CWE-614 · Misconfiguration and Insecure Design
Sensitive Cookie in HTTPS Session Without 'Secure' Attribute
66CVEs
0exploited
0with a public check
0likely (EPSS 10%+)
SortMost likely exploited
66 CVEs with CWE-614 as their weakness
| CVE · most likely exploited | CVSS | EPSS | Published |
|---|---|---|---|
| CVE-2021-3882Sensitive Cookie in HTTPS Session Without 'Secure' Attribute in ledgersmb/ledgersmbledgersmb · ledgersmb/ledgersmb · CVSS 5.9 · 2021-10-14 | 5.9 | 1.1% | 2021-10-14 |
| CVE-2022-25151ITarian - Session cookie not protected by HttpOnly flagITarian · ITarian SaaS platform / on-premise · CVSS 7.5 · 2022-06-08 | 7.5 | 0.8% | 2022-06-08 |
| CVE-2020-27651Synology Router Manager (SRM) before 1.2.4-8081 does not set the Secure flag for the session cookie in an HTTPS session, which makes it easier for remote attackers to capture this…Synology · Synology Router Manager (SRM) · CVSS 5.8 · 2020-10-29 | 5.8 | 0.8% | 2020-10-29 |
| CVE-2015-3207In Openshift Origin 3 the cookies being set in console have no 'secure', 'HttpOnly' attributes.Openshift · Openshift Origin · 2022-07-07 | – | 0.8% | 2022-07-07 |
| CVE-2022-3174Sensitive Cookie in HTTPS Session Without 'Secure' Attribute in ikus060/rdiffwebikus060 · ikus060/rdiffweb · CVSS 7.5 · 2022-09-13 | 7.5 | 0.7% | 2022-09-13 |
| CVE-2022-3251Sensitive Cookie in HTTPS Session Without 'Secure' Attribute in ikus060/minarcaikus060 · ikus060/minarca · CVSS 7.5 · 2022-09-21 | 7.5 | 0.7% | 2022-09-21 |
| CVE-2022-24045A vulnerability has been identified in Desigo DXR2 (All versions < V01.21.142.5-22), Desigo PXC3 (All versions < V01.21.142.4-18), Desigo PXC4 (All versions < V02.20.142.10-10884)…Siemens · Desigo DXR2 · 2022-05-10 | – | 0.6% | 2022-05-10 |
| CVE-2018-25060Macaron csrf csrf.go missing secure attributeMacaron · csrf · CVSS 3.7 · 2022-12-30 | 3.7 | 0.6% | 2022-12-30 |
| CVE-2020-27650Synology DiskStation Manager (DSM) before 6.2.3-25426-2 does not set the Secure flag for the session cookie in an HTTPS session, which makes it easier for remote attackers to capt…Synology · DiskStation Manager (DSM) · CVSS 5.8 · 2020-10-29 | 5.8 | 0.6% | 2020-10-29 |
| CVE-2021-27764HCL BigFix WebUI Cookie missing attributesHCL Software · HCL BigFix WebUI · CVSS 7.4 · 2022-05-06 | 7.4 | 0.6% | 2022-05-06 |
| CVE-2022-3250Sensitive Cookie in HTTPS Session Without 'Secure' Attribute in ikus060/rdiffwebikus060 · ikus060/rdiffweb · CVSS 4.9 · 2022-09-21 | 4.9 | 0.5% | 2022-09-21 |
| CVE-2020-29024Missing HtppOnly and Secure flagsSecomea · GateManager · CVSS 5.3 · 2021-02-16 | 5.3 | 0.5% | 2021-02-16 |
| CVE-2021-35236Missing Secure Flag From SSL CookieSolarWinds · Kiwi Syslog Server · CVSS 3.1 · 2021-10-27 | 3.1 | 0.5% | 2021-10-27 |
| CVE-2023-0055Sensitive Cookie in HTTPS Session Without 'Secure' Attribute in pyload/pyloadpyload · pyload/pyload · CVSS 3.1 · 2023-01-04 | 3.1 | 0.5% | 2023-01-04 |
| CVE-2022-4409Sensitive Cookie in HTTPS Session Without 'Secure' Attribute in thorsten/phpmyfaqthorsten · thorsten/phpmyfaq · CVSS 6.3 · 2022-12-11 | 6.3 | 0.5% | 2022-12-11 |
| CVE-2022-4683Sensitive Cookie in HTTPS Session Without 'Secure' Attribute in usememos/memosusememos · usememos/memos · CVSS 4.3 · 2022-12-23 | 4.3 | 0.4% | 2022-12-23 |
| CVE-2024-0349SourceCodester Engineers Online Portal missing secure attributeSourceCodester · Engineers Online Portal · CVSS 3.7 · 2024-01-09 | 3.7 | 0.4% | 2024-01-09 |
| CVE-2026-65655Temporal UI Server may set OAuth credential cookies without Secure behind a TLS-terminating reverse proxyTemporal Technologies, Inc. · Temporal UI Server · CVSS 2.3 · 2026-08-11 | 2.3 | 0.4% | 2026-08-11 |
| CVE-2022-21940Sensitive Cookie in HTTPS Session Without 'Secure' Attribute in System Configuration Tool (SCT)Johnson Controls · System Configuration Tool (SCT) · CVSS 7.5 · 2023-02-09 | 7.5 | 0.4% | 2023-02-09 |
| CVE-2026-41017Apache Airflow: JWT cookie missing Secure flag in JWTRefreshMiddleware behind HTTPS-terminating proxyApache Software Foundation · Apache Airflow · CVSS 5.9 · 2026-06-01 | 5.9 | 0.4% | 2026-06-01 |
| CVE-2023-4654Sensitive Cookie in HTTPS Session Without 'Secure' Attribute in instantsoft/icms2instantsoft · instantsoft/icms2 · CVSS 2.6 · 2023-08-31 | 2.6 | 0.3% | 2023-08-31 |
| CVE-2024-10718Cookie without Secure attribute in phpipam/phpipamphpipam · phpipam/phpipam · CVSS 5.3 · 2025-03-20 | 5.3 | 0.3% | 2025-03-20 |
| CVE-2023-5866Sensitive Cookie in HTTPS Session Without 'Secure' Attribute in thorsten/phpmyfaqthorsten · thorsten/phpmyfaq · CVSS 6.3 · 2023-10-31 | 6.3 | 0.3% | 2023-10-31 |
| CVE-2025-53757Insecure Cookie Flags Vulnerability in Digisol DG-GR6821AC RouterDigisol · XPON ONU Wi-Fi Router (DG-GR6821AC) · CVSS 8.7 · 2025-07-16 | 8.7 | 0.3% | 2025-07-16 |
| CVE-2024-2493Session Hijacking Vulnerability in Hitachi Ops Center AnalyzerHitachi · Hitachi Ops Center Analyzer · CVSS 7.5 · 2024-04-23 | 7.5 | 0.3% | 2024-04-23 |
| CVE-2025-27450CVE-2025-27450Endress+Hauser · Endress+Hauser MEAC300-FNADE4 · CVSS 6.5 · 2025-07-03 | 6.5 | 0.3% | 2025-07-03 |
| CVE-2023-3520Sensitive Cookie in HTTPS Session Without 'Secure' Attribute in it-novum/openitcockpitit-novum · it-novum/openitcockpit · CVSS 4.3 · 2023-07-06 | 4.3 | 0.3% | 2023-07-06 |
| CVE-2023-46179IBM Secure Proxy information disclosureIBM · Secure Proxy · CVSS 4.3 · 2024-03-15 | 4.3 | 0.3% | 2024-03-15 |
| CVE-2026-43828Apache Shiro: Shiro's native session and rememberMe cookies do not have secure flag set by defaultApache Software Foundation · Apache Shiro · CVSS 5.9 · 2026-05-25 | 5.9 | 0.3% | 2026-05-25 |
| CVE-2023-42016IBM Sterling B2B Integrator information disclosureIBM · Sterling B2B Integrator · CVSS 4.3 · 2024-02-09 | 4.3 | 0.3% | 2024-02-09 |
| CVE-2025-8037Nameless cookies shadow secure cookiesMozilla · Firefox · CVSS 9.1 · 2025-07-22 | 9.1 | 0.3% | 2025-07-22 |
| CVE-2026-53661boruta-server sent sensitive session cookies without the Secure attributemalach-it · boruta-server · CVSS 8.8 · 2026-06-11 | 8.8 | 0.3% | 2026-06-11 |
| CVE-2024-47833Session Cookie without Secure and HTTPOnly flags in taipyAvaiga · taipy · CVSS 6.3 · 2024-10-09 | 6.3 | 0.3% | 2024-10-09 |
| CVE-2026-48058nebula-mesh: Session and OIDC state cookies lack the Secure attributejuev · nebula-mesh · CVSS 4.6 · 2026-07-28 | 4.6 | 0.2% | 2026-07-28 |
| CVE-2023-5035Cookie Without Secure FlagMoxa · PT-G503 Series · CVSS 3.1 · 2023-11-02 | 3.1 | 0.2% | 2023-11-02 |
| CVE-2023-33860IBM Security ReaQta information disclosureIBM · Security QRadar EDR · CVSS 5.3 · 2024-07-10 | 5.3 | 0.2% | 2024-07-10 |
| CVE-2024-43180IBM Concert information disclosureIBM · Concert · CVSS 4.3 · 2024-09-13 | 4.3 | 0.2% | 2024-09-13 |
| CVE-2024-39734IBM Datacap Navigator information disclosureIBM · Datacap Navigator · CVSS 4.3 · 2024-07-14 | 4.3 | 0.2% | 2024-07-14 |
| CVE-2024-35211A vulnerability has been identified in SINEC Traffic Analyzer (6GK8822-1BG01-0BA0) (All versions < V1.2). The affected web server, after a successful login, sets the session cooki…Siemens · SINEC Traffic Analyzer · CVSS 5.5 · 2024-06-11 | 5.5 | 0.2% | 2024-06-11 |
| CVE-2024-41684Cookie Without Secure Flag Set VulnerabilitySyroTech · SyroTech SY-GPON-1110-WDONT router · CVSS 6.9 · 2024-07-26 | 6.9 | 0.2% | 2024-07-26 |
| CVE-2025-24390Missing Cookie FlagsOTRS AG · OTRS · CVSS 6.8 · 2025-01-27 | 6.8 | 0.2% | 2025-01-27 |
| CVE-2026-11956TwiN gatus OIDC Session Cookie oidc.go setSessionCookie missing secure attributeTwiN · gatus · CVSS 3.7 · 2026-06-11 | 3.7 | 0.2% | 2026-06-11 |
| CVE-2026-15656IBM MAS uses axios-1.15.2, protobufjs-8.0.1 and undici-7.26 which is vulnerable to multiple CVEs, and contains vulnerabilities related to missing Secure attribute on mas-redirect-…IBM · Maximo Application Suite · CVSS 4.3 · 2026-08-05 | 4.3 | 0.2% | 2026-08-05 |
| CVE-2026-115519Sensitive cookies without 'Secure' and 'HttpOnly' attributes in KNIME Business HubKNIME · KNIME Business Hub · CVSS 2.1 · 2026-10-22 | 2.1 | 0.2% | 2026-10-22 |
| CVE-2024-58317Kentico Xperience <= 13.0.164 Cookie Security ConfigurationKentico · Xperience · CVSS 5.3 · 2025-12-18 | 5.3 | 0.2% | 2025-12-18 |
| CVE-2024-55897IBM PowerHA SystemMirror for i information disclosureIBM · i · CVSS 4.3 · 2025-01-03 | 4.3 | 0.2% | 2025-01-03 |
| CVE-2024-28771IBM Security Directory Integrator information disclosureIBM · Security Directory Integrator · CVSS 4.8 · 2025-01-27 | 4.8 | 0.2% | 2025-01-27 |
| CVE-2024-28770IBM Security Directory Integrator information disclosureIBM · Security Directory Integrator · CVSS 4.8 · 2025-01-27 | 4.8 | 0.2% | 2025-01-27 |
| CVE-2026-46398HAX CMS Missing Secure Flag on Cookiehaxtheweb · haxcms-php · CVSS 8.8 · 2026-06-05 | 8.8 | 0.2% | 2026-06-05 |
| CVE-2025-36011IBM Jazz for Service Management information disclosureIBM · Jazz for Service Management · CVSS 4.3 · 2025-09-09 | 4.3 | 0.2% | 2025-09-09 |
EPSS is the probability of exploitation in the next 30 days (FIRST). Data as of 2026-11-14.