CWE-1275 · 13 records
Sensitive Cookie with Improper SameSite Attribute
CVEs in this class
13 records
| Action | CVE | Vulnerability | Severity | KEV | EPSS | Published |
|---|---|---|---|---|---|---|
39Monitor | CVE-2024-6611No exploit | Incorrect handling of SameSite cookiesmozilla · firefox · CWE-1275 | Critical9.8 | — | 0.6% | Jul 9, 2024 |
35Monitor | CVE-2025-52628No exploit | HCL AION is susceptible to Missing SameSite vulnerabilityhcltech · aion · CWE-1275 | High8.8 | — | 0.2% | Feb 3, 2026 |
34Monitor | CVE-2023-53957No exploit | Kimai 1.30.10 SameSite Cookie Vulnerability Session Hijackingkimai · kimai · CWE-1275 | High8.5 | — | 0.5% | Dec 19, 2025 |
30Monitor | CVE-2026-47889No exploit | Spring Framework sameSite Attribute Dropped in JettyCoreServerHttpResponsevmware · spring framework · CWE-1275 | High7.5 | — | 0.4% | Aug 27, 2026 |
30Monitor | CVE-2025-36134No exploit | IBM Sterling B2B Integrator and IBM Sterling File Gateway information disclosureibm · sterling b2b integrator · CWE-1275 | High7.5 | — | 0.3% | Nov 25, 2025 |
27Monitor | CVE-2026-107280No exploit | AsyncHttpClient: Cookie Domain attribute is not checked against the public suffix list, so a cookie can be set for co.ukasynchttpclient · async-http-client · CWE-1275 | Medium6.9 | — | 0.2% | Oct 7, 2026 |
26Monitor | CVE-2023-30674No exploit | Improper configuration in Samsung Internet prior to version 21.0.0.41 allows attacker to bypass SameSite Cookie.samsung · internet · CWE-1275 | Medium6.5 | — | 0.5% | Jul 5, 2023 |
26Monitor | CVE-2025-24387No exploit | Missing CSRF protectionotrs · otrs · CWE-1275 | Medium6.5 | — | 0.1% | Mar 10, 2025 |
23Monitor | CVE-2022-38386No exploit | IBM Cloud Pak for Security information disclosureibm · cloud pak for security · CWE-1275 | Medium5.9 | — | 0.4% | May 1, 2024 |
21Monitor | CVE-2024-42212No exploit | HCL BigFix Compliance is affected by an improper or missing SameSite attributehcltech · bigfix compliance · CWE-1275 | Medium5.4 | — | 0.2% | May 5, 2025 |
17Monitor | CVE-2024-30155No exploit | HCL SX is susceptible to cookie with Insecure, Improper, or Missing SameSite attribute vulnerabilityhcltech · hcl sx · CWE-1275 | Medium4.3 | — | 0.2% | Mar 26, 2025 |
16Monitor | CVE-2026-55688No exploit | AsyncHttpClient: Cookie stored for an unrelated domain (cookie tossing) via ThreadSafeCookieStoreasynchttpclient · async-http-client · CWE-1275 | Medium4.0 | — | 0.3% | Jul 1, 2026 |
14Monitor | CVE-2024-43173No exploit | IBM Concert information disclosureibm · concert · CWE-1275 | Low3.7 | — | 0.2% | Oct 22, 2024 |
- CVE-2024-661139Monitor
Incorrect handling of SameSite cookies
CriticalCVSS 9.8No exploitEPSS 0%mozilla · firefoxJul 9, 2024
- CVE-2025-5262835Monitor
HCL AION is susceptible to Missing SameSite vulnerability
HighCVSS 8.8No exploitEPSS 0%hcltech · aionFeb 3, 2026
- CVE-2023-5395734Monitor
Kimai 1.30.10 SameSite Cookie Vulnerability Session Hijacking
HighCVSS 8.5No exploitEPSS 0%kimai · kimaiDec 19, 2025
- CVE-2026-4788930Monitor
Spring Framework sameSite Attribute Dropped in JettyCoreServerHttpResponse
HighCVSS 7.5No exploitEPSS 0%vmware · spring frameworkAug 27, 2026
- CVE-2025-3613430Monitor
IBM Sterling B2B Integrator and IBM Sterling File Gateway information disclosure
HighCVSS 7.5No exploitEPSS 0%ibm · sterling b2b integratorNov 25, 2025
- CVE-2026-10728027Monitor
AsyncHttpClient: Cookie Domain attribute is not checked against the public suffix list, so a cookie can be set for co.uk
MediumCVSS 6.9No exploitEPSS 0%asynchttpclient · async-http-clientOct 7, 2026
- CVE-2023-3067426Monitor
Improper configuration in Samsung Internet prior to version 21.0.0.41 allows attacker to bypass SameSite Cookie.
MediumCVSS 6.5No exploitEPSS 0%samsung · internetJul 5, 2023
- CVE-2025-2438726Monitor
Missing CSRF protection
MediumCVSS 6.5No exploitEPSS 0%otrs · otrsMar 10, 2025
- CVE-2022-3838623Monitor
IBM Cloud Pak for Security information disclosure
MediumCVSS 5.9No exploitEPSS 0%ibm · cloud pak for securityMay 1, 2024
- CVE-2024-4221221Monitor
HCL BigFix Compliance is affected by an improper or missing SameSite attribute
MediumCVSS 5.4No exploitEPSS 0%hcltech · bigfix complianceMay 5, 2025
- CVE-2024-3015517Monitor
HCL SX is susceptible to cookie with Insecure, Improper, or Missing SameSite attribute vulnerability
MediumCVSS 4.3No exploitEPSS 0%hcltech · hcl sxMar 26, 2025
- CVE-2026-5568816Monitor
AsyncHttpClient: Cookie stored for an unrelated domain (cookie tossing) via ThreadSafeCookieStore
MediumCVSS 4.0No exploitEPSS 0%asynchttpclient · async-http-clientJul 1, 2026
- CVE-2024-4317314Monitor
IBM Concert information disclosure
LowCVSS 3.7No exploitEPSS 0%ibm · concertOct 22, 2024