The SingleSignOn Valve (org.apache.catalina.authenticator.SingleSignOn) in Apache Tomcat before 5.5.21 does not set the secure flag for the JSESSIONIDSSO cookie in an https session, which can cause the cookie to be sent in http requests and make it easier for remote attackers to capture this cookie.

The SingleSignOn Valve (org.apache.catalina.authenticator.SingleSignOn) in Apache Tomcat before 5.5.21 does not set the secure flag for the JSESSIONIDSSO cookie in an https session, which can cause the cookie to be sent in http requests and make it easier for remote attackers to capture this cookie.

mod_ssl SSLCipherSuite bypass libxpm buffer overflow tomcat multiple content-length header poisioning tomcat DoS openmotif libUil buffer overflows tomcat manager example DoS tomcat examples XSS perl-Crypt-CBC weaker encryption with some ciphers jabberd SASL DoS tomcat directory listing issue httpd mod_status XSS tomcat XSS in example webapps tomcat XSS in example webapps mod_jk chunk too long java-jre: GIF buffer overflow tomcat directory traversal mod_perl PerlRun denial of service tomcat XSS in samples tomcat accept-language xss flaw mod_jk sends decoded URL to tomcat javaws vulnerabilities tomcat examples jsp XSS tomcat host manager XSS Integer overflow in the embedded ICC profile image parser in Sun Java Development Kit BMP image parser vulnerability httpd scoreboard lack of PID protection tomcat handling of cookies tomcat handling of cookie values mod_autoindex XSS httpd: mod_imagemap XSS Absolute path traversal Apache Tomcat WEBDAV RHN XSS flaw JFreeChart: XSS vulnerabilities in the image map feature apache mod_status cross-site scripting tomcat5 SSO cookie login information disclosure