Description

IBM Security Access Manager Appliance 9.0.1.0, 9.0.2.0, 9.0.3.0, 9.0.4.0, and 9.0.5.0 does not set the secure attribute on authorization tokens or session cookies. This could allow an attacker to obtain sensitive information using man in the middle techniques. IBM X-Force ID: 149703.

Remediation

References

CVE-2018-1804

Related Vulnerabilities

MediaWiki Insecure Storage of Sensitive Information Vulnerability (CVE-2021-36127)

WordPress Plugin wp Dreamwork Gallery 'upload.php' Arbitrary File Upload (2.1)

Ruby on Rails Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2011-2197)

Roundcube Improper Privilege Management Vulnerability (CVE-2017-8114)

WordPress Plugin Cache-Control Unspecified Vulnerability (2.2.3)

Severity

Low

Classification

CVE-2018-1804 CWE-384 CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N

Tags

Missing Update Known Vulnerabilities