InVision: X-Frame-Options Header Not Set

Hi , Wamim Here With a dising issue iMPACT : X-Frame-Options header is not included in the HTTP response to protect against 'ClickJacking' attacks. Soliution : Most modern Web browsers support the X-Frame-Options HTTP header. Ensure it's set on all web pages returned by your site if you expect th...

Let's Encrypt Free SSL/TLS Certificate Now Trusted by Major Web Browsers

Yes, Let's Encrypt is now one step closer to its goal of offering Free HTTPS certificates to everyone. Let's Encrypt – the free, automated, and open certificate authority CA – has announced that its Free HTTPS certificates are Now Trusted and Supported by All Major Browsers. Let's Encrypt enables...

Keybase: xss

This xss issue only affects content sniffing browsers older versions that don't see the X-Content-Type-Options: nosniff header that you're sending. https://keybase.io//api/1.0/user/lookup.json?usernames=fakeuser1%2cfakeuser2'%22%26%25prompt/XSS/ This returns a page that contains this information:...

Vulnerability of Firefox and Firefox ESR browsers, allowing attackers to execute arbitrary code

The vulnerability of the HTMLVideoElement interface in browsers such as Firefox and Firefox ESR is related to the use of memory after it is freed. Exploiting this vulnerability allows a malicious actor to execute arbitrary code using JavaScript, thereby modifying the media elements’ tables...

[SECURITY] Fedora 22 Update: jakarta-commons-httpclient-3.1-23.fc22

The Hyper-Text Transfer Protocol HTTP is perhaps the most significant protocol used on the Internet today. Web services, network-enabled appliances and the growth of network computing continue to expand the role of the HTTP protocol beyond user-driven web browsers, and increase the number of...

[SECURITY] Fedora 23 Update: jakarta-commons-httpclient-3.1-23.fc23

The Hyper-Text Transfer Protocol HTTP is perhaps the most significant protocol used on the Internet today. Web services, network-enabled appliances and the growth of network computing continue to expand the role of the HTTP protocol beyond user-driven web browsers, and increase the number of...

Imgur: Content Sniffing not enabled

The HTTP header X-Content-Type-Options was not set to nosniff. This can cause some browsers to try to determine the content/encoding type of a response, which is an undesired behavior...

New vulnerability: the use of a browser Cookie to bypass HTTPS and steal private information-bug warning-the black bar safety net

! Recently, a presence in the major browsers Web cookies in a serious vulnerability is found, it enables secure browsing mode HTTPS is vulnerable to MiTM attacks. In addition, most of the Web sites and popular open source applications may contain Cookie injection vulnerabilities, including: Googl...

Exploiting Browser Cookies to Bypass HTTPS and Steal Private Information

A newly discovered critical flaw in the implementation of web cookies by major browsers could open secured HTTPS browsing to Man-in-the-middle attacks. The US Computer Emergency Response Team CERT has revealed that all the main browser vendors have improperly implemented the RFC 6265 Standard, al...

X2Engine 4.2 - Cross-Site Request Forgery

X2Engine 4.2 - Cross-Site Request Forgery Source: https://www.portcullis-security.com/security-research-and-downloads/security-advisories/cve-2015-5075/ Details: It was discovered that no protection against Cross-site Request Forgery attacks was implemented, resulting in an attacker being able to...

NeoKylin: China's Linux OS that Seriously Looks Like Windows XP

Do You Know: China has planned to eliminate all foreign Technologies and Services by 2020, just like Google and Facebook. And it seems China in some years would be an entirely independent IT economy; building homegrown Mobile and computer devices, Operating Systems, Applications, Browsers and...

Enabling QR codes in Internet Explorer, or a story of a cross-platform memory disclosure

Posted by Mateusz Jurczyk of Google Project Zero In the previous series of posts parts 1 2 3 4, we discussed the exploitation process of a serious “blend” vulnerability CVE-2015-0093 / CVE-2015-3052, which was special in that it provided the attacker with an extremely powerful primitive arbitrary...

CVE-2015-2542

Microsoft Internet Explorer 10 and 11 and Microsoft Edge allow remote attackers to execute arbitrary code or cause a denial of service memory corruption via a crafted web site, aka "Memory Corruption Vulnerability."...

CVE-2015-2494

Microsoft Internet Explorer 7 through 11 and Microsoft Edge allow remote attackers to execute arbitrary code or cause a denial of service memory corruption via a crafted web site, aka "Memory Corruption Vulnerability," a different vulnerability than CVE-2015-2486, CVE-2015-2487, CVE-2015-2490,...

Memory corruption

Microsoft Internet Explorer 7 through 11 and Microsoft Edge allow remote attackers to execute arbitrary code or cause a denial of service memory corruption via a crafted web site, aka "Memory Corruption Vulnerability," a different vulnerability than CVE-2015-2486, CVE-2015-2487, CVE-2015-2490,...

Memory corruption

Microsoft Internet Explorer 10 and 11 and Microsoft Edge allow remote attackers to execute arbitrary code or cause a denial of service memory corruption via a crafted web site, aka "Memory Corruption Vulnerability."...

The vulnerability of the Firefox OS operating system, as well as the Firefox and Firefox ESR browsers, allows attackers to circumvent access restrictions, read arbitrary files, and increase their privileges.

The vulnerability of the PDF reader component in the Firefox OS operating system, as well as in Firefox and Firefox ESR browsers, is related to the lack of protection for service data. Exploiting this vulnerability allows a malicious actor to bypass access controls, read arbitrary files, and...

CVE-2015-2542

Microsoft Internet Explorer 10 and 11 and Microsoft Edge allow remote attackers to execute arbitrary code or cause a denial of service memory corruption via a crafted web site, aka "Memory Corruption Vulnerability."...

Filet-o-Firewall UPnP Security Vulnerability in Home Routers

Security vulnerabilities in UPnP continue to crop up and continue to put millions of home networking devices at risk for compromise. The latest was revealed in early August, but prompted an advisory yesterday from the DHS-sponsored CERT at the Software Engineering Institute at Carnegie Mellon...

Vulnerabilities Identified in Dolphin, Mercury Android Browsers

Vulnerabilities exist in two fairly popular alternative browsers for Android – Dolphin and Mercury — that depending on the browser could result in either remote code execution or arbitrary read/write access. Mobile security researcher Benjamin Watson, who blogs under the guise of Rotlogix...