CWE-614 · 66 records

Sensitive Cookie in HTTPS Session Without 'Secure' Attribute

CVEs in this class

66 records

CVE records
Action	CVE	Vulnerability	Severity	KEV	EPSS	Published
36Monitor	CVE-2025-8037No exploit	Nameless cookies shadow secure cookiesmozilla · firefox · CWE-614 Pre-auth	Critical9.1	—	0.2%	Jul 22, 2025
35Monitor	CVE-2026-53661No exploit	boruta-server sent sensitive session cookies without the Secure attributemalach-it · boruta-server · CWE-614 Pre-auth	High8.8	—	0.3%	Jun 11, 2026
35Monitor	CVE-2026-46398No exploit	HAX CMS Missing Secure Flag on Cookiehaxtheweb · haxcms-php · CWE-614 Pre-auth	High8.8	—	0.3%	Jun 5, 2026
34Monitor	CVE-2025-0479No exploit	Security Misconfiguration Vulnerability in CP Plus Routercp plus · cp-xr-de21-s router · CWE-614 Pre-auth	High8.6	—	0.4%	Jan 20, 2025
34Monitor	CVE-2025-53757No exploit	Insecure Cookie Flags Vulnerability in Digisol DG-GR6821AC Routerdigisol · xpon onu wi-fi router (dg-gr6821ac) · CWE-614 Pre-auth	High8.7	—	0.3%	Jul 16, 2025
32Monitor	CVE-2020-27651No exploit	Synology Router Manager (SRM) before 1.2.4-8081 does not set the Secure flag for the session cookie in an HTTPS session, which makes it easisynology · router manager · CWE-614 Pre-auth	High8.1	—	0.8%	Oct 29, 2020
30Monitor	CVE-2022-25151No exploit	ITarian - Session cookie not protected by HttpOnly flagitarian · on-premise · CWE-614 Pre-auth XSS	High7.5	—	0.8%	Jun 9, 2022
30Monitor	CVE-2022-3174No exploit	Sensitive Cookie in HTTPS Session Without 'Secure' Attribute in ikus060/rdiffwebikus-soft · rdiffweb · CWE-614 Pre-auth	High7.5	—	0.7%	Sep 13, 2022
30Monitor	CVE-2018-25060No exploit	Macaron csrf csrf.go missing secure attributego-macaron · csrf · CWE-614 Pre-auth CSRF	High7.5	—	0.5%	Dec 30, 2022
30Monitor	CVE-2022-4409No exploit	Sensitive Cookie in HTTPS Session Without 'Secure' Attribute in thorsten/phpmyfaqphpmyfaq · phpmyfaq · CWE-614 Pre-auth	High7.5	—	0.5%	Dec 11, 2022
30Monitor	CVE-2024-10718No exploit	Cookie without Secure attribute in phpipam/phpipamphpipam · phpipam · CWE-614 Pre-auth	High7.5	—	0.3%	Mar 20, 2025
30Monitor	CVE-2024-2493No exploit	Session Hijacking Vulnerability in Hitachi Ops Center Analyzerhitachi · hitachi ops center analyzer · CWE-614 Pre-auth	High7.5	—	0.3%	Apr 23, 2024
30Monitor	CVE-2026-57948No exploit	Pinpoint - Insecure Session Cookie Attributes in pinpointJwtpinpoint-apm · pinpoint · CWE-614 Pre-auth XSS	High7.6	—	0.2%	Jun 29, 2026
30Monitor	CVE-2025-52632No exploit	HCL AION is susceptible to Missing Secure Attribute in Encrypted Session (SSL) Cookie vulnerabilityhcltech · aion · CWE-614 Pre-auth	High7.5	—	0.1%	Oct 10, 2025
29Monitor	CVE-2026-22617No exploit	Eaton Intelligent Power Protector (IPP) uses an insecure cookie configuration, which could allow a network‑based attacker to intercept the ceaton · intelligent power protector · CWE-614 Pre-auth	High7.4	—	0.2%	Apr 16, 2026
27Monitor	CVE-2021-3882No exploit	Sensitive Cookie in HTTPS Session Without 'Secure' Attribute in ledgersmb/ledgersmbledgersmb · ledgersmb · CWE-614 Pre-auth	Medium6.8	—	1.1%	Oct 14, 2021
27Monitor	CVE-2024-35211No exploit	A vulnerability has been identified in SINEC Traffic Analyzer (6GK8822-1BG01-0BA0) (All versions < V1.2).siemens · sinec traffic analyzer · CWE-614	Medium6.8	—	0.2%	Jun 11, 2024
27Monitor	CVE-2024-41684No exploit	Cookie Without Secure Flag Set Vulnerabilitysyrotech · sy-gpon-1110-wdont firmware · CWE-614 Pre-auth	Medium6.9	—	0.2%	Jul 26, 2024
27Monitor	CVE-2025-24390No exploit	Missing Cookie Flagsotrs ag · otrs · CWE-614	Medium6.8	—	0.2%	Jan 27, 2025
27Monitor	CVE-2024-58317No exploit	Kentico Xperience <= 13.0.164 Cookie Security Configurationkentico · xperience · CWE-614 Pre-auth	Medium6.9	—	0.2%	Dec 18, 2025
26Monitor	CVE-2022-24045No exploit	A vulnerability has been identified in Desigo DXR2 (All versions < V01.21.142.5-22), Desigo PXC3 (All versions < V01.21.142.4-18), Desigo PXsiemens · desigo dxr2 firmware · CWE-614	Medium6.5	—	0.6%	May 20, 2022
26Monitor	CVE-2021-27764No exploit	HCL BigFix WebUI Cookie missing attributeshcltech · bigfix webui · CWE-614 Pre-auth	Medium6.5	—	0.6%	May 6, 2022
26Monitor	CVE-2022-4683No exploit	Sensitive Cookie in HTTPS Session Without 'Secure' Attribute in usememos/memosusememos · memos · CWE-614	Medium6.5	—	0.4%	Dec 23, 2022
26Monitor	CVE-2025-27450No exploit	The Secure attribute is missing on multiple cookies provided by the MEAC300-FNADE4.endress · meac300-fnade4 firmware · CWE-614 Pre-auth	Medium6.5	—	0.3%	Jul 3, 2025
26Monitor	CVE-2024-28771No exploit	IBM Security Directory Integrator information disclosureibm · security directory integrator · CWE-614 Pre-auth	Medium6.5	—	0.2%	Jan 26, 2025

CVE-2025-8037
36Monitor
Nameless cookies shadow secure cookies
CriticalCVSS 9.1No exploitEPSS 0%
- Pre-auth
mozilla · firefoxJul 22, 2025
CVE-2026-53661
35Monitor
boruta-server sent sensitive session cookies without the Secure attribute
HighCVSS 8.8No exploitEPSS 0%
- Pre-auth
malach-it · boruta-serverJun 11, 2026
CVE-2026-46398
35Monitor
HAX CMS Missing Secure Flag on Cookie
HighCVSS 8.8No exploitEPSS 0%
- Pre-auth
haxtheweb · haxcms-phpJun 5, 2026
CVE-2025-0479
34Monitor
Security Misconfiguration Vulnerability in CP Plus Router
HighCVSS 8.6No exploitEPSS 0%
- Pre-auth
cp plus · cp-xr-de21-s routerJan 20, 2025
CVE-2025-53757
34Monitor
Insecure Cookie Flags Vulnerability in Digisol DG-GR6821AC Router
HighCVSS 8.7No exploitEPSS 0%
- Pre-auth
digisol · xpon onu wi-fi router (dg-gr6821ac)Jul 16, 2025
CVE-2020-27651
32Monitor
Synology Router Manager (SRM) before 1.2.4-8081 does not set the Secure flag for the session cookie in an HTTPS session, which makes it easi
HighCVSS 8.1No exploitEPSS 1%
- Pre-auth
synology · router managerOct 29, 2020
CVE-2022-25151
30Monitor
ITarian - Session cookie not protected by HttpOnly flag
HighCVSS 7.5No exploitEPSS 1%
- Pre-auth
- XSS
itarian · on-premiseJun 9, 2022
CVE-2022-3174
30Monitor
Sensitive Cookie in HTTPS Session Without 'Secure' Attribute in ikus060/rdiffweb
HighCVSS 7.5No exploitEPSS 1%
- Pre-auth
ikus-soft · rdiffwebSep 13, 2022
CVE-2018-25060
30Monitor
Macaron csrf csrf.go missing secure attribute
HighCVSS 7.5No exploitEPSS 1%
- Pre-auth
- CSRF
go-macaron · csrfDec 30, 2022
CVE-2022-4409
30Monitor
Sensitive Cookie in HTTPS Session Without 'Secure' Attribute in thorsten/phpmyfaq
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
phpmyfaq · phpmyfaqDec 11, 2022
CVE-2024-10718
30Monitor
Cookie without Secure attribute in phpipam/phpipam
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
phpipam · phpipamMar 20, 2025
CVE-2024-2493
30Monitor
Session Hijacking Vulnerability in Hitachi Ops Center Analyzer
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
hitachi · hitachi ops center analyzerApr 23, 2024
CVE-2026-57948
30Monitor
Pinpoint - Insecure Session Cookie Attributes in pinpointJwt
HighCVSS 7.6No exploitEPSS 0%
- Pre-auth
- XSS
pinpoint-apm · pinpointJun 29, 2026
CVE-2025-52632
30Monitor
HCL AION is susceptible to Missing Secure Attribute in Encrypted Session (SSL) Cookie vulnerability
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
hcltech · aionOct 10, 2025
CVE-2026-22617
29Monitor
Eaton Intelligent Power Protector (IPP) uses an insecure cookie configuration, which could allow a network‑based attacker to intercept the c
HighCVSS 7.4No exploitEPSS 0%
- Pre-auth
eaton · intelligent power protectorApr 16, 2026
CVE-2021-3882
27Monitor
Sensitive Cookie in HTTPS Session Without 'Secure' Attribute in ledgersmb/ledgersmb
MediumCVSS 6.8No exploitEPSS 1%
- Pre-auth
ledgersmb · ledgersmbOct 14, 2021
CVE-2024-35211
27Monitor
A vulnerability has been identified in SINEC Traffic Analyzer (6GK8822-1BG01-0BA0) (All versions < V1.2).
MediumCVSS 6.8No exploitEPSS 0%
siemens · sinec traffic analyzerJun 11, 2024
CVE-2024-41684
27Monitor
Cookie Without Secure Flag Set Vulnerability
MediumCVSS 6.9No exploitEPSS 0%
- Pre-auth
syrotech · sy-gpon-1110-wdont firmwareJul 26, 2024
CVE-2025-24390
27Monitor
Missing Cookie Flags
MediumCVSS 6.8No exploitEPSS 0%
otrs ag · otrsJan 27, 2025
CVE-2024-58317
27Monitor
Kentico Xperience <= 13.0.164 Cookie Security Configuration
MediumCVSS 6.9No exploitEPSS 0%
- Pre-auth
kentico · xperienceDec 18, 2025
CVE-2022-24045
26Monitor
A vulnerability has been identified in Desigo DXR2 (All versions < V01.21.142.5-22), Desigo PXC3 (All versions < V01.21.142.4-18), Desigo PX
MediumCVSS 6.5No exploitEPSS 1%
siemens · desigo dxr2 firmwareMay 20, 2022
CVE-2021-27764
26Monitor
HCL BigFix WebUI Cookie missing attributes
MediumCVSS 6.5No exploitEPSS 1%
- Pre-auth
hcltech · bigfix webuiMay 6, 2022
CVE-2022-4683
26Monitor
Sensitive Cookie in HTTPS Session Without 'Secure' Attribute in usememos/memos
MediumCVSS 6.5No exploitEPSS 0%
usememos · memosDec 23, 2022
CVE-2025-27450
26Monitor
The Secure attribute is missing on multiple cookies provided by the MEAC300-FNADE4.
MediumCVSS 6.5No exploitEPSS 0%
- Pre-auth
endress · meac300-fnade4 firmwareJul 3, 2025
CVE-2024-28771
26Monitor
IBM Security Directory Integrator information disclosure
MediumCVSS 6.5No exploitEPSS 0%
- Pre-auth
ibm · security directory integratorJan 26, 2025

All vulnerability classes