CWE-614 Sensitive Cookie in HTTPS Session Without 'Secure' Attribute
variantThe Secure attribute for sensitive cookies in HTTPS sessions is not set.
01
parent weaknesses
Broader classes this is a kind of.
02
vulnerabilities (75)
Known CVEs related to this entry.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2025-24897US | high8.2 | — | ||
Misskey is an open source, federated social media platform. Starting in version 12.109.0 and prior to version 2025.2.0-alpha.0, due to a lack of CSRF protection and the lack of pro… | ||||
| CVE-2020-27651US | high8.1OT elevated | — | ||
Synology Router Manager (SRM) before 1.2.4-8081 does not set the Secure flag for the session cookie in an HTTPS session, which makes it easier for remote attackers to capture this… | ||||
| CVE-2026-22617US | high7.4 | — | ||
Eaton Intelligent Power Protector (IPP) uses an insecure cookie configuration, which could allow a network‑based attacker to intercept the cookie and exploit it through a man‑in‑th… | ||||
| CVE-2025-52632US | high7.5 | — | ||
A Missing Secure Attribute in Encrypted Session (SSL) Cookie vulnerability in HCL AION.This issue affects AION: 2.0. | ||||
| CVE-2024-10718US | high7.5OT elevated | — | ||
In phpipam/phpipam version 1.5.1, the Secure attribute for sensitive cookies in HTTPS sessions is not set. This could cause the user agent to send those cookies in plaintext over a… | ||||
| CVE-2018-25060US | high7.5OT elevated | — | ||
A vulnerability was found in Macaron csrf and classified as problematic. Affected by this issue is some unknown functionality of the file csrf.go. The manipulation of the argument… | ||||
| CVE-2022-4409US | high7.5OT elevated | — | ||
Sensitive Cookie in HTTPS Session Without 'Secure' Attribute in GitHub repository thorsten/phpmyfaq prior to 3.1.9. | ||||
| CVE-2022-3174US | high7.5OT elevated | — | ||
Sensitive Cookie in HTTPS Session Without 'Secure' Attribute in GitHub repository ikus060/rdiffweb prior to 2.4.2. | ||||
| CVE-2022-25151US | high7.5 | — | ||
Within the Service Desk module of the ITarian platform (SAAS and on-premise), a remote attacker can obtain sensitive information, caused by the failure to set the HTTP Only flag. A… | ||||
| CVE-2017-1000046US | high7.5 | — | ||
Mautic 2.6.1 and earlier fails to set flags on session cookies | ||||
| CVE-2021-3882US | medium6.8OT elevated | — | ||
LedgerSMB does not set the 'Secure' attribute on the session authorization cookie when the client uses HTTPS and the LedgerSMB server is behind a reverse proxy. By tricking a user… | ||||
| CVE-2026-43828US | medium6.5 | — | ||
Default configurations of Apache Shiro send sensitive cookies in HTTPS session without 'Secure' attribute.
This issue affects Apache Shiro from 1.0 to 2.1.0, and 3.0.0-alpha-1.… | ||||
| CVE-2026-1697US | medium6.5 | — | ||
The Secure and SameSite attribute are missing in the GraphicalData web services and WebClient web app of PcVue in version 12.0.0 through 16.3.3 included. | ||||
| CVE-2024-28771US | medium6.5 | — | ||
IBM Security Directory Integrator 7.2.0 and IBM Security Verify Directory Integrator 10.0.0 does not set the secure attribute on authorization tokens or session cookies. Attackers… | ||||
| CVE-2024-28770US | medium6.5 | — | ||
IBM Security Directory Integrator 7.2.0 and IBM Security Verify Directory Integrator 10.0.0 does not set the secure attribute on authorization tokens or session cookies. Attackers… | ||||
| CVE-2024-47833US | medium6.5OT elevated | — | ||
Taipy is an open-source Python library for easy, end-to-end application development for data scientists and machine learning engineers. In affected versions session cookies are ser… | ||||
| CVE-2022-4683US | medium6.5OT elevated | — | ||
Sensitive Cookie in HTTPS Session Without 'Secure' Attribute in GitHub repository usememos/memos prior to 0.9.0. | ||||
| CVE-2022-24045US | medium6.5OT elevated | — | ||
A vulnerability has been identified in Desigo DXR2 (All versions < V01.21.142.5-22), Desigo PXC3 (All versions < V01.21.142.4-18), Desigo PXC4 (All versions < V02.20.142.10-10884),… | ||||
| CVE-2021-27764US | medium6.5OT elevated | — | ||
Cookie without HTTPONLY flag set. NUMBER cookie(s) was set without Secure or HTTPOnly flags. The images show the cookie with the missing flag. (WebUI) | ||||
| CVE-2026-41017US | medium5.9 | — | ||
Apache Airflow's `JWTRefreshMiddleware` set the JWT auth cookie without the `Secure` flag, so deployments running the Airflow API server behind an HTTPS-terminating reverse proxy (… | ||||
03
attack patterns (1)
CAPEC attack patterns that exploit this.
04
source
Where this definition is published.
MITREUS
scry
Weaknesses like this turn up in real, exploitable exposures. See what is exposed on your perimeter with a free passive scan.
Free scan