CWE-1275 Sensitive Cookie with Improper SameSite Attribute
variantThe SameSite attribute for sensitive cookies is not set, or an insecure value is used.
01
übergeordnete Schwächen
Übergeordnete Klassen, zu denen dies gehört.
02
Schwachstellen (34)
Zugehörige CVEs.
| ID | Schweregrad | ausnutzbar | ||
|---|---|---|---|---|
| CVE-2026-8434US | high8.8 | — | ||
Concrete CMS 9 before 9.5.0 is vulnerable to Cross Site Request Forgery (CSRF) at concrete/controllers/backend/file rescanMultiple(). The Concrete CMS security team gave this vulne… | ||||
| CVE-2026-8433US | high8.8 | — | ||
Concrete CMS 9 before 9.5.0 is vulnerable to Cross Site Request Forgery (CSRF) at concrete/controllers/backend/file rescan(). The Concrete CMS security team gave this vulnerability… | ||||
| CVE-2026-8432US | high8.8 | — | ||
Concrete CMS 9 before 9.5.0 is vulnerable to Cross Site Request Forgery (CSRF) at concrete/controllers/backend/file star(). The Concrete CMS security team gave this vulnerability a… | ||||
| CVE-2026-8427US | high8.8 | — | ||
Concrete CMS 9 before 9.5.0 is vulnerable to Cross Site Request Forgery (CSRF) at concrete/controllers/backend/file removeFavoriteFolder($id). The Concrete CMS security team gave t… | ||||
| CVE-2026-8416US | high8.8 | — | ||
Concrete CMS 9 before 9.5.0 is vulnerable to Cross Site Request Forgery (CSRF) at concrete/controllers/backend/file addFavoriteFolder($id). The Concrete CMS security team gave this… | ||||
| CVE-2026-8415US | high8.8 | — | ||
Concrete CMS 9 before 9.5.0 is vulnerable to Cross Site Request Forgery (CSRF) at concrete/controllers/dialog/express/association/reorder. The Concrete CMS security team gave this… | ||||
| CVE-2026-8414US | high8.8 | — | ||
Concrete CMS 9 before 9.5.0 is vulnerable to Cross Site Request Forgery (CSRF) at concrete/controllers/dialog/event/duplicate. The Concrete CMS security team gave this vulnerabilit… | ||||
| CVE-2026-8413US | high8.8 | — | ||
Concrete CMS 9 before 9.5.0 is vulnerable to Cross Site Request Forgery (CSRF) at concrete/controllers/dialog/page/bulk/design. The Concrete CMS security team gave this vulnerabili… | ||||
| CVE-2026-8412US | high8.8 | — | ||
Concrete CMS 9 before 9.5.0 is vulnerable to Cross Site Request Forgery (CSRF) at concrete/controllers/dialog/page/bulk/cache. The Concrete CMS security team gave this vulnerabili… | ||||
| CVE-2026-8411US | high8.8 | — | ||
Concrete CMS 9 before 9.5.0 is vulnerable to Cross Site Request Forgery (CSRF) at concrete/controllers/dialog/page/bulk/delete. The Concrete CMS security team gave this vulnerabili… | ||||
| CVE-2026-8410US | high8.8 | — | ||
Concrete CMS 9 before 9.5.0 is vulnerable to Cross Site Request Forgery (CSRF) at concrete/controllers/dialog/logs/bulk/delete. The The Concrete CMS security team gave this vulner… | ||||
| CVE-2026-8409US | high8.8 | — | ||
Concrete CMS 9 before 9.5.0 is vulnerable to Cross Site Request Forgery (CSRF) at concrete/controllers/dialog/logs/delete. The The Concrete CMS security team gave this vulnerabili… | ||||
| CVE-2025-52628US | high8.8 | — | ||
HCL AION is affected by a Cookie with Insecure, Improper, or Missing SameSite vulnerability. This can allow cookies to be sent in cross-site requests, potentially increasing expos… | ||||
| CVE-2023-53957US | high8.8 | — | ||
Kimai 1.30.10 contains a SameSite cookie vulnerability that allows attackers to steal user session cookies through malicious exploitation. Attackers can trick victims into executin… | ||||
| CVE-2025-24897US | high8.2 | — | ||
Misskey is an open source, federated social media platform. Starting in version 12.109.0 and prior to version 2025.2.0-alpha.0, due to a lack of CSRF protection and the lack of pro… | ||||
| CVE-2025-36134US | high7.5 | — | ||
IBM Sterling B2B Integrator and IBM Sterling File Gateway 6.0.0.0 through 6.1.2.7 and 6.2.0.0 through 6.2.0.5 and 6.2.1.1 could disclose sensitive information due to a missing or i… | ||||
| CVE-2026-8435US | medium6.5 | — | ||
Concrete CMS 9 before 9.5.0 is vulnerable to Cross Site Request Forgery (CSRF) at concrete/controllers/backend/file approveVersion(). The Concrete CMS security team gave this vulne… | ||||
| CVE-2026-1697US | medium6.5 | — | ||
The Secure and SameSite attribute are missing in the GraphicalData web services and WebClient web app of PcVue in version 12.0.0 through 16.3.3 included. | ||||
| CVE-2025-24387US | medium6.5 | — | ||
A vulnerability in OTRS Application Server allows session hijacking due to missing attributes for sensitive
cookie settings in HTTPS sessions. A request to an OTRS endpoint from a… | ||||
| CVE-2022-45410US | medium6.5OT erhöht | — | ||
When a ServiceWorker intercepted a request with <code>FetchEvent</code>, the origin of the request was lost after the ServiceWorker took ownership of it. This had the effect of neg… | ||||
03
Angriffsmuster (1)
CAPEC-Angriffsmuster, die dies ausnutzen.
04
Quelle
Wo diese Definition veröffentlicht ist.
MITREUS
scry
Schwächen wie diese tauchen in realen, ausnutzbaren Angriffsflächen auf. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan