CWE-1004 Sensitive Cookie Without 'HttpOnly' Flag
Description
The product uses a cookie to store sensitive information, but the cookie is not marked with the HttpOnly flag.
Associated Reviewed Advisories
Vulnerabilities classified under CWE-1004 ordered by modification date.
| Advisory ID | NVD ID | Severity | PURLs | Summary | Last Modified |
|---|---|---|---|---|---|
| GHSA-fpmh-vx4h-xc33 | CVE-2026-53660 | HIGH |
OpenAM Insecure SSO Cookie Initialization |
2026-08-14 | |
| GHSA-4f9j-vr4p-642r | CVE-2026-42239 | HIGH |
Budibase auth session cookies are set with httpOnly:false — any XSS can lead to full account takeover |
2026-05-11 | |
| GHSA-fq4f-4738-rqxm | CVE-2026-25736 | MODERATE |
Rucio WebUI has a Stored Cross-site Scripting (XSS) Vulnerability in its Custom RSE Attribute |
2026-02-27 | |
| GHSA-8wpv-6x3f-3rm5 | CVE-2026-25735 | MODERATE |
Rucio WebUI has a Stored Cross-site Scripting (XSS) vulnerability its Identity Name |
2026-02-27 | |
| GHSA-h9fp-p2p9-873q | CVE-2026-25734 | MODERATE |
Rucio WebUI has Stored Cross-site Scripting (XSS) in RSE Metadata |
2026-02-27 | |
| GHSA-rwj9-7j48-9f7q | CVE-2026-25733 | HIGH |
Rucio WebUI Vulnerable to Stored Cross-site Scripting (XSS) through Custom Rule Function |
2026-02-27 | |
| GHSA-h79m-5jjm-jm4q | CVE-2026-25136 | HIGH |
Rucio WebUI has a Reflected Cross-site Scripting Vulnerability |
2026-02-27 | |
| GHSA-r3jq-4r5c-j9hp | CVE-2024-47833 | MODERATE |
Taipy has a Session Cookie without Secure and HTTPOnly flags |
2025-01-21 | |
| GHSA-f777-f784-36gm | - | HIGH | - |
TYPO3 Security Misconfiguration in Install Tool Cookie |
2024-06-07 |
| GHSA-ppvg-hw62-6ph9 | - | HIGH | - |
TYPO3 Security Misconfiguration in Install Tool Cookie |
2024-05-30 |
| GHSA-pvjh-7h8q-q56r | CVE-2010-4312 | MODERATE |
Apache Tomcat has cookies without HTTPOnly flag in Set-Cookie header |
2024-02-07 | |
| GHSA-mwvp-qr62-cvjx | CVE-2019-25091 | MODERATE |
nsupdate.info has Sensitive Cookie Without 'HttpOnly' Flag |
2023-01-09 |