Security Advisories
CVEs affecting projects tracked on Release Alert, from NVD & OSV.
CVE-2010-4312
6.4
MEDIUMCVSS v2
Published
November 26, 2010
Affected
1 project
Assigned by
MITRE
Severity scale
010
Description
The default configuration of Apache Tomcat 6.x does not include the HTTPOnly flag in a Set-Cookie header, which makes it easier for remote attackers to hijack a session via script access to a cookie.
apache/tomcat
GitHubApache Tomcat
GitHubApache Tomcat= 6.0.6, = 6.0.11, = 6.0.7, = 6.0.4, = 6.0.15, = 6.0.20, = 6.0.10, = 6.0.29, = 6.0.3, = 6.0, = 6.0.28, = 6.0.17, = 6.0.18, = 6.0.2, = 6.0.26, = 6.0.19, = 6.0.16, = 6.0.14, = 6.0.1, = 6.0.0, = 6.0.13, = 6.0.24, = 6.0.9, = 6.0.8, = 6.0.5, = 6.0.27, = 6.0.12NVD