Weaknesses of type CWE-1004

45 results

Cookie sensível sem flag HttpOnly

Uma aplicação cria um cookie contendo dados sensíveis (como token de sessão, credenciais) mas não marca a flag HttpOnly, permitindo que JavaScript no navegador acesse o cookie. Isso expõe o dado a ataques XSS, onde um script malicioso injeta código e rouba o cookie diretamente.

Example

Um site de banco faz login e armazena o token de autenticação em um cookie sem HttpOnly. Um atacante injeta JavaScript via XSS em um comentário da página; o script lê document.cookie, rouba o token e o envia para um servidor controlado.

How to mitigate

Sempre defina a flag HttpOnly ao criar cookies sensíveis (ex: Set-Cookie: session=xyz; HttpOnly; Secure). Assim o cookie fica inacessível a JavaScript, reduzindo o risco de roubo por XSS. Combine com SameSite=Strict e Secure para defesa em camadas.

CVE-2023-4228LOWioLogik 4000 Series: Session Cookies Attribute Not Set ProperlyEPSS 0.3%CVE-2025-24318MEDIUMDario Health USB-C Blood Glucose Monitoring System Starter Kit Android Application Sensitive Cookie Without 'HttpOnly' FlagEPSS 0.3%CVE-2026-53660HIGHOpenAM Insecure SSO Cookie InitializationEPSS 0.3%CVE-2023-4217LOWSession cookies attribute not set properlyEPSS 0.3%CVE-2025-49189MEDIUMCookie missing HttpOnly flagEPSS 0.3%CVE-2026-82697MEDIUMsambitraj Student-Management-System session_start cookie httponly flagEPSS 0.3%CVE-2023-2876LOWSession cookie exposure for client side scriptEPSS 0.3%CVE-2026-25734MEDIUMRucio WebUI has Stored Cross-site Scripting (XSS) in RSE MetadataEPSS 0.3%CVE-2026-25736MEDIUMRucio WebUI has a Stored Cross-site Scripting (XSS) Vulnerability in its Custom RSE AttributeEPSS 0.3%CVE-2026-25735MEDIUMRucio WebUI has a Stored Cross-site Scripting (XSS) vulnerability its Identity NameEPSS 0.3%CVE-2026-42239HIGHBudibase auth session cookies are set with httpOnly:false — any XSS can lead to full account takeoverEPSS 0.3%CVE-2025-53757HIGHInsecure Cookie Flags Vulnerability in Digisol DG-GR6821AC RouterEPSS 0.3%CVE-2025-57424HIGHA stored cross-site scripting (XSS) vulnerability exists in the MyCourts v3 application within the LTA number profile field. An attacker canEPSS 0.3%CVE-2026-25136HIGHRucio WebUI has a Reflected Cross-site Scripting VulnerabilityEPSS 0.3%CVE-2026-25733HIGHRucio WebUI Vulnerable to Stored Cross-site Scripting (XSS) through Custom Rule FunctionEPSS 0.3%CVE-2024-47833MEDIUMSession Cookie without Secure and HTTPOnly flags in taipyEPSS 0.3%CVE-2025-47289MEDIUMStored XSS in CE Phoenix Cart Testimonials Allows Account Takeover if Missing HttpOnly FlagEPSS 0.2%CVE-2026-35575HIGHChurchCRM has Stored XSS in Group NameEPSS 0.2%CVE-2025-42909LOWSecurity Misconfiguration vulnerability in SAP Cloud Appliance Library AppliancesEPSS 0.2%CVE-2021-34563LOWIn WirelessHART-Gateway versions 3.0.8 and 3.0.9 the HttpOnly flag is missing in a cookie which allows client-side javascript to modify itEPSS 0.2%