Apache Tomcat has cookies without HTTPOnly flag in Set-Cookie header

Description

References

• nvd.nist.gov/vuln/detail/CVE-2010-4312 · ADVISORY
• bugs.debian.org/cgi-bin/bugreport.cgi · WEB
• apache/tomcat · PACKAGE
• launchpad.net/bugs/cve/CVE-2010-4312 · WEB
• security-tracker.debian.org/tracker/CVE-2010-4312 · WEB
• ubuntu.com/security/CVE-2010-4312 · WEB
• securityfocus.com/archive/1/514866/100/0/threaded

Weitere Schwachstellen in org.apache.tomcat:tomcat

• CVE-2026-68525KRITISCH 9.1Incorrect Authorization vulnerability in Apache Tomcat's FORM authentication process allows the bypassing of a security constraint that limi…
• CVE-2026-65905KRITISCH 9.8Authentication Bypass by Capture-replay vulnerability in Apache Tomcat's DIGEST authenticator. If, before windowSize requests have been made…
• CVE-2026-65182KRITISCH 9.1Improper Access Control, Incorrect Authorization vulnerability in Apache Tomcat leads to security constraint bypass if a constraint for a lo…
• CVE-2026-43515KRITISCH 9.1Improper Authorization vulnerability when multiple method constraints define an HTTP method for the same extension in Apache Tomcat. This i…
• CVE-2026-43514NIEDRIG 3.7Observable Timing Discrepancy vulnerability when comparing AJP secret in Apache Tomcat. This issue affects Apache Tomcat: from 11.0.0-M1 th…