python-requests: Redirect from HTTPS to HTTP does not remove Authorization header

A credentials-exposure flaw was found in python-requests, where if a request with authentication is redirected 302 from an HTTPS endpoint to an HTTP endpoint on the same host, the Authorization header is not stripped and the credentials can be read in plain text. A man-in-the-middle attacker coul...

python-requests: Redirect from HTTPS to HTTP does not remove Authorization header

A credentials-exposure flaw was found in python-requests, where if a request with authentication is redirected 302 from an HTTPS endpoint to an HTTP endpoint on the same host, the Authorization header is not stripped and the credentials can be read in plain text. A man-in-the-middle attacker coul...

CVE-2020-1631

A vulnerability in the HTTP/HTTPS service used by J-Web, Web Authentication, Dynamic-VPN DVPN, Firewall Authentication Pass-Through with Web-Redirect, and Zero Touch Provisioning ZTP allows an unauthenticated attacker to perform local file inclusion LFI or path traversal. Using this vulnerability...

Design/Logic Flaw

In versions prior to 3.3.0, the NGINX Controller Agent installer script 'install.sh' uses HTTP instead of HTTPS to check and install packages...

CVE-2020-5867

The CVE-2020-5867 issue affects the NGINX Controller Agent installer script (install.sh) used by the NGINX Controller. In versions prior to 3.3.0, it uses HTTP instead of HTTPS to check and install packages, creating a MITM risk where malicious packages could be forged and installed on affected N...

CVE-2020-11685

In JetBrains GoLand before 2019.3.2, the plugin repository was accessed via HTTP instead of HTTPS...

Design/Logic Flaw

In JetBrains GoLand before 2019.3.2, the plugin repository was accessed via HTTP instead of HTTPS...

CVE-2020-11685

CVE-2020-11685 affects JetBrains GoLand prior to 2019.3.2, where the plugin repository was accessed via HTTP instead of HTTPS. Root cause: HTTP access allowed potential eavesdropping/credential exposure to the plugin channel. Impact stated: confidentiality could be affected. Remediation: JetBrain...

ambiendo.de Cross Site Scripting vulnerability

Open Bug Bounty ID: OBB-1148788 Security Researcher error404 Helped patch 532 vulnerabilities Received 8 Coordinated Disclosure badges Received 20 recommendations , a holder of 8 badges for responsible and coordinated disclosure, found a security vulnerability affecting ambiendo.de website and it...

OpenJDK: Re-use of single TLS session for new connections (JSSE, 8234408)

Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE component: JSSE. Supported versions that are affected are Java SE: 7u251, 8u241, 11.0.6 and 14; Java SE Embedded: 8u241. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTPS to...

OpenJDK: Incomplete enforcement of algorithm restrictions for TLS (JSSE, 8232424)

Vulnerability in the Java SE product of Oracle Java SE component: JSSE. Supported versions that are affected are Java SE: 11.0.6 and 14. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTPS to compromise Java SE. Successful attacks of this vulnerability...

bling.com.br Cross Site Scripting vulnerability

Open Bug Bounty ID: OBB-1148328 Security Researcher raviakp1004 Helped patch 652 vulnerabilities Received 4 Coordinated Disclosure badges Received 5 recommendations , a holder of 4 badges for responsible and coordinated disclosure, found a security vulnerability affecting bling.com.br website and...

OpenJDK: Re-use of single TLS session for new connections (JSSE, 8234408)

Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE component: JSSE. Supported versions that are affected are Java SE: 7u251, 8u241, 11.0.6 and 14; Java SE Embedded: 8u241. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTPS to...

bapen.org.uk Cross Site Scripting vulnerability

Open Bug Bounty ID: OBB-1148229 Security Researcher g0bl1nsec Helped patch 3768 vulnerabilities Received 4 Coordinated Disclosure badges Received 3 recommendations , a holder of 4 badges for responsible and coordinated disclosure, found a security vulnerability affecting bapen.org.uk website and...

Oracle MySQL Server 5.7 <= 5.7.28 Security Update (cpuapr2020) - Windows

Oracle MySQL Server is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2020 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:oracle:mysql"; if...

calculator.net Cross Site Scripting vulnerability

Open Bug Bounty ID: OBB-1147155 Security Researcher MrRain1996 Helped patch 1003 vulnerabilities Received 5 Coordinated Disclosure badges Received 9 recommendations , a holder of 5 badges for responsible and coordinated disclosure, found a security vulnerability affecting calculator.net website a...

profile.usatoday.com Cross Site Scripting vulnerability

Open Bug Bounty ID: OBB-1146706 Security Researcher Rbcafe Helped patch 258 vulnerabilities Received 3 Coordinated Disclosure badges Received 7 recommendations , a holder of 3 badges for responsible and coordinated disclosure, found a security vulnerability affecting profile.usatoday.com website...

toptbdev.net Open Redirect vulnerability

Open Bug Bounty ID: OBB-1146530 Security Researcher myNickName Helped patch 200 vulnerabilities Received 2 Coordinated Disclosure badges , a holder of 2 badges for responsible and coordinated disclosure, found a security vulnerability affecting toptbdev.net website and its users. Following...

m.onenewspage.co.uk Open Redirect vulnerability

Open Bug Bounty ID: OBB-1145816 Security Researcher myNickName Helped patch 200 vulnerabilities Received 2 Coordinated Disclosure badges , a holder of 2 badges for responsible and coordinated disclosure, found a security vulnerability affecting m.onenewspage.co.uk website and its users. Following...

magicode.me Open Redirect vulnerability

Open Bug Bounty ID: OBB-1145640 Security Researcher myNickName Helped patch 200 vulnerabilities Received 2 Coordinated Disclosure badges , a holder of 2 badges for responsible and coordinated disclosure, found a security vulnerability affecting magicode.me website and its users. Following...