CWE-1004 Sensitive Cookie Without 'HttpOnly' Flag
variantThe product uses a cookie to store sensitive information, but the cookie is not marked with the HttpOnly flag.
01
parent weaknesses
Broader classes this is a kind of.
02
vulnerabilities (70)
Known CVEs related to this entry.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2018-4110US | critical9.8 | Exploit | ||
An issue was discovered in certain Apple products. iOS before 11.3 is affected. The issue involves the "Web App" component. It allows remote attackers to bypass intended restrictio… | ||||
| CVE-2023-4329US | critical9.8OT elevated | — | ||
Broadcom RAID Controller web interface is vulnerable due to insecure default of HTTP configuration that does not safeguard SESSIONID cookie with SameSite attribute | ||||
| CVE-2025-47289US | critical9.0 | — | ||
CE Phoenix is a free, open-source eCommerce platform. A stored cross-site scripting (XSS) vulnerability was discovered in CE Phoenix versions 1.0.9.9 through 1.1.0.2 where an attac… | ||||
| CVE-2021-42115US | critical9.1 | — | ||
Missing HTTPOnly flag in Web Applications operating on Business-DNA Solutions GmbH’s TopEase® Platform Version <= 7.1.27 allows an unauthenticated remote attacker to escalate privi… | ||||
| CVE-2020-15574US | high7.5 | — | ||
SolarWinds Serv-U File Server before 15.2.1 mishandles the Same-Site cookie attribute, aka Case Number 00331893. | ||||
| CVE-2022-43845US | high7.5 | — | ||
IBM Aspera Console 3.4.0 through 3.4.4 could allow a remote attacker to obtain sensitive information, caused by the failure to set the HTTPOnly flag. A remote attacker could exploi… | ||||
| CVE-2022-33167US | high7.5 | — | ||
IBM Security Directory Integrator 7.2.0 and IBM Security Verify Directory Integrator 10.0.0 could allow a remote attacker to obtain sensitive information, caused by the failure to… | ||||
| CVE-2024-41685US | high7.5 | — | ||
This vulnerability exists in SyroTech SY-GPON-1110-WDONT Router due to missing HTTPOnly flag for the session cookies associated with the router's web management interface. An attac… | ||||
| CVE-2021-3706US | high7.5 | — | ||
adminlte is vulnerable to Sensitive Cookie Without 'HttpOnly' Flag | ||||
| CVE-2013-2859US | high7.5 | — | ||
Google Chrome before 27.0.1453.110 allows remote attackers to bypass the Same Origin Policy and trigger namespace pollution via unspecified vectors. | ||||
| CVE-2001-0723US | medium6.4 | — | ||
Internet Explorer 5.5 and 6.0 allows remote attackers to read and modify user cookies via Javascript, aka the "Second Cookie Handling Vulnerability." | ||||
| CVE-2010-4312US | medium6.4 | — | ||
The default configuration of Apache Tomcat 6.x does not include the HTTPOnly flag in a Set-Cookie header, which makes it easier for remote attackers to hijack a session via script… | ||||
| CVE-2026-0696US | medium6.5 | — | ||
In ConnectWise PSA versions older than 2026.1, certain session cookies were not set with the HttpOnly attribute. In some scenarios, this could allow client-side scripts access to s… | ||||
| CVE-2025-27453US | medium6.5 | — | ||
The HttpOnly flag is set to false on the PHPSESSION cookie. Therefore, the cookie can be accessed by other sources such as JavaScript. | ||||
| CVE-2024-47833US | medium6.5OT elevated | — | ||
Taipy is an open-source Python library for easy, end-to-end application development for data scientists and machine learning engineers. In affected versions session cookies are ser… | ||||
| CVE-2021-39210US | medium6.5 | — | ||
GLPI is a free Asset and IT management software package. In versions prior to 9.5.6, the cookie used to store the autologin cookie (when a user uses the "remember me" feature) is a… | ||||
| CVE-2020-25473US | medium6.5 | — | ||
SimplePHPscripts News Script PHP Pro 2.3 does not properly set the HttpOnly Flag from Session Cookies. | ||||
| CVE-2019-8283US | medium6.5 | — | ||
Hasplm cookie in Gemalto Admin Control Center, all versions prior to 7.92, does not have 'HttpOnly' flag. This allows malicious javascript to steal it. | ||||
| CVE-2026-39338US | medium6.1 | — | ||
ChurchCRM is an open-source church management system. Prior to 7.1.0, a Blind Reflected Cross-Site Scripting vulnerability exists in the search parameter accepted by the ChurchCRM… | ||||
| CVE-2026-25136US | medium6.1 | — | ||
Rucio is a software framework that provides functionality to organize, manage, and access large volumes of scientific data using customizable policies. A reflected Cross-site Scrip… | ||||
03
source
Where this definition is published.
MITREUS
scry
Weaknesses like this turn up in real, exploitable exposures. See what is exposed on your perimeter with a free passive scan.
Free scan