CVE-2015-2855

The WebUI component in Blue Coat SSL Visibility Appliance SV800, SV1800, SV2800, and SV3800 3.6.x through 3.8.x before 3.8.4 does not set the secure flag for the administrator's cookie in an https session, which makes it easier for remote attackers to capture this cookie by intercepting its transmission within an http session, a different vulnerability than CVE-2015-4138.

• CWE-200

• http://www.kb.cert.org/vuls/id/498348Third Party Advisory, US Government Resource
• http://www.securityfocus.com/bid/74921
• https://bto.bluecoat.com/security-advisory/sa96Vendor Advisory
• http://www.kb.cert.org/vuls/id/498348Third Party Advisory, US Government Resource
• http://www.securityfocus.com/bid/74921
• https://bto.bluecoat.com/security-advisory/sa96Vendor Advisory

Published

May 30, 2015

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2015-2849SQL injection vulnerability in main.ant in the ANTlabs InnGa…
• CVE-2015-2850Cross-site scripting (XSS) vulnerability in index-login.ant …
• CVE-2015-2851client_chown in the sync client in Synology Cloud Station 1.…
• CVE-2015-2852Cross-site request forgery (CSRF) vulnerability in the WebUI…
• CVE-2015-2853Session fixation vulnerability in the WebUI component in Blu…
• CVE-2015-2854The WebUI component in Blue Coat SSL Visibility Appliance SV…
• CVE-2015-2856Directory traversal vulnerability in the template function i…
• CVE-2015-2857Accellion File Transfer Appliance before FTA_9_11_210 allows…9.8
• CVE-2015-2858Datalex airline booking software before 2015-09-03 allows re…
• CVE-2015-2859Intel McAfee ePolicy Orchestrator (ePO) 4.x through 4.6.9 an…
• CVE-2015-2860Directory traversal vulnerability in Avigilon Control Center…
• CVE-2015-2861Cross-site request forgery (CSRF) vulnerability in Vesta Con…