IBM Jazz for Service Management versions 1.1.3.0 through 1.1.3.25 do not set the secure attribute on authorization tokens or session cookies. This omission allows cookies to be sent over insecure HTTP connections, potentially exposing them to interception by attackers who can trick users into visiting malicious HTTP links. The vulnerability has a low severity rating based on its CVSS score of 3.7.