CVE-2015-1994: IBM Security QRadar Incident Forensics 7.2.x before 7.2.5 Patch 5 does not include the HTTPOnly flag in a S...

Security readout for executives and security teams

IBM Security QRadar Incident Forensics 7.2.x before 7.2.5 Patch 5 set a session cookie without the HTTPOnly protection. If hostile script runs in a user's browser, that cookie may be easier to read, increasing session compromise risk. Exposure is limited to organizations running IBM Security QRadar Incident Forensics 7.2.x before 7.2.5 Patch 5. Risk is higher where the interface is reachable by untrusted networks or users browse it from less-controlled workstations. Treat as a targeted remediation item for legacy QRadar Incident Forensics deployments, not an emergency based on current evidence. Prioritize patching if the product remains in use or is exposed beyond trusted administrators. Mitigation focus: Upgrade affected QRadar Incident Forensics 7.2.x systems to 7.2.5 Patch 5 or later.; Review the IBM advisory for exact affected builds and upgrade prerequisites.; Limit access to the QRadar Incident Forensics interface until remediated..

Prepared

Jun 13, 2026, 21:45 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.