CVE-2014-9634

Jenkins before 1.586 does not set the secure flag on session cookies when run on Tomcat 7.0.41 or later, which makes it easier for remote attackers to capture cookies by intercepting their transmission within an HTTP session.

• CWE-254

• http://www.openwall.com/lists/oss-security/2015/01/22/3Mailing List, Third Party Advisory
• http://www.securityfocus.com/bid/72054Third Party Advisory, VDB Entry
• https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=769682Third Party Advisory
• https://bugzilla.redhat.com/show_bug.cgi?id=1185148Issue Tracking, Third Party Advisory, VDB Entry
• https://github.com/jenkinsci/jenkins/commit/582128b9ac179a788d43c1478be8a5224dc19710Patch, Third Party Advisory
• https://issues.jenkins-ci.org/browse/JENKINS-25019Issue Tracking, Vendor Advisory
• https://jenkins.io/changelog-old/Release Notes, Vendor Advisory
• http://www.openwall.com/lists/oss-security/2015/01/22/3Mailing List, Third Party Advisory
• http://www.securityfocus.com/bid/72054Third Party Advisory, VDB Entry
• https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=769682Third Party Advisory
• https://bugzilla.redhat.com/show_bug.cgi?id=1185148Issue Tracking, Third Party Advisory, VDB Entry
• https://github.com/jenkinsci/jenkins/commit/582128b9ac179a788d43c1478be8a5224dc19710Patch, Third Party Advisory
• https://issues.jenkins-ci.org/browse/JENKINS-25019Issue Tracking, Vendor Advisory
• https://jenkins.io/changelog-old/Release Notes, Vendor Advisory

Published

Sep 12, 2017

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2014-9627The MP4_ReadBox_String function in modules/demux/mp4/libmp4.…7.8
• CVE-2014-9628The MP4_ReadBox_String function in modules/demux/mp4/libmp4.…7.8
• CVE-2014-9629Integer overflow in the Encode function in modules/codec/sch…7.8
• CVE-2014-9630The rtp_packetize_xiph_config function in modules/stream_out…7.8
• CVE-2014-9632The TDI driver (avgtdix.sys) in AVG Internet Security before…
• CVE-2014-9633The bdisk.sys driver in COMODO Backup before 4.4.1.23 allows…
• CVE-2014-9635Jenkins before 1.586 does not set the HttpOnly flag in a Set…
• CVE-2014-9636unzip 6.0 allows remote attackers to cause a denial of servi…
• CVE-2014-9637GNU patch 2.7.2 and earlier allows remote attackers to cause…
• CVE-2014-9638oggenc in vorbis-tools 1.4.0 allows remote attackers to caus…
• CVE-2014-9639Integer overflow in oggenc in vorbis-tools 1.4.0 allows remo…
• CVE-2014-9640oggenc/oggenc.c in vorbis-tools 1.4.0 allows remote attacker…