Monthly
OpenAM Community Edition through 16.0.6 ships its iPlanetDirectoryPro SSO session cookie with HttpOnly disabled and no SameSite attribute by default, and reuses that same cookie value as the CSRF token for the OAuth/OIDC consent flow. When chained with any other same-origin XSS in the OpenAM console, a single clicked attacker link lets a remote, unauthenticated attacker read the cookie from document.cookie, hijack a logged-in console user's full SSO session, and simultaneously submit attacker-controlled OAuth consent grants using the stolen cookie as the anti-CSRF token. The issue is fixed by
Session hijacking via JavaScript-readable authentication cookies in Budibase versions prior to 3.35.10 allows any Cross-Site Scripting (XSS) vulnerability to escalate into full account takeover. The budibase:auth cookie containing the JWT session token is set with httpOnly: false, enabling JavaScript to read it via document.cookie. Combined with confirmed prior XSS vulnerabilities in Budibase (GHSA-gp5x-2v54-v2q5), attackers can exfiltrate session tokens and gain persistent access to victim accounts. The cookie also lacks secure and sameSite flags, exposing tokens over plaintext HTTP. No public exploit identified at time of analysis. EPSS data not available. Patch available in version 3.35.10.
Session cookie exposure in sambitraj's Student-Management-System allows attackers to steal session tokens via client-side JavaScript due to the absence of the HttpOnly flag in the `session_start` function. All commits up to 56ba287f2e9031523ccb4244cb6e3fe530e4e5d5 are affected, and no vendor patch exists as the maintainer has not responded to the responsible disclosure. A publicly available proof-of-concept exists, though exploitation requires high attack complexity and a co-present XSS vector to materialize as a session hijack.
Missing HttpOnly cookie flags in HCL Hive expose session tokens and sensitive credentials to client-side script access, enabling session hijacking when combined with cross-site scripting. The CVE description cites broader infrastructure weaknesses - lateral movement, container breakout, and internal communications exposure - suggesting CWE-1004 is one root cause within a cluster of related configuration flaws. No public exploit has been identified at time of analysis, and no KEV listing exists, but the network-accessible attack surface with no privilege requirement (beyond user interaction) makes this relevant for any internet-exposed Hive deployment.
Professional Service Automation contains a vulnerability that allows attackers to client-side scripts access to session cookie values (CVSS 6.5).
This vulnerability exists in Tenda wireless routers (300Mbps Wireless Router F3 and N300 Easy Setup Router) due to the missing HTTPOnly flag for session cookies associated with the web-based administrative interface.
Session cookies issued by the BLU-IC2 and BLU-IC4 device web interfaces (firmware through 1.19.5) are set without the Secure and HttpOnly attributes, so any party able to run JavaScript inside the device's web context or to intercept cleartext HTTP traffic can read those cookies and replay them to hijack an authenticated administrative session. Exploitation is not standalone: it requires a pre-existing script-injection (XSS) foothold or a network man-in-the-middle position, plus a live authenticated session cookie and reachability to the web UI, so despite the raw CVSS 4.0 score of 5.3 the practical risk is low-to-moderate. No public exploit code was identified at time of analysis, the issue is not KEV-listed, and EPSS is only 0.21% (10th percentile).
SAP Cloud Appliance Library (CAL) appliances can be abused by an authenticated high-privileged attacker to access limited information on other CAL-provisioned appliances due to an insecure default S/4HANA profile setting. Exploitation requires high privileges, specific configuration conditions, and high attack complexity, with only low confidentiality impact; integrity and availability are unaffected. No public exploit or active exploitation has been identified, and the EPSS score is 0.24% (percentile 14%), indicating a low likelihood of exploitation.
A remote code execution vulnerability in HttpOnly flag (CVSS 5.3). Remediation should follow standard vulnerability management procedures.
CVE-2025-49189 is a security vulnerability (CVSS 5.3). Remediation should follow standard vulnerability management procedures.
OpenAM Community Edition through 16.0.6 ships its iPlanetDirectoryPro SSO session cookie with HttpOnly disabled and no SameSite attribute by default, and reuses that same cookie value as the CSRF token for the OAuth/OIDC consent flow. When chained with any other same-origin XSS in the OpenAM console, a single clicked attacker link lets a remote, unauthenticated attacker read the cookie from document.cookie, hijack a logged-in console user's full SSO session, and simultaneously submit attacker-controlled OAuth consent grants using the stolen cookie as the anti-CSRF token. The issue is fixed by
Session hijacking via JavaScript-readable authentication cookies in Budibase versions prior to 3.35.10 allows any Cross-Site Scripting (XSS) vulnerability to escalate into full account takeover. The budibase:auth cookie containing the JWT session token is set with httpOnly: false, enabling JavaScript to read it via document.cookie. Combined with confirmed prior XSS vulnerabilities in Budibase (GHSA-gp5x-2v54-v2q5), attackers can exfiltrate session tokens and gain persistent access to victim accounts. The cookie also lacks secure and sameSite flags, exposing tokens over plaintext HTTP. No public exploit identified at time of analysis. EPSS data not available. Patch available in version 3.35.10.
Session cookie exposure in sambitraj's Student-Management-System allows attackers to steal session tokens via client-side JavaScript due to the absence of the HttpOnly flag in the `session_start` function. All commits up to 56ba287f2e9031523ccb4244cb6e3fe530e4e5d5 are affected, and no vendor patch exists as the maintainer has not responded to the responsible disclosure. A publicly available proof-of-concept exists, though exploitation requires high attack complexity and a co-present XSS vector to materialize as a session hijack.
Missing HttpOnly cookie flags in HCL Hive expose session tokens and sensitive credentials to client-side script access, enabling session hijacking when combined with cross-site scripting. The CVE description cites broader infrastructure weaknesses - lateral movement, container breakout, and internal communications exposure - suggesting CWE-1004 is one root cause within a cluster of related configuration flaws. No public exploit has been identified at time of analysis, and no KEV listing exists, but the network-accessible attack surface with no privilege requirement (beyond user interaction) makes this relevant for any internet-exposed Hive deployment.
Professional Service Automation contains a vulnerability that allows attackers to client-side scripts access to session cookie values (CVSS 6.5).
This vulnerability exists in Tenda wireless routers (300Mbps Wireless Router F3 and N300 Easy Setup Router) due to the missing HTTPOnly flag for session cookies associated with the web-based administrative interface.
Session cookies issued by the BLU-IC2 and BLU-IC4 device web interfaces (firmware through 1.19.5) are set without the Secure and HttpOnly attributes, so any party able to run JavaScript inside the device's web context or to intercept cleartext HTTP traffic can read those cookies and replay them to hijack an authenticated administrative session. Exploitation is not standalone: it requires a pre-existing script-injection (XSS) foothold or a network man-in-the-middle position, plus a live authenticated session cookie and reachability to the web UI, so despite the raw CVSS 4.0 score of 5.3 the practical risk is low-to-moderate. No public exploit code was identified at time of analysis, the issue is not KEV-listed, and EPSS is only 0.21% (10th percentile).
SAP Cloud Appliance Library (CAL) appliances can be abused by an authenticated high-privileged attacker to access limited information on other CAL-provisioned appliances due to an insecure default S/4HANA profile setting. Exploitation requires high privileges, specific configuration conditions, and high attack complexity, with only low confidentiality impact; integrity and availability are unaffected. No public exploit or active exploitation has been identified, and the EPSS score is 0.24% (percentile 14%), indicating a low likelihood of exploitation.
A remote code execution vulnerability in HttpOnly flag (CVSS 5.3). Remediation should follow standard vulnerability management procedures.
CVE-2025-49189 is a security vulnerability (CVSS 5.3). Remediation should follow standard vulnerability management procedures.