersion()

• Cross-site request forgery (CSRF)
• CWE-1275

>=9.0.0RC1, <9.5.1 · fixed in 9.5.1

Use of unsecure cookies for GraphicalData web service and WebClient web app

• arcinfo PcVue
• CWE-614
• CWE-1275

HCL AION is susceptible to Missing SameSite vulnerability

• HCL AION
• CWE-1275

Kimai contains a SameSite cookie vulnerability

• CWE-1275

<=1.30.10 · no fixed version yet

IBM Sterling B2B Integrator and IBM Sterling File Gateway information disclosure

• IBM Sterling B2B Integrator
• IBM Sterling File Gateway
• CWE-1275

HCL BigFix Compliance is affected by an improper or missing SameSite attribute

• HCL Software HCL BigFix Compliance
• CWE-1275

HCL SX is susceptible to cookie with Insecure, Improper, or Missing SameSite attribute vulnerability

• HCL Software HCL SX
• CWE-1275

Missing CSRF protection

• OTRS
• CWE-1275

Misskey CSRF vulnerability due to insecure configuration of authentication cookie attributes

• misskey
• Cross-site request forgery (CSRF)
• CWE-614

IBM Concert information disclosure

• IBM Concert
• CWE-1275

Incorrect handling of SameSite cookies

• Mozilla Firefox
• Mozilla Thunderbird
• CWE-1275

IBM Cloud Pak for Security information disclosure

• IBM Cloud Pak for Security
• IBM QRadar Suite for Software
• CWE-1275