442 matches found
CVE-2016-3043: Exposure of Sensitive Information to an Unauthorized Actor
IBM Security Access Manager for Web could allow a remote attacker to obtain sensitive information, caused by the failure to properly enable HTTP Strict Transport Security. An attacker could exploit this vulnerability to obtain sensitive information using man in the middle techniques...
CVE-2016-8966: Exposure of Sensitive Information to an Unauthorized Actor
IBM BigFix Inventory v9 could allow a remote attacker to obtain sensitive information, caused by the failure to properly enable HTTP Strict Transport Security. An attacker could exploit this vulnerability to obtain sensitive information using man in the middle techniques...
CVE-2016-5966: Exposure of Sensitive Information to an Unauthorized Actor
IBM Security Privileged Identity Manager Virtual Appliance could allow a remote attacker to obtain sensitive information, caused by the failure to properly enable HTTP Strict Transport Security. An attacker could exploit this vulnerability to obtain sensitive information using man in the middle...
http-hsts-verify NSE Script
Verify that HTTP Strict Transport Security is enabled. HTTP Strict-Transport-Security HSTS RFC 6797 forces a web browser to communicate with a web server over HTTPS. This script examines HTTP Response Headers to determine whether HSTS is configured. References:...
Multiple IBM Security Access Manager Product Information Disclosure Vulnerabilities
IBM Security Access Manager ISAM and others are products of IBM Corporation in the U.S. ISAM is a security access manager; IBM Security Access Manager for Web is a solution that provides mobile access security through a modular software package. An information disclosure vulnerability exists in a...
HP System Management Homepage < 7.6 Multiple Vulnerabilities (HPSBMU03653) (httpoxy)
According to its banner, the version of HP System Management Homepage SMH hosted on the remote web server is prior to 7.6. It is, therefore, affected by the following vulnerabilities : - A heap buffer overflow condition exists in OpenSSL in the EVPEncodeUpdate function within file...
The vulnerability of Google Chrome’s browser allows a hacker to determine which website was visited using an HSTS connection.
The vulnerability of the CSPSource::schemeMatches function WebKit/Source/core/frame/csp/CSPSource.cpp in the CSP component of the Blink browser Google Chrome is related to errors in applying security policies designed for http and ws protocols to secure https and wss protocols. Exploiting this...
SSL/TLS: HTTP Strict Transport Security (HSTS) Detection
Checks if the remote web server has HTTP Strict Transport Security HSTS enabled. SPDX-FileCopyrightText: 2016 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
SSL/TLS: `preload` Missing in HSTS Header
The remote web server is missing the SPDX-FileCopyrightText: 2016 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription scriptoid"1.3.6.1.4.1.25623.1.0.105878";...
SSL/TLS: HTTP Strict Transport Security (HSTS) Missing
The remote web server is not enforcing HTTP Strict Transport Security HSTS. SPDX-FileCopyrightText: 2016 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
SSL/TLS: `includeSubDomains` Missing in HSTS Header
The remote web server is missing the SPDX-FileCopyrightText: 2016 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription scriptoid"1.3.6.1.4.1.25623.1.0.105877";...
Google Adds New Layer of Security to Domain: Adds HSTS
Google is adding HTTP Strict Transport Security or HSTS to the Google.com domain, an extra layer of protection that prevents visitors from using a less secure HTTP connection. By using HSTS, visitors following HTTP links to Google.com will be automatically redirected to the more secure HTTPS...
Here's How Websites Are Tracking You Online
Webmasters can track all your activities on the Internet – even if you have already cleared your browsing history and deleted all saved cookies. A researcher demonstrated two unpatched flaws that can be exploited to track Millions of Internet users, allowing malicious website owners: 1. List...
CVE-2015-5505
CVE-2015-5505 relates to Drupal’s contributed HTTP Strict Transport Security (HSTS) module. The module versions 6.x-1.x prior to 6.x-1.1 and 7.x-1.x prior to 7.x-1.2 do not correctly implement the include_subdomains directive, causing the HSTS policy not to be applied to subdomains. This is descr...
APPLE-SA-2015-08-13-1 Safari 8.0.8, Safari 7.1.8, and Safari 6.2.8
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 APPLE-SA-2015-08-13-1 Safari 8.0.8, Safari 7.1.8, and Safari 6.2.8 Safari 8.0.8, Safari 7.1.8, and Safari 6.2.8 is now available and addresses the following: Safari Application Available for: OS X Mountain Lion v10.8.5, OS X Mavericks v10.9.5, and O...
HTTP Strict Transport Security - Moderately Critical - Logical Error - SA-CONTRIB-2015-118
The contributed HSTS module makes it easy for site administrators to implement HTTP Strict Transport Security HSTS by setting the Strict-Transport-Security header on each page generated by Drupal. HSTS module provides a configuration UI for the HSTS "include subdomains" directive, which indicates...
Microsoft Brings HSTS to Windows 7 and 8.1
In the midst of a relatively light Patch Tuesday, Microsoft yesterday introduced an extra measure of security for users running Internet Explorer 11 on Windows 7 and Windows 8.1 machines: HSTS. Short for HTTP Strict Transport Security, HSTS is a browser header that forces any sessions sent over...
Debian DSA-3238-1 : chromium-browser - security update
Several vulnerabilities were discovered in the chromium web browser. - CVE-2015-1235 A Same Origin Policy bypass issue was discovered in the HTML parser. - CVE-2015-1236 Amitay Dobo discovered a Same Origin Policy bypass in the Web Audio API. - CVE-2015-1237 Khalil Zhani discovered a use-after-fr...
[SECURITY] [DSA 3238-1] chromium-browser security update
------------------------------------------------------------------------- Debian Security Advisory DSA-3238-1 [email protected] http://www.debian.org/security/ Michael Gilbert April 26, 2015 http://www.debian.org/security/faq -...
