daotao.vku.udn.vn

Why it matters

This check asks whether an applicable CVE candidate also appears in the CISA Known Exploited Vulnerabilities (KEV) catalog. A positive match means attackers have used that vulnerability in real incidents and warrants urgent investigation, but the installed software still needs to be confirmed as affected.

What to do

Verify the installed product immediately and follow the CISA and vendor instructions for mitigation, patching, or upgrading if it is affected.

Evidence and check scope

Known exploited vulnerabilities:

1

Total known-exploited candidates:

1

Possible CVE identifiers:

CVE-2015-9251, CVE-2016-10735, CVE-2018-14040, CVE-2018-14042, CVE-2018-20676, CVE-2018-20677, CVE-2019-11358, CVE-2019-8331, CVE-2020-11022, CVE-2020-11023

Possible CVE identifiers shown:

CVE-2015-9251, CVE-2016-10735, CVE-2018-14040, CVE-2018-14042, CVE-2018-20676, CVE-2018-20677, CVE-2019-11358, CVE-2019-8331, CVE-2020-11022, CVE-2020-11023

Total possible vulnerabilities:

10

Possible vulnerabilities shown:

10

Known-exploited lookup complete:

Yes

Complete:

Yes

Products checked:

2

Products ready for matching:

2

16 additional evidence fields are not shown here.

References

Why it matters

The Secure attribute prevents a browser from sending a cookie over unencrypted HTTP. This bounded check scores cookies whose names look session- or authentication-related; other cookies are reported as context but do not by themselves prove that sensitive data is exposed.

What to do

Set Secure on every session, authentication, and other sensitive cookie served by the HTTPS application.

Why it matters

Content Security Policy (CSP) limits where scripts, styles, frames, and other browser content may come from. A strong policy reduces the impact if an attacker manages to inject content into a page.

What to do

Define only the sources the application needs, test the policy before activating it, and avoid broad wildcard (*) rules, unsafe-inline, and unsafe-eval where possible.