7979 matches found
Espionage - A Network Packet And Traffic Interceptor For Linux. Spoof ARP & Wiretap A Network
Espionage is a network packet sniffer that intercepts large amounts of data being passed through an interface. The tool allows users to to run normal and verbose traffic analysis that shows a live feed of traffic, revealing packet direction, protocols, flags, etc. Espionage can also spoof ARP so,...
Fedora: Security Advisory for curl (FEDORA-2020-6af1dd2936)
The remote host is missing an update for the Copyright C 2020 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...
USN-4402-1: curl vulnerabilities
Marek Szlagor, Gregory Jefferis and Jeroen Ooms discovered that curl incorrectly handled certain credentials. An attacker could possibly use this issue to expose sensitive information. This issue only affected Ubuntu 19.10 and Ubuntu 20.04 LTS. CVE-2020-8169 It was discovered that curl incorrectl...
CVE-2020-12053
In Unisys Stealth 3.4.x, 4.x and 5.x before 5.0.026, if certificate-based authorization is used without HTTPS, an endpoint could be authorized without a private key...
Authorization
In Unisys Stealth 3.4.x, 4.x and 5.x before 5.0.026, if certificate-based authorization is used without HTTPS, an endpoint could be authorized without a private key...
CVE-2020-12053
In Unisys Stealth 3.4.x, 4.x and 5.x before 5.0.026, if certificate-based authorization is used without HTTPS, an endpoint could be authorized without a private key...
CVE-2020-12053
In Unisys Stealth, versions 3.4.x, 4.x and 5.x prior to 5.0.026 expose a vulnerability where certificate-based authorization can occur without HTTPS, potentially allowing an endpoint to be authorized without proving a private key. The issue is documented in CVE-2020-12053 with a context that the ...
httpd: mod_http2: possible crash on late upgrade
A vulnerability was found in Apache HTTP Server 2.4.34 to 2.4.38. When HTTP/2 was enabled for a http: host or H2Upgrade was enabled for h2 on a https: host, an Upgrade request from http/1.1 to http/2 that was not the first request on a connection could lead to a misconfiguration and crash. Server...
CVE-2020-11767
Istio through 1.5.1 and Envoy through 1.14.1 have a data-leak issue. If there is a TCP connection negotiated with SNI over HTTPS to .example.com, a request for a domain concurrently configured explicitly e.g., abc.example.com is sent to the servers listening behind .example.com. The outcome shoul...
Huawei EulerOS: Security Advisory for python-requests (EulerOS-SA-2020-1633)
The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2020 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
filmlondon.org.uk Cross Site Scripting vulnerability OBB-1194083
Following coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has:       a. verified the vulnerability and confirmed its existence;       b. notified the website operator about its existence...
CVE-2020-3929
GeoVision Door Access Control device family employs shared cryptographic private keys for SSH and HTTPS. Attackers may conduct MITM attack with the derived keys and plaintext recover of encrypted messages...
CVE-2020-3929
CVE-2020-3929 affects GeoVision Door Access Control device families that use shared cryptographic private keys for SSH and HTTPS. The underlying issue enables attackers to perform MITM attacks with derived keys and recover plaintext from encrypted messages. NVD notes medium base scores (CVSSv2 4....
Updated coturn packages fix security vulnerability
Updated the coturn package in order to fix some security vulnerabilities: httpserver.c: An exploitable heap overflow vulnerability exists in the way CoTURN 4.5.1.1 web server parses POST requests. A specially crafted HTTP POST request can lead to information leaks and other misbehavior. An attack...
BabyShark - Basic C2 Server
This is a basic C2 generic server written in Python and Flask. This code has based ideia to GTRS, which uses Google Translator as a proxy for sending commands to the infected host. The BabyShark project aims to centralize reverse connections with agents, creating a way to centralize several types...
CVE-2020-8172
A TLS Hostname verification bypass vulnerability exists in NodeJS. This flaw allows an attacker to bypass TLS Hostname verification when a TLS client reuses HTTPS sessions...
The vulnerability of the JSE component in Oracle Java SE and Oracle Java SE Embedded software platforms allows a hacker to trigger a service failure.
The vulnerability of the JSE component in Oracle Java SE and Oracle Java SE Embedded software platforms is related to insufficient validation of input data. Exploiting this vulnerability can allow an attacker to cause service failures using the HTTPS protocol...
undertow: possible Denial Of Service (DOS) in Undertow HTTP server listening on HTTPS
A vulnerability was found in the Undertow HTTP server listening on HTTPS. An attacker can target the HTTPS port to carry out a Denial Of Service DOS to make the service unavailable on SSL...
Information Disclosure
com.liferay.login.web is vulnerable to information disclosure. The attack exists because Sign In widget leaks user's email address and/or password allowing a malicious user to intercept the sensitive information if HTTPS is not in place...
Man-in-the-Middle (MitM)
com.liferay.map.openstreetmap is vulnerable to man-in-the-middle attacks. The bundle loads the npm package leaflet using HTTP instead of HTTPS. This allows an attacker to perform a man-in-the-middle attack to modify the package contents...