CVE-2014-0154

oVirt Engine before 3.5.0 does not include the HTTPOnly flag in a Set-Cookie header for the session IDs, which makes it easier for remote attackers to obtain potentially sensitive information via script access to this cookie.

• CWE-200

• http://rhn.redhat.com/errata/RHSA-2015-0158.htmlPatch, Vendor Advisory
• https://bugzilla.redhat.com/show_bug.cgi?id=1077450Vendor Advisory
• http://rhn.redhat.com/errata/RHSA-2015-0158.htmlPatch, Vendor Advisory
• https://bugzilla.redhat.com/show_bug.cgi?id=1077450Vendor Advisory

Published

Feb 13, 2015

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2014-0148Qemu before 2.0 block driver for Hyper-V VHDX Images is vuln…5.5
• CVE-2014-0149Multiple cross-site scripting (XSS) vulnerabilities in Red H…
• CVE-2014-0150Integer overflow in the virtio_net_handle_mac function in hw…
• CVE-2014-0151Cross-site request forgery (CSRF) vulnerability in oVirt Eng…
• CVE-2014-0152Session fixation vulnerability in the web admin interface in…
• CVE-2014-0153The REST API in oVirt 3.4.0 and earlier stores session IDs i…
• CVE-2014-0155The ioapic_deliver function in virt/kvm/ioapic.c in the Linu…
• CVE-2014-0156Awesome spawn contains OS command injection vulnerability, w…9.8
• CVE-2014-0157Cross-site scripting (XSS) vulnerability in the Horizon Orch…
• CVE-2014-0158Heap-based buffer overflow in the JPEG2000 image tile decode…
• CVE-2014-0159Buffer overflow in the GetStatistics64 remote procedure call…
• CVE-2014-0160The (1) TLS and (2) DTLS implementations in OpenSSL 1.0.1 be…7.5