Falhas do tipo CWE-614

69 resultados

Cookie sensível sem atributo Secure

Quando um cookie que contém dados sensíveis (sessão, autenticação, token) é criado sem a flag Secure, o navegador o envia também em conexões HTTP não criptografadas. Um atacante na rede (man-in-the-middle) consegue interceptar e roubar esse cookie, comprometendo a autenticação ou sessão do usuário.

Exemplo

Uma aplicação web autentica o usuário e cria um cookie de sessão com Set-Cookie: session_id=abc123; HttpOnly, mas esquece de adicionar Secure. Se o usuário acessar a página por HTTP em uma rede Wi-Fi pública, o cookie viaja em texto plano e pode ser capturado.

Como mitigar

Sempre adicione o atributo Secure em cookies que armazenem dados sensíveis (session_id, auth tokens): Set-Cookie: session_id=abc123; Secure; HttpOnly; SameSite=Strict. Force HTTPS em toda a aplicação e redirecione HTTP para HTTPS.

CVE-2024-41684MEDIUMCookie Without Secure Flag Set VulnerabilityEPSS 0.2%CVE-2025-24390MEDIUMMissing Cookie FlagsEPSS 0.2%CVE-2026-11956MEDIUMTwiN gatus OIDC Session Cookie oidc.go setSessionCookie missing secure attributeEPSS 0.2%CVE-2026-15656MEDIUMIBM MAS uses axios-1.15.2, protobufjs-8.0.1 and undici-7.26 which is vulnerable to multiple CVEs, and contains vulnerabilities related to missing Secure attribute on mas-redirect-uri cookie and weak HMAC Session SecretEPSS 0.2%CVE-2026-115519LOWSensitive cookies without 'Secure' and 'HttpOnly' attributes in KNIME Business HubEPSS 0.2%CVE-2024-58317MEDIUMKentico Xperience <= 13.0.164 Cookie Security ConfigurationEPSS 0.2%CVE-2024-55897MEDIUMIBM PowerHA SystemMirror for i information disclosureEPSS 0.2%CVE-2024-28770MEDIUMIBM Security Directory Integrator information disclosureEPSS 0.2%CVE-2024-28771MEDIUMIBM Security Directory Integrator information disclosureEPSS 0.2%CVE-2026-46398HIGHHAX CMS Missing Secure Flag on CookieEPSS 0.2%CVE-2025-36011MEDIUMIBM Jazz for Service Management information disclosureEPSS 0.2%CVE-2026-22617MEDIUMEaton Intelligent Power Protector (IPP) uses an insecure cookie configuration, which could allow a network‑based attacker to intercept the cEPSS 0.2%CVE-2025-36026MEDIUMIBM Datacap information disclosureEPSS 0.2%CVE-2026-46550MEDIUMNocoDB: Refresh Token Cookie Set Without `Secure` and `SameSite` FlagsEPSS 0.2%CVE-2026-57948HIGHPinpoint - Insecure Session Cookie Attributes in pinpointJwtEPSS 0.2%CVE-2025-36249LOWIBM Jazz for Service Management is vulnerable to "filter" cookie not sent over SSLEPSS 0.2%CVE-2026-56581LOWHCL MyCloud was affected with Cookie Attribute Path Not SetEPSS 0.2%CVE-2025-52632MEDIUMHCL AION is susceptible to Missing Secure Attribute in Encrypted Session (SSL) Cookie vulnerabilityEPSS 0.1%CVE-2025-52614LOWHCL Unica Platform is affected by a Cookie without HTTPOnly Flag Set vulnerabilityEPSS 0.1%CVE-2025-24897HIGHMisskey CSRF vulnerability due to insecure configuration of authentication cookie attributesEPSS 0.1%