CVE

Id
67563  
CVE No.
CVE-2014-0154  
Status
Candidate  
Description
oVirt Engine before 3.5.0 does not include the HTTPOnly flag in a Set-Cookie header for the session IDs, which makes it easier for remote attackers to obtain potentially sensitive information via script access to this cookie.  
Phase
Assigned (20131203)  
Votes
None (candidate not yet proposed)  
Comments