PT-2018-16793 · Veraport · Veraport G3

Name of the Vulnerable Software and Affected Versions: Veraport G3 ALL on MacOS affected versions not specified Description: The issue is related to insufficient domain validation, allowing a remote unauthenticated attacker to overwrite installation files with malicious ones, potentially leading ...

PT-2019-5708 · Python +8 · Python +8

Name of the Vulnerable Software and Affected Versions: Python versions 2.x through 2.7.16 Python versions 3.x before 3.4.10 Python versions 3.5.x before 3.5.7 Python versions 3.6.x before 3.6.9 Python versions 3.7.x before 3.7.3 Description: The issue is related to the incorrect domain validation...

GitLab: Lack of validation before assigning custom domain names leading to abuse of GitLab pages service

One way to add a custom domain name for GitLab pages is to create a new DNS A record pointing to the IP of GitLab Pages server i.e. 52.167.214.135. A person who owns the domain name, could then add the domain name in the Pages settings at https://gitlab.com///pages. GitLab then assigns the domain...

Free Certs Come With a Cost

Let’s Encrypt is the largest certificate authority by volume doling out more than 100,000 free domain certificates a day. The non-profit fulfills a noble mission of securing website communications that is applauded across the internet; it has raised the bar on SSL and TLS security, issuing 100...

Reaching toward universal TLS SNI

The past few years have seen a dramatic increase in client support for TLS SNI a technology standard that makes HTTPS much more scaleable. While early 2014 saw fewer than 85% of HTTPS requests being sent by clients supporting TLS SNI, many Akamai customers today now see client TLS SNI usage...

Saying Goodbye to the ShadowBrokers, GoDaddy's Domain Validation Issue, and More

Mike Mimoso and Chris Brook discuss the news of the week, including the ShadowBrokers’ farewell, GoDaddy’s buggy domain validation issue, MongoDB ransoms, and the latest with St. Jude Medical. Show notes: ShadowBrokers Bid Farewell, Close Doors ShadowBrokers Selling Windows Exploits, Attack Tools...

Buggy Domain Validation Forces GoDaddy to Revoke Certs

GoDaddy has revoked, and begun the process of re-issuing, new SSL certificates for more than 6,000 customers after a bug was discovered in the registrar’s domain validation process. The bug was introduced July 29 and impacted fewer than two percent of the certificates GoDaddy issued from that dat...

Apple To Block WoSign Intermediate Certificates

Apple weighed in on the ongoing WoSign fiasco over the weekend, saying it would soon distrust certificates issued by the Chinese Certificate Authority’s Free SSL Certificate G2 intermediate CA on macOS. Apple’s decision comes several days after Mozilla accused the CA of backdating SHA-1...

Keeping Positive – Obtaining Arbitrary Wildcard SSL Certificates from Comodo via Dangling Markup Injection

I recently decided to investigate the security of various certificate authority’s online certificate issuing systems. These online issuers allow certificate authorities to verify that someone owns a specific domain, such as thehackerblog.com and get a signed certificate so they can enable SSL/TLS...

X (Formerly Twitter): Incorrect param parsing in Digits web authentication

Hi, I would like to report an issue on Digits web authentication which allows attackers to retrieve the OAuth credential data of an application victims authorized. Detail Digits web authentication has strict validation on host and callbackurl. On the server side, the values are compared with the...

Symantec Domain-Validation Certificate Incorrect Character Handling Vulnerability

Symantec Domain-Validation Certificates are a set of certificates that provide encryption and authentication capabilities over SSL/TLS. Symantec DV Certificates do not properly handle specific characters in email addresses, allowing remote attackers to obtain legitimate DV SSL/TLS certificates wi...

Updated squid packages fix CVE-2015-3455

Updated squid packages fix security vulnerability: Squid configured with client-first SSL-bump does not correctly validate X509 server certificate domain / hostname fields CVE-2015-3455...

WePay: oauth redirect uri validation bug leads to open redirect and account compromise

according to: https://stage.wepay.com/developer/reference/oauth2 "redirecturi - The uri the user will be redirected to after authorization. Must have the same domain as the application." your current validation of this domain value is not sufficient. i setup my app with a website url of...

Two more Comodo registration authority accounts compromised !

Two more Comodo registration authority accounts compromised ! Certification company's humiliation drags on as hacker scalps two more Comodo registration authority accounts The Iranian hacker that managed to trick Comodo into issuing nine fraudulent certificates appears to have compromised two mor...

Mozilla NSS - NULL Character CA SSL Certificate Validation Security Bypass

source: https://www.securityfocus.com/bid/35888/info Mozilla Network Security Services NSS is prone to a security-bypass vulnerability because it fails to properly validate the domain name in a signed CA certificate, allowing attackers to substitute malicious SSL certificates for trusted ones. Th...

Firefox SSL Server Spoofing Vulnerability (Windows)

The host is installed with Mozilla Firefox browser and is prone to SSL server spoofing vulnerability. OpenVAS Vulnerability Test $Id: gbfirefoxsslspoofvulnwin.nasl 6530 2017-07-05 06:23:50Z cfischer $ Firefox SSL Server Spoofing Vulnerability Windows Authors: Nikita MR Copyright: Copyright c 2009...