CVE-2015-1994

Name of the Vulnerable Software and Affected Versions IBM Security QRadar Incident Forensics versions 7.2.x through 7.2.5 before Patch 5

Description The issue makes it easier for remote attackers to obtain potentially sensitive information via script access to a session cookie, as the HTTPOnly flag is not included in a Set-Cookie header.

Recommendations For IBM Security QRadar Incident Forensics versions 7.2.x through 7.2.5 before Patch 5, apply Patch 5 to include the HTTPOnly flag in the Set-Cookie header for the session cookie.