A company runs a DAST scan on a web application. The tool outputs the following recommendations:
• Use Cookie prefixes.
• Content Security Policy - SameSite=strict is not set.
Which of the following vulnerabilities has the tool identified?