Monthly
Session hijacking in Pinpoint (open-source APM) through version 3.1.0 stems from the pinpointJwt session cookie being issued without the HttpOnly and Secure flags, letting client-side JavaScript read it via document.cookie and allowing it to traverse cleartext HTTP. An attacker who can land a stored or reflected XSS payload, or who can sniff network traffic, can steal the JWT session token and impersonate the victim. There is no public exploit identified at time of analysis and the issue is not on CISA KEV; the CVSS 4.0 base score is 7.6.
Session cookie hijacking in Boruta authorization server prior to 0.9.1 allows network-positioned attackers to capture authentication and remember-me cookies because they lack the Secure attribute and may be transmitted over plaintext HTTP. The flaw affects boruta_web, boruta_identity, and boruta_admin components and enables full user impersonation, including potentially administrative sessions on an OAuth 2.0/OpenID Connect identity provider. No public exploit identified at time of analysis and the issue is not in CISA KEV.
Session token disclosure in HAX CMS versions 25.0.0 through 26.0.0 (exclusive) stems from the haxcms_refresh_token cookie being issued without the Secure flag, allowing the browser to send it over plaintext HTTP. A network-positioned attacker can capture the refresh token via passive sniffing and hijack the victim's authenticated session. No public exploit identified at time of analysis, and the vendor has published a fix in version 26.0.0.
KNIME Business Hub before 1.19.0 sets sensitive cookies without protective attributes such as Secure, HttpOnly or SameSite, so session data can be read or intercepted only when a separate cross-site scripting flaw exists in the product or an attacker already holds a man-in-the-middle position on the network path. The issue is rated CVSS 4.0 base 2.1 with Attack Requirements set to Present (AT:P), and it is prioritized as monitor; no public exploit was identified at time of analysis and there is no CISA KEV listing. The vendor states that a workaround is not possible and that upgrading to 1.19.0 is the only complete remediation.
Insecure cookie attribute configuration in HCL BigFix Service Management allows attackers to facilitate cross-site request forgery, session hijacking via cross-site scripting, and unauthorized access when a pre-existing enabler - such as an active XSS vector, a cross-site attack page, or an on-path network position - is present. This is a low-priority, defense-in-depth weakness rather than a directly exploitable flaw; no public exploit code has been identified at time of analysis. The vulnerability requires an application deployed without hardened cookie attributes (missing Secure, HttpOnly, SameSite, and restrictive Path), and exploitation yields only low-level confidentiality impact.
Session cookie interception in HCL iControl allows an on-path attacker to capture sensitive information such as session identifiers when the Secure attribute is missing and cookies are transmitted over unencrypted HTTP. Exploitation requires a victim with an authenticated session, transmission of the cookie over HTTP, and the attacker to occupy a man-in-the-middle position; no public exploit or active exploitation has been identified. This is a low-priority information disclosure issue (CVSS 3.1) with confidentiality-only impact.
Temporal UI Server versions 2.7.0 through 2.53.1 incorrectly derive the Secure attribute for OAuth authentication cookies from the proxy-to-server connection rather than the browser-facing connection, causing access-token and refresh-token cookies to be issued without Secure when TLS terminates at a reverse proxy forwarding over HTTP. An attacker who can additionally redirect browser traffic for the UI hostname away from HTTPS - beyond merely serving attacker-controlled content - can potentially intercept a live credential transmitted in a plaintext HTTP request. No public exploit code exists and CISA KEV does not list this vulnerability; the SSVC assessment confirms exploitation is currently none and the attack is not automatable, consistent with the very low CVSS 4.0 score of 2.3.
IBM Maximo Application Suite 9.0, 9.1, and 9.2 fails to set the `Secure` attribute on authorization tokens and session cookies, enabling interception of credential material over unencrypted HTTP. An attacker who tricks an authenticated user into following an HTTP link - via phishing or a malicious page - causes the victim's browser to transmit the session cookie in plaintext, where it can be captured by a server the attacker controls or via network sniffing. No public exploit has been identified at time of analysis and the vulnerability is not listed in the CISA KEV catalog; however, session token theft can lead to full account takeover, meaningfully exceeding the limited confidentiality scope implied by the raw CVSS score.
Session cookie exposure in HCL MyCloud arises from the cookie Path attribute not being set, causing authentication tokens to be transmitted to all paths within the application domain rather than restricted to intended endpoints. The CVSS 2.6 score reflects a genuinely limited-impact finding requiring both high attack complexity and authenticated user interaction to exploit, with only low confidentiality impact and no integrity or availability consequences. No public exploit code or active exploitation has been identified at time of analysis.
OIDC session cookie exposure in TwiN gatus 5.36.0 allows network-positioned attackers to intercept authentication tokens because the `setSessionCookie` function in `security/oidc.go` sets session cookies without the Secure attribute, permitting transmission over unencrypted HTTP connections. Only deployments with OIDC authentication enabled are affected, and exploitation requires high attack complexity due to mandatory network interception positioning. No public exploit code has been identified; the upstream maintainer has closed the associated GitHub issue (#1689) as 'not planned', meaning no vendor patch will be released.
Session hijacking in Pinpoint (open-source APM) through version 3.1.0 stems from the pinpointJwt session cookie being issued without the HttpOnly and Secure flags, letting client-side JavaScript read it via document.cookie and allowing it to traverse cleartext HTTP. An attacker who can land a stored or reflected XSS payload, or who can sniff network traffic, can steal the JWT session token and impersonate the victim. There is no public exploit identified at time of analysis and the issue is not on CISA KEV; the CVSS 4.0 base score is 7.6.
Session cookie hijacking in Boruta authorization server prior to 0.9.1 allows network-positioned attackers to capture authentication and remember-me cookies because they lack the Secure attribute and may be transmitted over plaintext HTTP. The flaw affects boruta_web, boruta_identity, and boruta_admin components and enables full user impersonation, including potentially administrative sessions on an OAuth 2.0/OpenID Connect identity provider. No public exploit identified at time of analysis and the issue is not in CISA KEV.
Session token disclosure in HAX CMS versions 25.0.0 through 26.0.0 (exclusive) stems from the haxcms_refresh_token cookie being issued without the Secure flag, allowing the browser to send it over plaintext HTTP. A network-positioned attacker can capture the refresh token via passive sniffing and hijack the victim's authenticated session. No public exploit identified at time of analysis, and the vendor has published a fix in version 26.0.0.
KNIME Business Hub before 1.19.0 sets sensitive cookies without protective attributes such as Secure, HttpOnly or SameSite, so session data can be read or intercepted only when a separate cross-site scripting flaw exists in the product or an attacker already holds a man-in-the-middle position on the network path. The issue is rated CVSS 4.0 base 2.1 with Attack Requirements set to Present (AT:P), and it is prioritized as monitor; no public exploit was identified at time of analysis and there is no CISA KEV listing. The vendor states that a workaround is not possible and that upgrading to 1.19.0 is the only complete remediation.
Insecure cookie attribute configuration in HCL BigFix Service Management allows attackers to facilitate cross-site request forgery, session hijacking via cross-site scripting, and unauthorized access when a pre-existing enabler - such as an active XSS vector, a cross-site attack page, or an on-path network position - is present. This is a low-priority, defense-in-depth weakness rather than a directly exploitable flaw; no public exploit code has been identified at time of analysis. The vulnerability requires an application deployed without hardened cookie attributes (missing Secure, HttpOnly, SameSite, and restrictive Path), and exploitation yields only low-level confidentiality impact.
Session cookie interception in HCL iControl allows an on-path attacker to capture sensitive information such as session identifiers when the Secure attribute is missing and cookies are transmitted over unencrypted HTTP. Exploitation requires a victim with an authenticated session, transmission of the cookie over HTTP, and the attacker to occupy a man-in-the-middle position; no public exploit or active exploitation has been identified. This is a low-priority information disclosure issue (CVSS 3.1) with confidentiality-only impact.
Temporal UI Server versions 2.7.0 through 2.53.1 incorrectly derive the Secure attribute for OAuth authentication cookies from the proxy-to-server connection rather than the browser-facing connection, causing access-token and refresh-token cookies to be issued without Secure when TLS terminates at a reverse proxy forwarding over HTTP. An attacker who can additionally redirect browser traffic for the UI hostname away from HTTPS - beyond merely serving attacker-controlled content - can potentially intercept a live credential transmitted in a plaintext HTTP request. No public exploit code exists and CISA KEV does not list this vulnerability; the SSVC assessment confirms exploitation is currently none and the attack is not automatable, consistent with the very low CVSS 4.0 score of 2.3.
IBM Maximo Application Suite 9.0, 9.1, and 9.2 fails to set the `Secure` attribute on authorization tokens and session cookies, enabling interception of credential material over unencrypted HTTP. An attacker who tricks an authenticated user into following an HTTP link - via phishing or a malicious page - causes the victim's browser to transmit the session cookie in plaintext, where it can be captured by a server the attacker controls or via network sniffing. No public exploit has been identified at time of analysis and the vulnerability is not listed in the CISA KEV catalog; however, session token theft can lead to full account takeover, meaningfully exceeding the limited confidentiality scope implied by the raw CVSS score.
Session cookie exposure in HCL MyCloud arises from the cookie Path attribute not being set, causing authentication tokens to be transmitted to all paths within the application domain rather than restricted to intended endpoints. The CVSS 2.6 score reflects a genuinely limited-impact finding requiring both high attack complexity and authenticated user interaction to exploit, with only low confidentiality impact and no integrity or availability consequences. No public exploit code or active exploitation has been identified at time of analysis.
OIDC session cookie exposure in TwiN gatus 5.36.0 allows network-positioned attackers to intercept authentication tokens because the `setSessionCookie` function in `security/oidc.go` sets session cookies without the Secure attribute, permitting transmission over unencrypted HTTP connections. Only deployments with OIDC authentication enabled are affected, and exploitation requires high attack complexity due to mandatory network interception positioning. No public exploit code has been identified; the upstream maintainer has closed the associated GitHub issue (#1689) as 'not planned', meaning no vendor patch will be released.