CVE-2010-5148: Websense Web Security and Web Filter before 7.1 Hotfix 21 do not set the secure flag for the Encrypted Sess...

Security readout for executives and security teams

This is a legacy Websense session-cookie protection issue. In affected Web Security and Web Filter releases before 7.1 Hotfix 21, an SSL session cookie may be sent without the Secure flag, increasing the chance it could be exposed if traffic falls back to HTTP. Exposure is likely limited to organizations still running Websense Web Security or Web Filter before 7.1 Hotfix 21, especially where HTTP remains reachable alongside HTTPS. Prioritize confirmation if legacy Websense remains in use. This is not currently evidenced as actively exploited, but session cookie exposure can affect confidentiality and account integrity in environments still running affected versions. Mitigation focus: Confirm whether Websense Web Security or Web Filter is still deployed.; Check vendor guidance for 7.1 Hotfix 21 or later remediation.; Disable or redirect HTTP access where operationally possible..

Prepared

Jun 28, 2026, 00:52 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.