Description
Drupal, probably 5.10 and 6.4, does not set the secure flag for the session cookie in an https session, which can cause the cookie to be sent in http requests and make it easier for remote attackers to capture this cookie.
Remediation
References
Related Vulnerabilities
Django DEPRECATED: Code Vulnerability (CVE-2015-0222)
WordPress Plugin Participants Database Cross-Site Scripting (1.7.5.9)
WordPress Plugin Wbcom Designs-BuddyPress Group Reviews Security Bypass (2.8.3)
Mailman Other Vulnerability (CVE-2005-0080)
WordPress Plugin WP Statistics Cross-Site Scripting (12.6.5)