CWE-1275 Sensitive Cookie with Improper SameSite Attribute
variantThe SameSite attribute for sensitive cookies is not set, or an insecure value is used.
01
parent weaknesses
Broader classes this is a kind of.
02
vulnerabilities (34)
Known CVEs related to this entry.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2026-8434US | high8.8 | — | ||
Concrete CMS 9 before 9.5.0 is vulnerable to Cross Site Request Forgery (CSRF) at concrete/controllers/backend/file rescanMultiple(). The Concrete CMS security team gave this vulne… | ||||
| CVE-2026-8433US | high8.8 | — | ||
Concrete CMS 9 before 9.5.0 is vulnerable to Cross Site Request Forgery (CSRF) at concrete/controllers/backend/file rescan(). The Concrete CMS security team gave this vulnerability… | ||||
| CVE-2026-8432US | high8.8 | — | ||
Concrete CMS 9 before 9.5.0 is vulnerable to Cross Site Request Forgery (CSRF) at concrete/controllers/backend/file star(). The Concrete CMS security team gave this vulnerability a… | ||||
| CVE-2026-8427US | high8.8 | — | ||
Concrete CMS 9 before 9.5.0 is vulnerable to Cross Site Request Forgery (CSRF) at concrete/controllers/backend/file removeFavoriteFolder($id). The Concrete CMS security team gave t… | ||||
| CVE-2026-8416US | high8.8 | — | ||
Concrete CMS 9 before 9.5.0 is vulnerable to Cross Site Request Forgery (CSRF) at concrete/controllers/backend/file addFavoriteFolder($id). The Concrete CMS security team gave this… | ||||
| CVE-2026-8415US | high8.8 | — | ||
Concrete CMS 9 before 9.5.0 is vulnerable to Cross Site Request Forgery (CSRF) at concrete/controllers/dialog/express/association/reorder. The Concrete CMS security team gave this… | ||||
| CVE-2026-8414US | high8.8 | — | ||
Concrete CMS 9 before 9.5.0 is vulnerable to Cross Site Request Forgery (CSRF) at concrete/controllers/dialog/event/duplicate. The Concrete CMS security team gave this vulnerabilit… | ||||
| CVE-2026-8413US | high8.8 | — | ||
Concrete CMS 9 before 9.5.0 is vulnerable to Cross Site Request Forgery (CSRF) at concrete/controllers/dialog/page/bulk/design. The Concrete CMS security team gave this vulnerabili… | ||||
| CVE-2026-8412US | high8.8 | — | ||
Concrete CMS 9 before 9.5.0 is vulnerable to Cross Site Request Forgery (CSRF) at concrete/controllers/dialog/page/bulk/cache. The Concrete CMS security team gave this vulnerabili… | ||||
| CVE-2026-8411US | high8.8 | — | ||
Concrete CMS 9 before 9.5.0 is vulnerable to Cross Site Request Forgery (CSRF) at concrete/controllers/dialog/page/bulk/delete. The Concrete CMS security team gave this vulnerabili… | ||||
| CVE-2026-8410US | high8.8 | — | ||
Concrete CMS 9 before 9.5.0 is vulnerable to Cross Site Request Forgery (CSRF) at concrete/controllers/dialog/logs/bulk/delete. The The Concrete CMS security team gave this vulner… | ||||
| CVE-2026-8409US | high8.8 | — | ||
Concrete CMS 9 before 9.5.0 is vulnerable to Cross Site Request Forgery (CSRF) at concrete/controllers/dialog/logs/delete. The The Concrete CMS security team gave this vulnerabili… | ||||
| CVE-2025-52628US | high8.8 | — | ||
HCL AION is affected by a Cookie with Insecure, Improper, or Missing SameSite vulnerability. This can allow cookies to be sent in cross-site requests, potentially increasing expos… | ||||
| CVE-2023-53957US | high8.8 | — | ||
Kimai 1.30.10 contains a SameSite cookie vulnerability that allows attackers to steal user session cookies through malicious exploitation. Attackers can trick victims into executin… | ||||
| CVE-2025-24897US | high8.2 | — | ||
Misskey is an open source, federated social media platform. Starting in version 12.109.0 and prior to version 2025.2.0-alpha.0, due to a lack of CSRF protection and the lack of pro… | ||||
| CVE-2025-36134US | high7.5 | — | ||
IBM Sterling B2B Integrator and IBM Sterling File Gateway 6.0.0.0 through 6.1.2.7 and 6.2.0.0 through 6.2.0.5 and 6.2.1.1 could disclose sensitive information due to a missing or i… | ||||
| CVE-2026-8435US | medium6.5 | — | ||
Concrete CMS 9 before 9.5.0 is vulnerable to Cross Site Request Forgery (CSRF) at concrete/controllers/backend/file approveVersion(). The Concrete CMS security team gave this vulne… | ||||
| CVE-2026-1697US | medium6.5 | — | ||
The Secure and SameSite attribute are missing in the GraphicalData web services and WebClient web app of PcVue in version 12.0.0 through 16.3.3 included. | ||||
| CVE-2025-24387US | medium6.5 | — | ||
A vulnerability in OTRS Application Server allows session hijacking due to missing attributes for sensitive
cookie settings in HTTPS sessions. A request to an OTRS endpoint from a… | ||||
| CVE-2022-45410US | medium6.5OT elevated | — | ||
When a ServiceWorker intercepted a request with <code>FetchEvent</code>, the origin of the request was lost after the ServiceWorker took ownership of it. This had the effect of neg… | ||||
03
attack patterns (1)
CAPEC attack patterns that exploit this.
04
source
Where this definition is published.
MITREUS
scry
Weaknesses like this turn up in real, exploitable exposures. See what is exposed on your perimeter with a free passive scan.
Free scan