EUVD-2015-5460

Malware in sbrugna...

Design/Logic Flaw

The HTTP Strict Transport Security HSTS module 6.x-1.x before 6.x-1.1 and 7.x-1.x before 7.x-1.2 for Drupal does not properly implement the "include subdomains" directive, which causes the HSTS policy to not be applied to subdomains and allows man-in-the-middle attackers to have unspecified impac...

PT-2015-6957

Name of the Vulnerable Software and Affected Versions Drupal HSTS module versions 6.x-1.x before 6.x-1.1 Drupal HSTS module versions 7.x-1.x before 7.x-1.2 Description The issue is related to the improper implementation of the "include subdomains" directive in the HTTP Strict Transport Security...

CVE-2015-5505: Undefined Security Weakness

The HTTP Strict Transport Security HSTS module 6.x-1.x before 6.x-1.1 and 7.x-1.x before 7.x-1.2 for Drupal does not properly implement the "include subdomains" directive, which causes the HSTS policy to not be applied to subdomains and allows man-in-the-middle attackers to have unspecified impac...

HTTP Strict Transport Security - Moderately Critical - Logical Error - SA-CONTRIB-2015-118

The contributed HSTS module makes it easy for site administrators to implement HTTP Strict Transport Security HSTS by setting the Strict-Transport-Security header on each page generated by Drupal. HSTS module provides a configuration UI for the HSTS "include subdomains" directive, which indicates...