CVE-2015-3754

The private-browsing implementation in WebKit in Apple Safari before 6.2.8, 7.x before 7.1.8, and 8.x before 8.0.8 does not prevent caching of HTTP authentication credentials, which makes it easier for remote attackers to track users via a crafted web site...

CVE-2015-3754

The private-browsing implementation in WebKit in Apple Safari before 6.2.8, 7.x before 7.1.8, and 8.x before 8.0.8 does not prevent caching of HTTP authentication credentials, which makes it easier for remote attackers to track users via a crafted web site...

CVE-2015-3754

The private-browsing implementation in WebKit in Apple Safari before 6.2.8, 7.x before 7.1.8, and 8.x before 8.0.8 does not prevent caching of HTTP authentication credentials, which makes it easier for remote attackers to track users via a crafted web site...

PT-2015-1944

Name of the Vulnerable Software and Affected Versions Apple Safari versions prior to 6.2.8 Apple Safari versions 7.x prior to 7.1.8 Apple Safari versions 8.x prior to 8.0.8 Description The issue is related to the private-browsing implementation in WebKit, which does not prevent caching of HTTP...

CVE-2015-3675

The default configuration of the Apache HTTP Server on Apple OS X before 10.10.4 does not enable the modhfsapple module, which allows remote attackers to bypass HTTP authentication via a crafted URL...

Default configuration

The default configuration of the Apache HTTP Server on Apple OS X before 10.10.4 does not enable the modhfsapple module, which allows remote attackers to bypass HTTP authentication via a crafted URL...

CVE-2015-3675

The default configuration of the Apache HTTP Server on Apple OS X before 10.10.4 does not enable the modhfsapple module, which allows remote attackers to bypass HTTP authentication via a crafted URL...

CVE-2015-3675

The default configuration of the Apache HTTP Server on Apple OS X before 10.10.4 does not enable the modhfsapple module, which allows remote attackers to bypass HTTP authentication via a crafted URL...

PT-2015-6273

Name of the Vulnerable Software and Affected Versions Apache HTTP Server on Apple OS X versions prior to 10.10.4 Description The issue concerns the default configuration of the Apache HTTP Server on Apple OS X, where the mod hfs apple module is not enabled. This allows remote attackers to bypass...

CVE-2015-3675: Improper Access Control

The default configuration of the Apache HTTP Server on Apple OS X before 10.10.4 does not enable the modhfsapple module, which allows remote attackers to bypass HTTP authentication via a crafted URL...

CVE-2015-3200

modauth in lighttpd before 1.4.36 allows remote attackers to inject arbitrary log entries via a basic HTTP authentication string without a colon character, as demonstrated by a string containing a NULL and new line character...

CVE-2015-3200

modauth in lighttpd before 1.4.36 allows remote attackers to inject arbitrary log entries via a basic HTTP authentication string without a colon character, as demonstrated by a string containing a NULL and new line character...

CVE-2015-3200

modauth in lighttpd before 1.4.36 allows remote attackers to inject arbitrary log entries via a basic HTTP authentication string without a colon character, as demonstrated by a string containing a NULL and new line character...

CVE-2015-3200

The CVE-2015-3200 entry concerns lighttpd mod_auth prior to 1.4.36. A remote attacker can inject log entries via a basic-auth string without a colon, demonstrated using a NULL/newline in the string. Impact is log injection; some references note potential information exposure. Remediation exists: ...

CVE-2015-3200

modauth in lighttpd before 1.4.36 allows remote attackers to inject arbitrary log entries via a basic HTTP authentication string without a colon character, as demonstrated by a string containing a NULL and new line character...

lighttpd -- Log injection vulnerability in mod_auth

MITRE reports: modauth in lighttpd before 1.4.36 allows remote attackers to inject arbitrary log entries via a basic HTTP authentication string without a colon character, as demonstrated by a string containing a NULL and new line character...

PT-2015-6091

Name of the Vulnerable Software and Affected Versions lighttpd versions prior to 1.4.36 Description The issue allows remote attackers to inject arbitrary log entries via a basic HTTP authentication string without a colon character. This can be achieved by using a string containing a NULL and new...

Unspecified Vulnerability in Websense TRITON AP-WEB

Websense TRITON is the Unified Content Architecture for data security. Websense TRITON AP-WEB HTTP authentication unspecified security vulnerability allows attackers to submit a special request to enumerate windows domain users...

CVE-2015-2762

Websense TRITON AP-WEB before 8.0.0 allows remote attackers to enumerate Windows domain user accounts via vectors related to HTTP authentication...

CVE-2015-2762

Websense TRITON AP-WEB (before 8.0.0) is affected. The vulnerability allows remote attackers to enumerate Windows domain user accounts via HTTP authentication-related vectors. Root cause is exposure in the AP-WEB authentication flow prior to version 8.0.0. Impact includes potential information di...