Unscored CVE-2015-3319 EUVD-2015-3365GHSA-6634-p5wf-9mgr

Hotspot Express hotEx Billing Manager 73 does not include the HTTPOnly flag in a Set-Cookie header, which makes it easier for remote attack…

Published Apr 16, 2015 · Updated Aug 6, 2024 · Assigned by mitre

Description

Hotspot Express hotEx Billing Manager 73 does not include the HTTPOnly flag in a Set-Cookie header, which makes it easier for remote attackers to obtain potentially sensitive information via script access to this cookie.

References

http://packetstormsecurity.com/files/131297/HotExBilling-Manager-73-Cross-Site-Scripting.html
20150408 HotExBilling Manager Cross-site scriptin g (XSS) vulnerability mailing-list
20150405 HotExBilling Manager Cross-site scripting (XSS) vulnerability mailing-list
74205 vdb-entry