CVE-2015-1993: IBM Security QRadar Incident Forensics 7.2.x before 7.2.5 Patch 5 does not set the secure flag for unspecif...

Security readout for executives and security teams

IBM QRadar Incident Forensics 7.2.x before 7.2.5 Patch 5 could issue some session cookies without the Secure flag. That can let cookies travel over plain HTTP in some conditions, increasing the chance that an attacker on the network path could capture them. The source bundle does not provide CVSS, impact scope, or active exploitation evidence. Exposure is likely limited to organizations running IBM Security QRadar Incident Forensics 7.2.x versions earlier than 7.2.5 Patch 5. The provided affected product metadata is incomplete, so confirm against IBM’s advisory and local asset inventory. Treat as an exposure-reduction item for any environment still running the affected IBM product. It is not KEV-listed in the provided data, but session-cookie capture can support account compromise if network interception is possible. Mitigation focus: Upgrade affected systems to IBM Security QRadar Incident Forensics 7.2.5 Patch 5 or later.; Review the IBM advisory for exact affected builds and remediation requirements.; Confirm all QRadar Incident Forensics access uses HTTPS-only paths..

Prepared

Jun 13, 2026, 21:45 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.