CVE-2014-0154
EUVD-2014-021313.02.2015, 15:59
oVirt Engine before 3.5.0 does not include the HTTPOnly flag in a Set-Cookie header for the session IDs, which makes it easier for remote attackers to obtain potentially sensitive information via script access to this cookie.Enginsight
Affected Products (NVD)
| Vendor | Product | Version |
|---|---|---|
| ovirt | ovirt | 𝑥 ≤ 3.4.4 |
𝑥
= Vulnerable software versions
Common Weakness Enumeration