Unscored severity · published Nov 8, 2015
CVE-2015-1993
IBM Security QRadar Incident Forensics 7.2.x before 7.2.5 Patch 5 does not set the secure flag for unspecified cookies in an https session, which makes it easier for remote…
–
CVSS
1.2%
EPSS
No
On KEV
Description
IBM Security QRadar Incident Forensics 7.2.x before 7.2.5 Patch 5 does not set the secure flag for unspecified cookies in an https session, which makes it easier for remote attackers to capture these cookies by intercepting their transmission within an http session.
Exploitation
Is it being used?
Exploit prediction (EPSS)1.2% · higher than 68% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
SQ
Security Qradar Incident Forensics · Ibm
7.2.0; 7.2.1; 7.2.2; 7.2.3; 7.2.4; 7.2.5 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2015-1993
CVE.org
https://www.cve.org/CVERecord?id=CVE-2015-1993
Vendor Advisory
http://www-01.ibm.com/support/docview.wss?uid=swg21968270
More from Security Qradar Incident Forensics
6.5
CVE-2016-2968
IBM Security QRadar Incident Forensics 7.2.x before 7.2.7 allows remote attackers to bypass authentication, and obtain sensitive information or modify data, via unspecified…
5.3
CVE-2016-2872
Directory traversal vulnerability in IBM Security QRadar SIEM 7.2.x before 7.2.7 and QRadar Incident Forensics 7.2.x before 7.2.7 allows remote attackers to read arbitrary files…
–
CVE-2015-1999
IBM Security QRadar Incident Forensics 7.2.x before 7.2.5 Patch 5 places session IDs in https URLs, which allows remote attackers to obtain sensitive information by reading (1)…
–
CVE-2015-1997
Cross-site request forgery (CSRF) vulnerability in IBM Security QRadar Vulnerability Manager 7.2.x before 7.2.5 Patch 5 allows remote attackers to hijack the authentication of…
–
CVE-2015-1996
IBM Security QRadar Incident Forensics 7.2.x before 7.2.5 Patch 5 does not prevent caching of HTTPS responses, which allows physically proximate attackers to obtain sensitive…