CWE-614 · Sensitive Cookie in HTTPS Session Without 'Secure' Attribute
61 CVEs classified under CWE-614 (Sensitive Cookie in HTTPS Session Without 'Secure' Attribute). Browse by severity and year.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-8037 | Critical | 9.1 | 2025-07-22 | Setting a nameless cookie with an equals sign in the value shadowed other cookies. Even if the nameless cookie was set over HTTP and the shadowed cookie includ… |
CVE-2025-24897 | High | 8.2 | 2025-02-11 | Misskey is an open source, federated social media platform. Starting in version 12.109.0 and prior to version 2025.2.0-alpha.0, due to a lack of CSRF protectio… |
CVE-2024-10718 | High | 7.5 | 2025-03-20 | In phpipam/phpipam version 1.5.1, the Secure attribute for sensitive cookies in HTTPS sessions is not set. This could cause the user agent to send those cookie… |
CVE-2024-2493 | High | 7.5 | 2024-04-23 | Session Hijacking vulnerability in Hitachi Ops Center Analyzer.This issue affects Hitachi Ops Center Analyzer: from 10.0.0-00 before 11.0.1-00. |
CVE-2022-21940 | High | 7.5 | 2023-02-09 | Sensitive Cookie in HTTPS Session Without 'Secure' Attribute vulnerability in Johnson Controls System Configuration Tool (SCT) version 14 prior to 14.2.3 and v… |
CVE-2022-4409 | High | 7.5 | 2022-12-11 | Sensitive Cookie in HTTPS Session Without 'Secure' Attribute in GitHub repository thorsten/phpmyfaq prior to 3.1.9. |
CVE-2022-3174 | High | 7.5 | 2022-09-13 | Sensitive Cookie in HTTPS Session Without 'Secure' Attribute in GitHub repository ikus060/rdiffweb prior to 2.4.2. |
CVE-2022-25151 | High | 7.5 | 2022-06-09 | Within the Service Desk module of the ITarian platform (SAAS and on-premise), a remote attacker can obtain sensitive information, caused by the failure to set… |
CVE-2021-27764 | High | 7.4 | 2022-05-06 | Cookie without HTTPONLY flag set. NUMBER cookie(s) was set without Secure or HTTPOnly flags. The images show the cookie with the missing flag. (WebUI) |
CVE-2026-57948 | Medium | 6.8 | 2026-06-29 | Pinpoint through version 3.1.0 contains an insecure session management vulnerability that allows attackers to access the pinpointJwt session cookie due to miss… |
CVE-2025-24390 | Medium | 6.8 | 2025-01-27 | A vulnerability in OTRS Application Server and reverse proxy settings allows session hijacking due to missing attributes for sensitive cookie settings in HTTPS… |
CVE-2021-3882 | Medium | 6.8 | 2021-10-14 | LedgerSMB does not set the 'Secure' attribute on the session authorization cookie when the client uses HTTPS and the LedgerSMB server is behind a reverse proxy… |
CVE-2026-43828 | Medium | 6.5 | 2026-05-25 | Default configurations of Apache Shiro send sensitive cookies in HTTPS session without 'Secure' attribute. This issue affects Apache Shiro from 1.0 to 2.1.0… |
CVE-2026-1697 | Medium | 6.5 | 2026-02-26 | The Secure and SameSite attribute are missing in the GraphicalData web services and WebClient web app of PcVue in version 12.0.0 through 16.3.3 included. |
CVE-2025-52632 | Medium | 6.5 | 2025-10-10 | A Missing Secure Attribute in Encrypted Session (SSL) Cookie vulnerability in HCL AION.This issue affects AION: 2.0. |
CVE-2025-27450 | Medium | 6.5 | 2025-07-03 | The Secure attribute is missing on multiple cookies provided by the MEAC300-FNADE4. An attacker can trick a user to establish an unencrypted HTTP connection to… |
CVE-2024-47833 | Medium | 6.5 | 2024-10-09 | Taipy is an open-source Python library for easy, end-to-end application development for data scientists and machine learning engineers. In affected versions se… |
CVE-2022-4683 | Medium | 6.5 | 2022-12-23 | Sensitive Cookie in HTTPS Session Without 'Secure' Attribute in GitHub repository usememos/memos prior to 0.9.0. |
CVE-2022-24045 | Medium | 6.5 | 2022-05-20 | A vulnerability has been identified in Desigo DXR2 (All versions < V01.21.142.5-22), Desigo PXC3 (All versions < V01.21.142.4-18), Desigo PXC4 (All versions <… |
CVE-2026-32745 | Medium | 6.3 | 2026-03-13 | In JetBrains Datalore before 2026.1 session hijacking was possible due to missing secure attribute for cookie settings |