GMail Goes "https-only" By Default

A day after confirming a major security breach by Chinese hackers looking for GMail account information, Google has turned on default “https:” access for its popular Web mail service. Google had previously added the option for GMail users to “always use https” back in July 2008 but it was turned...

Experts Ask Google to Bolster Security of Online Tools

A collection of some of the top names in the security community has sent a letter asking Google to force users of its online applications to use secure connections by default. And Google has responded quickly, saying that it is investigating the possibility of enabling HTTPS connections by defaul...

php168 v2008 default setting of the disaster-vulnerability warning-the black bar safety net

index.php Section 6 3 line start 1. elseif$webdbNewsMakeHtml==1 //if it is to generate static and... 2. 3. $content=obgetcontents; 4. obendclean; 5. obstart; //spare 6. $content=makehtml$content,'index'; 7. echo "$content"; 8. makehtml function code 1. function makehtml$content,$pagetype=" 2...

lighttpd: Multiple vulnerabilities

Background lighttpd is a lightweight high-performance web server. Description Julien Cayzax discovered that an insecure default setting exists in moduserdir in lighttpd. When userdir.path is not set the default value used is $HOME. It should be noted that the "nobody" user's $HOME is "/"...

Privacy issue with SSL Client Authentication — Mozilla

Peter Brodersen and Alexander Klink independently reported that the default setting for SSL Client Authentication, automatically selecting a client certificate on behalf of the user, creates a potential privacy issue for users by allowing tracking through client certificates. For users who alread...

A user cannot set the security level to none if the default security level is set

Selecting 'none' always creates an issue with the default security level...

phpMyAdmin: Multiple vulnerabilities

Background phpMyAdmin is a popular, web-based MySQL administration tool written in PHP. It allows users to administer a MySQL database from a web-browser. Description Two serious vulnerabilities exist in phpMyAdmin. The first allows any user to alter the server configuration variables including...

CVE-2001-1221

The CVE-2001-1221 entry affects D‑Link DWL-1000AP Wireless LAN Access Point with firmware 3.2.28 #483. The issue is use of a default SNMP community string 'public', allowing remote attackers to obtain sensitive information. The provided documents do not specify affected versions beyond the listed...