14 matches found
sniffly
Sniffly2 Sniffly2는 HTTP Strict Transport Security 헤더와 Performance Timing API를 악용하여 Chromium 기반 브라우저에서 사용자의 방문 기록을 스니핑하는 Sniffly의 변형입니다. 데모 HTTPS Everywhere가 비활성화된 상태에서 Chrome/Chromium/Brave 등으로 http://diracdeltas.github.io/sniffly를 방문하세요. 주의사항: 모바일 또는 Firefox에서는 작동하지 않음 혼합 콘텐츠 차단으로 인해 HTTPS에서는 작동...
EUVD-2022-50473
Malicious code in bioql PyPI...
CVE-2023-23127
In Connectwise Control 22.8.10013.8329, the login page does not implement HSTS headers therefore not enforcing HTTPS. NOTE: the vendor's position is that, by design, this is controlled by a configuration option in which a customer can choose to use HTTP rather than HTTPS during troubleshooting...
Medium: qt5-qtbase
Issue Overview: QT-based clients may mismatch HSTS headers Strict-Transport-Security, which would prevent the client from switching to a secure HTTPS connection as requested by a server. CVE-2023-32762 Affected Packages: qt5-qtbase Note: This advisory is applicable to Amazon Linux 2 AL2 Core...
CVE-2022-47714
Last Yard 22.09.8-1 does not enforce HSTS headers...
CVE-2022-47714
Last Yard 22.09.8-1 does not enforce HSTS headers...
CVE-2023-23127: Missing Encryption of Sensitive Data
In Connectwise Control 22.8.10013.8329, the login page does not implement HSTS headers therefore not enforcing HTTPS. NOTE: the vendor's position is that, by design, this is controlled by a configuration option in which a customer can choose to use HTTP rather than HTTPS during troubleshooting...
CVE-2022-47714
Last Yard 22.09.8-1 does not enforce HSTS headers...
CVE-2023-23127
In Connectwise Control 22.8.10013.8329, the login page does not implement HSTS headers therefore not enforcing HTTPS. NOTE: the vendor's position is that, by design, this is controlled by a configuration option in which a customer can choose to use HTTP rather than HTTPS during troubleshooting...
CVE-2023-23127
In Connectwise Control 22.8.10013.8329, the login page does not implement HSTS headers therefore not enforcing HTTPS. NOTE: the vendor's position is that, by design, this is controlled by a configuration option in which a customer can choose to use HTTP rather than HTTPS during troubleshooting...
CVE-2022-47714
Last Yard 22.09.8-1 does not enforce HSTS headers...
Uber: duplicate hsts headers lead to firefox ignoring hsts on business.uber.com
It was possible for an attacker to temporarily downgrade a chosen victim from a secure HTTPS connection to HTTP in Firefox. The impact of this issue was low due to the very small window that it provided to actually take advantage of the downgrade, and the fact that it required getting a user to...
Debian DSA-2246-1 : mahara - several vulnerabilities
Several vulnerabilities were discovered in Mahara, an electronic portfolio, weblog, and resume builder. The Common Vulnerabilities and Exposures project identifies the following problems : - CVE-2011-1402 It was discovered that previous versions of Mahara did not check user credentials before...