72 matches found
Macro browser breaks https secure connection
h3. Issue Summary Macro browser loads http insecure resources including a data:image/png and a testing mocking resource http://example.com/bla-bla-bla h3. Environment Optional - If Applicable h3. Steps to Reproduce Create a page Open macro browser h3. Expected Results Connection remains secure h3...
CVE-2018-12403
If a site is loaded over a HTTPS connection but loads a favicon resource over HTTP, the mixed content warning is not displayed to users. This vulnerability affects Firefox 63...
Unable to Launch Applications or Desktops Using HTTPS URL via Workspace App for HTML5
When using StoreFront or Cloud Workspace with Workspace App for HTML5 through an HTTPS URL, applications and desktops cannot be started. One of the following error messages is displayed: “Cannot create a secure connection in this browser. Refer to the Citrix Knowledge Center article CTX134123.”...
CVE-2018-2460
SAP Business One Android application, version 1.2, does not verify the certificate properly for HTTPS connection. This allows attacker to do MITM attack...
Unitrends UEB 9.1 Authentication Bypass / Remote Command Execution
Exploit Title: Unauthenticated root RCE for Unitrends UEB 9.1 Date: 08/08/2017 Exploit Authors: Cale Smith, Benny Husted, Jared Arave Contact: https://twitter.com/iotennui || https://twitter.com/BennyHusted || https://twitter.com/0xC413 Vendor Homepage: https://www.unitrends.com/ Software Link:...
GSA Bounty: federalist.18f.gov vulnerable to Sweet32 attack
The researcher noted that federalist.18f.gov allows use of the TLSRSAWITH3DESEDECBCSHA cipher, which is now marked as "weak" in SSL labs because of risks of MitM attacks given this vulnerability: https://sweet32.info/, which requires monitoring of a long lived HTTPS connection. We inherit this...
Unitrends UEB 9.1 - Authentication Bypass / Remote Command Execution
Exploit Title: Unauthenticated root RCE for Unitrends UEB 9.1 Date: 08/08/2017 Exploit Authors: Cale Smith, Benny Husted, Jared Arave Contact: https://twitter.com/iotennui || https://twitter.com/BennyHusted || https://twitter.com/0xC413 Vendor Homepage: https://www.unitrends.com/ Software Link:...
UCL Ransomware Linked to AdGholas Malvertising Group
A ransomware attack that closed off access to personal and shared drives at University College London last week has been linked to a malvertising campaign spreading Mole, a variant of CryptoMix ransomware. Kafeine, a white-hat who works for Proofpoint and is known for his research into exploit...
Amazon Linux AMI : java-1.6.0-openjdk (ALAS-2017-795)
It was discovered that the Hotspot component of OpenJDK did not properly check arguments of the System.arraycopy function in certain cases. An untrusted Java application or applet could use this flaw to corrupt virtual machine's memory and completely bypass Java sandbox restrictions. CVE-2016-558...
Cisco Content Security Management Appliance AsyncOS Software Update Server Certificate Validation Vulnerability (cisco-sa-20161207-asyncos)
A vulnerability in the update functionality of Cisco AsyncOS Software for Cisco Content Security Management Appliance SMA could allow an unauthenticated, remote attacker to impersonate the update server. SPDX-FileCopyrightText: 2016 Greenbone AG Some text descriptions might be excerpted from a...
Cisco Web Security Appliance AsyncOS Software Update Server Certificate Validation Vulnerability
A vulnerability in the update functionality of Cisco AsyncOS Software for Cisco Web Security Appliance WSA could allow an unauthenticated, remote attacker to impersonate the update server. SPDX-FileCopyrightText: 2016 Greenbone AG Some text descriptions might be excerpted from a referenced source...
MileSight camera default private key certificate vulnerability
MileSight camera is a network camera produced by Xiamen PulseVision Digital Technology Co. MileSight camera suffers from a default private key certificate vulnerability. Since all cameras share the same secret key, an attacker can exploit the vulnerability to launch a man-in-the-middle attack whe...
Design/Logic Flaw
Remote Artifact Loader RAL in IBM WebSphere Process Server 7 and Business Process Manager Advanced 7.5 through 7.5.1.2, 8.0 through 8.0.1.3, 8.5.0 through 8.5.0.2, 8.5.5 through 8.5.5.0, and 8.5.6 through 8.5.6.2 does not properly use SSL for its HTTPS connection, which allows remote authenticate...
CVE-2015-7441
Remote Artifact Loader RAL in IBM WebSphere Process Server 7 and Business Process Manager Advanced 7.5 through 7.5.1.2, 8.0 through 8.0.1.3, 8.5.0 through 8.5.0.2, 8.5.5 through 8.5.5.0, and 8.5.6 through 8.5.6.2 does not properly use SSL for its HTTPS connection, which allows remote authenticate...
connect.bloomberg.com XSS vulnerability
Vulnerable URL: http://connect.bloomberg.com/Aprimo/etrack.aspx?DSN=a5487ab3b15de173=9a26cff48c8aac63=e8d7842613e1c04a1fbbb788ac89bba6=9a26cff48c8aac63=1=9a26cff48c8aac63=https://www.xssposed.org/ Details: Description| Value ---|--- Patched:| Yes, at 24.05.2016 Latest check for patch:| 24.05.2016...
Cisco FireSIGHT Management Center Certificate Validation Vulnerability
A vulnerability in the rule update functionality of Cisco FireSIGHT Management Center MC could allow an unauthenticated, remote attacker to manipulate the content of the rule update packages and execute arbitrary code on the system. The vulnerability is due to lack of certificate validation durin...
mitmproxy kit using the Raiders and customization-bug warning-the black bar safety net
mitmproxy is a support for HTTPSMiTM proxy tool. Different from Fiddler2, and burpsuite, etc. similar function tools, mitmproxy can be in the terminal under the run. mitmproxy in Python development, is to assist the web development&testing, debugging, penetration testing tool. The working princip...
NAI Net Tools PKI Server 1.0 strong.exe Buffer Overflow Vulnerability
No description provided by source. source: http://www.securityfocus.com/bid/1536/info Certain versions of Network Associates Inc.'s Net Tools PKI Public Key Infrastructure server ship with a buffer overflow vulnerability which could lead to a remote compromise of the system running the PKI server...
New Banking Malware with Network Sniffer Spreading Rapidly Worldwide
The hike in the banking malware this year is no doubt almost double compared to the previous one, and so in the techniques of malware authors. Until now, we have seen banking Trojans affecting devices and steal users’ financial credentials in order to run them out of their money. But nowadays,...
Design/Logic Flaw
Android OS before 2.2 does not display the correct SSL certificate in certain cases, which might allow remote attackers to spoof trusted web sites via a web page containing references to external sources in which 1 the certificate of the last loaded resource is checked, instead of for the main...