Advisories · Weakness
CWE-614.
Every Advisory and CVE whose sources give the weakness CWE-614, newest first.
-
WebDyne versions from 2.014 before 3.022 for Perl issue session cookies without the Secure, HttpOnly and SameSite attributes
- CWE-614
- CWE-1004
- CVSS 2.1 Low
Sensitive cookies without 'Secure' and 'HttpOnly' attributes in KNIME Business Hub
- KNIME Business Hub
- CWE-614
- CWE-1004
- CVSS 2.2 Low
HCL BigFix Service Management is affected by multiple security vulnerabilities.
- HCL Software HCL BigFix Service Management
- CWE-614
- CVSS 3.1 Low
HCL iControl is affected by a Missing Secure Attribute vulnerability
- HCL Software iControl
- CWE-614
- CVSS 2.3 Low
Temporal UI Server may set OAuth credential cookies without Secure behind a TLS-terminating reverse proxy
- Temporal Technologies, Inc. Temporal UI Server
- CWE-614
- CVSS 4.3 Medium
IBM MAS uses axios-1.15.2, protobufjs-8.0.1 and undici-7.26 which is vulnerable to multiple CVEs, and contains vulnerabilities related to missing Secure attribute on mas-redirect-uri cookie and weak…
- IBM Maximo Application Suite
- CWE-614
- CVSS 2.6 Low
HCL MyCloud was affected with Cookie Attribute Path Not Set
- HCLSoftware MyCloud
- CWE-614
- CVSS 4.2 Medium
HCLSoftware Aftermarket EPC: HCL Aftermarket EPC is vulnerable to attack as cookie appears to contain a session token…
- HCLSoftware Aftermarket EPC
- CWE-614
- CVSS 7.6 High
Pinpoint - Insecure Session Cookie Attributes in pinpointJwt
- pinpoint
- CWE-614
- CWE-1004
- CVSS 8.8 High
boruta-server sent sensitive session cookies without the Secure attribute
- malach-it boruta-server
- CWE-614
- CVSS 6.3 Medium
TwiN gatus OIDC Session Cookie oidc.go setSessionCookie missing secure attribute
- TwiN gatus
- CWE-614
- CWE-1004
- CVSS 4.6 Medium
nebula-mesh: Session and OIDC state cookies lack the Secure attribute
- CWE-614
<0.3.2 · fixed in 0.3.2
GHSA-rqfj-vv8r-xhqc · CVE-2026-48058 - CVSS 8.8 High
HAX CMS Missing Secure Flag on Cookie
- haxtheweb haxcms-php
- CWE-614
- CVSS 3.1 Low
HCL iControl was affected by Missing Cookie Attributes vulnerability.
- HCL iControl
- CWE-614
- CVSS 5.9 Medium
Apache Airflow's `JWTRefreshMiddleware` set the JWT auth cookie without the `Secure` flag, so deployments running the Airflow API server behind an HTTPS-terminating reverse proxy (e.g. nginx / Envo...
- CWE-614
>=3.0.0, <3.2.2 · fixed in 3.2.2
GHSA-95v7-h9j5-gvjr · CVE-2026-41017 - CVSS 5.9 Medium
Apache Shiro sends sensitive cookies in HTTPS session without 'Secure' attribute
- CWE-614
>=1.0.0-incubating, <2.2.0 || >=3.0.0-alpha-1, <3.0.0-alpha-2 · fixed in 2.2.0, 3.0.0-alpha-2
GHSA-c6r4-qjmw-cvj2 · CVE-2026-43828 - CVSS 5.4 Medium
NocoDB: Refresh Token Cookie Set Without `secure` and `sameSite` Flags
- CWE-614
<=0.301.3 · no fixed version yet
GHSA-f74w-272x-mqcv · CVE-2026-46550 - CVSS 5.7 Medium
Eaton IPP Software: Eaton Intelligent Power Protector (IPP) uses an insecure cookie configuration…
- Eaton IPP Software
- CWE-614
- CVSS 4.3 Medium
IBM Maximo Application Suite was vulnerable to because Cookie ltpatoken2_<workspace_name> was not set with secure flag
- IBM Maximo Application Suite
- CWE-614
- CVSS 4.0, no score published
@grackle-ai/server has a Missing Secure Flag on Session Cookie
- CWE-614
<0.70.5 · fixed in 0.70.5
GHSA-5j35-xr4g-vwf4 - CVSS 6.3 Medium
JetBrains Datalore: In JetBrains Datalore before 2026.1 session hijacking was possible due to missing secure…
- JetBrains Datalore
- CWE-614
- CVSS 5.3 Medium
Use of unsecure cookies for GraphicalData web service and WebClient web app
- arcinfo PcVue
- CWE-614
- CWE-1275
- CVSS 6.9 Medium
Kentico Xperience <= 13.0.164 Cookie Security Configuration
- Kentico Xperience
- CWE-614
- CVSS 3.7 Low
IBM Jazz for Service Management is vulnerable to "filter" cookie not sent over SSL
- IBM Jazz for Service Management
- CWE-614
- CVSS 3.5 Low
HCL Unica Platform is affected by a Cookie without HTTPOnly Flag Set vulnerability
- HCL Software Unica Platform
- CWE-614
- CVSS 6.5 Medium
HCL AION is susceptible to Missing Secure Attribute in Encrypted Session (SSL) Cookie vulnerability
- HCL AION
- CWE-614
- CVSS 4.3 Medium
IBM Jazz for Service Management information disclosure
- IBM Jazz for Service Management
- CWE-614
- CVSS 9.1 CriticalCritical · CVSS 9+
Nameless cookies shadow secure cookies
- Mozilla Firefox
- Mozilla Thunderbird
- CWE-614
- CVSS 8.7 High
Insecure Cookie Flags Vulnerability in Digisol DG-GR6821AC Router
- Digisol XPON ONU Wi-Fi Router (DG-GR6821AC)
- CWE-614
- CWE-1004
- CVSS 6.5 Medium
CVE-2025-27450
- Endress+Hauser MEAC300-FNADE4
- CWE-614
- CVSS 4.3 Medium
IBM Datacap information disclosure
- IBM Datacap
- CWE-614
- CVSS 5.3 Medium
Cookie without Secure attribute in phpipam/phpipam
- phpipam/phpipam
- CWE-614
- CVSS 8.2 High
Misskey CSRF vulnerability due to insecure configuration of authentication cookie attributes
- misskey
- Cross-site request forgery (CSRF)
- CWE-614
-
General OpenMRS Security Advisory, January 2025: Penetration Testing Results and Patches
- Information disclosure
- Broken access control
<2.19.0 · fixed in 2.19.0
GHSA-vpxm-cr3r-pjp9 - CVSS 6.8 Medium
Missing Cookie Flags
- OTRS
- CWE-614
- CVSS 4.8 Medium
IBM Security Directory Integrator information disclosure
- IBM Security Directory Integrator
- IBM Security Verify Directory Integrator
- CWE-614
- CVSS 4.8 Medium
IBM Security Directory Integrator information disclosure
- IBM Security Directory Integrator
- IBM Security Verify Directory Integrator
- CWE-614
- CVSS 8.6 High
Security Misconfiguration Vulnerability in CP Plus Router
- CP Plus CP-XR-DE21-S Router
- CWE-614
- CWE-1004
- CVSS 4.3 Medium
IBM PowerHA SystemMirror for i information disclosure
- i
- CWE-614
- CVSS 3.8 Low
HCL BigFix Compliance is affected by a missing secure flag on a cookie
- HCL Software BigFix Compliance
- CWE-614
- CVSS 4.3 Medium
IBM Concert information disclosure
- IBM Concert
- CWE-614
- CVSS 6.3 Medium
Taipy has a Session Cookie without Secure and HTTPOnly flags
- Weak cryptography or TLS
- CWE-614
<4.0.0 · fixed in 4.0.0
GHSA-r3jq-4r5c-j9hp · CVE-2024-47833 - CVSS 4.3 Medium
usememos/memos missing Secure cookie attribute in github.com/usememos/memos
- CWE-614
<0.9.0 · fixed in 0.9.0
GHSA-qcw2-492v-57xj · CVE-2022-4683 -
Insecure cookies in Openshift Origin in github.com/openshift/origin
- CWE-614
<1.0.0 · fixed in 1.0.0
GHSA-rqph-25q9-9jhp · CVE-2015-3207 - CVSS 6.9 Medium
Cookie Without Secure Flag Set Vulnerability
- SyroTech SY-GPON-1110-WDONT router
- CWE-614
- CVSS 4.3 Medium
IBM Datacap Navigator information disclosure
- IBM Datacap Navigator
- CWE-614
- CVSS 5.3 Medium
IBM Security ReaQta information disclosure
- IBM Security QRadar EDR
- CWE-614
- CVSS 6.8 Medium
Siemens SINEC Traffic Analyzer: A vulnerability has been identified in SINEC Traffic Analyzer (6GK8822-1BG01-0BA0) (All…
- Siemens SINEC Traffic Analyzer
- CWE-614
- CVSS 7.5 High
Session Hijacking Vulnerability in Hitachi Ops Center Analyzer
- Hitachi Ops Center Analyzer
- CWE-614
- CVSS 4.3 Medium
IBM Secure Proxy information disclosure
- IBM Secure Proxy
- CWE-614
- CVSS 4.3 Medium
IBM Sterling B2B Integrator information disclosure
- IBM Sterling B2B Integrator
- CWE-614
- CVSS 3.7 Low
SourceCodester Engineers Online Portal missing secure attribute
- SourceCodester Engineers Online Portal
- CWE-614
- CVSS 3.1 Low
Cookie Without Secure Flag
- Moxa PT-G503 Series
- CWE-614
- CVSS 6.3 Medium
Sensitive cookie in HTTPS session without 'Secure' attribute in thorsten/phpmyfaq
- CWE-614
<3.2.1 · fixed in 3.2.1
GHSA-34w4-wrqp-j47g · CVE-2023-5866 - CVSS 2.6 Low
Sensitive Cookie in HTTPS Session Without 'Secure' Attribute in instantsoft/icms2
- instantsoft/icms2
- CWE-614
- CVSS 4.3 Medium
Sensitive Cookie in HTTPS Session Without 'Secure' Attribute in it-novum/openitcockpit
- it-novum/openitcockpit
- CWE-614
- CVSS 7.5 High
Sensitive Cookie in HTTPS Session Without 'Secure' Attribute in System Configuration Tool (SCT)
- Johnson Controls System Configuration Tool (SCT)
- CWE-614
- CVSS 3.1 Low
Pyload contains Sensitive Cookie in HTTPS Session Without 'Secure' Attribute
- Weak cryptography or TLS
- CWE-614
<0.5.0b3.dev32 · fixed in 0.5.0b3.dev32
GHSA-m3g7-wrrq-v5c8 · CVE-2023-0055 - CVSS 3.7 Low
Insecure generation of cookies in github.com/go-macaron/csrf
- CWE-614
<0.0.0-20180426211050-dadd1711a617 · fixed in 0.0.0-20180426211050-dadd1711a617
GHSA-hhxg-px5h-jc32 · CVE-2018-25060 - CVSS 6.3 Medium
phpMyFAQ has insecure HTTP cookies
- Weak cryptography or TLS
- CWE-614
<3.1.9 · fixed in 3.1.9
GHSA-wpgc-5cr5-h9gg · CVE-2022-4409