CWE-1004: CWE-1004

This vulnerability allows unauthenticated remote attackers to steal session-independent static cookies and escalate privileges to authenticated users ...

This vulnerability in SyroTech SY-GPON-1110-WDONT routers allows attackers to steal session cookies from the web management interface due to missing H...

This vulnerability in Johnson Controls System Configuration Tool (SCT) exposes sensitive cookies to client-side scripts because they lack the 'HttpOnl...

This vulnerability allows attackers to observe cookie policies through built-in browser developer tools. When combined with a cross-site scripting (XS...

ConnectWise PSA versions before 2026.1 fail to set HttpOnly attribute on certain session cookies, potentially allowing client-side scripts to access s...

A stored cross-site scripting (XSS) vulnerability in CE Phoenix eCommerce platform allows attackers to inject malicious JavaScript into testimonial de...

This vulnerability allows attackers to read sensitive cookies via JavaScript due to missing Secure and HttpOnly attributes. It affects BLU-IC2 and BLU...

This vulnerability allows client-side scripts (like JavaScript) to access the PHPSESSION cookie because the HttpOnly flag is disabled. This affects we...

This vulnerability involves a session cookie named '@@' being configured without the HttpOnly flag, making it accessible to client-side scripts. This ...

This vulnerability in Openfind's MailGates and MailAudit products allows remote attackers to potentially steal session cookies via cross-site scriptin...

This vulnerability allows remote attackers to capture session cookies from Tenda wireless routers due to missing HTTPOnly flags and insecure HTTP tran...