{"action":"Upgrade novnc to 1:0.4+dfsg+1+20131010+gitf68af8af3d-4 or later.","affected":[{"fixed":"1:0.4+dfsg+1+20131010+gitf68af8af3d-4","introduced":"0"}],"component":"novnc","cve_ids":[],"ecosystem":"Debian","ecosystem_qualifier":"Debian:13","exploited":false,"fixed_versions":["1:0.4+dfsg+1+20131010+gitf68af8af3d-4"],"id":"tcs_01M5NAMYAFFNRSEM855TB87J3S","modified_at":"2026-09-01T20:03:19.930636951Z","published_at":"2015-04-10T14:59:00.063Z","references":["https://osv.dev/vulnerability/DEBIAN-CVE-2013-7436","https://security-tracker.debian.org/tracker/CVE-2013-7436"],"severity":{"label":"unknown"},"sources":[{"source":"osv","source_id":"DEBIAN-CVE-2013-7436#Debian:13/novnc","url":"https://osv.dev/vulnerability/DEBIAN-CVE-2013-7436"}],"summary":"noVNC before 0.5 does not set the secure flag for a cookie in an https session, which makes it easier for remote attackers to capture this cookie by intercepting its transmission within an http sessio"}