CVE-2020-8987

Avast AntiTrack before 1.5.1.172 and AVG Antitrack before 2.0.0.178 proxies traffic to HTTPS sites but does not validate certificates, and thus a man-in-the-middle can host a malicious website using a self-signed certificate. No special action necessary by the victim using AntiTrack with "Allow...

CVE-2020-8987

The CVE-2020-8987 issue affects Avast AntiTrack (before 1.5.1.172) and AVG Antitrack (before 2.0.0.178). The root problem is that these products proxy HTTPS traffic but do not validate certificates, allowing a man-in-the-middle to host a malicious site using a self-signed certificate. This risk i...

openSUSE Security Update : ovmf (openSUSE-2020-314)

This update for ovmf fixes the following issues : Security issues fixed : - CVE-2019-14563: Fixed a memory corruption caused by insufficient numeric truncation bsc1163959. - CVE-2019-14553: Fixed the TLS certification verification in HTTPS-over-IPv6 boot sequences bsc1153072. - CVE-2019-14559:...

openSUSE: Security Advisory for ovmf (openSUSE-SU-2020:0314-1)

The remote host is missing an update for the Copyright C 2020 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

OPENSUSE-SU-2020:0314-1 Security update for ovmf

This update for ovmf fixes the following issues: Security issues fixed: - CVE-2019-14563: Fixed a memory corruption caused by insufficient numeric truncation bsc1163959. - CVE-2019-14553: Fixed the TLS certification verification in HTTPS-over-IPv6 boot sequences bsc1153072. - CVE-2019-14559: Fixe...

Security update for ovmf (moderate)

openSUSE Security Update: Security update for ovmf Announcement ID: openSUSE-SU-2020:0314-1 Rating: moderate References: 1153072 1163927 1163959 1163969 Cross-References: CVE-2019-14553 CVE-2019-14559 CVE-2019-14563 CVE-2019-14575 Affected Products: openSUSE Leap 15.1 An update that fixes four...

trailer-journal.com Cross Site Scripting vulnerability

Open Bug Bounty ID: OBB-1112683 Security Researcher g0bl1nsec Helped patch 3768 vulnerabilities Received 4 Coordinated Disclosure badges Received 3 recommendations , a holder of 4 badges for responsible and coordinated disclosure, found a security vulnerability affecting trailer-journal.com websi...

Identifying Let’s Encrypt Revoked Certificates

Let's Encrypt is a free, automated, open certificate authority CA run for the public's benefit as a service from the Internet Security Research Group ISRG. It provides free digital certificates to enable HTTPS SSL/TLS for websites via user-friendly means. Earlier this week, Let's Encrypt announce...

SUSE SLES15 Security Update : ovmf (SUSE-SU-2020:0568-1)

This update for ovmf fixes the following issues : Security issues fixed : CVE-2019-14563: Fixed a memory corruption caused by insufficient numeric truncation bsc1163959. CVE-2019-14553: Fixed the TLS certification verification in HTTPS-over-IPv6 boot sequences bsc1153072. CVE-2019-14559: Fixed a...

Node.js: Node.js: TLS session reuse can lead to hostname verification bypass

The Node.js TLS library supports client side reuse of TLS sessions when multiple connections to the same server are opened. Code that wants to use this feature can listen for the 'session' event https://nodejs.org/api/tls.htmltlseventsession on a tls.TLSSocket to get notified of newly created TLS...

catalogo.marr.it Cross Site Scripting vulnerability

Open Bug Bounty ID: OBB-1109690 Security Researcher AmineChabik Helped patch 64 vulnerabilities Received 2 Coordinated Disclosure badges Received 1 recommendations , a holder of 2 badges for responsible and coordinated disclosure, found a security vulnerability affecting catalogo.marr.it website...

SUSE-SU-2020:0568-1 Security update for ovmf

This update for ovmf fixes the following issues: Security issues fixed: - CVE-2019-14563: Fixed a memory corruption caused by insufficient numeric truncation bsc1163959. - CVE-2019-14553: Fixed the TLS certification verification in HTTPS-over-IPv6 boot sequences bsc1153072. - CVE-2019-14559: Fixe...

Security Bulletin: Cacheable HTTPS Responses have been identified on multiple Tivoli Netcool/OMNIbus WebGUI admin pages (CVE-2020-4197)

Summary Fix is available for vulnerability Cacheable HTTPS Responses in Tivoli Netcool/OMNIbus WebGUI admin pages CVE-2020-4197. Vulnerability Details CVEID: CVE-2020-4197 DESCRIPTION: IBM Tivoli Netcool/OMNIbusGUI allows web pages to be stored locally which can be read by another user on the...

Man-in-the-Middle (MitM)

ratis is vulnerable to man-in-the-middle MitM. The vulnerability exists as it does not use https when resolving dependencies from the maven repositories...

Let's Encrypt Issued A Billion Free SSL Certificates in the Last 4 Years

Let's Encrypt, a free, automated, and open certificate signing authority CA from the nonprofit Internet Security Research Group ISRG, has said it's issued a billion certificates since its launch in 2015. The CA issued its first certificate in September 2015, before eventually reaching 100 million...

Let's Encrypt Issued A Billion Free SSL Certificates in the Last 4 Years

Let's Encrypt, a free, automated, and open certificate signing authority CA from the nonprofit Internet Security Research Group ISRG, has said it's issued a billion certificates since its launch in 2015. The CA issued its first certificate in September 2015, before eventually reaching 100 million...

bloody.com Cross Site Scripting vulnerability

Security Researcher raviakp1004 Helped patch 511 vulnerabilities Received 4 Coordinated Disclosure badges Received 4 recommendations , a holder of 4 badges for responsible and coordinated disclosure, found a security vulnerability affecting bloody.com website and its users. Following coordinated...

Product release: Virtuozzo Infrastructure Platform 3.5 Update 1 (3.5.1-43)

This update provides a new feature as well as fixes and improvements. Vulnerability id: VSTOR-30003 Unable to release node from cluster: 'Unable to send message to any node in ABGW cluster'. Vulnerability id: VSTOR-30135 No read/write data on dashboards if multipath is configured. Vulnerability i...

[SECURITY] Fedora 30 Update: caddy-1.0.3-2.fc30

Caddy is the web server with automatic HTTPS. This package was built with the following plugins: http.geoip http.realip tls.dns.azure tls.dns.cloudflare tls.dns.digitalocean tls.dns.googlecloud tls.dns.powerdns tls.dns.rackspace tls.dns.route53...

Firefox enables DNS-over-HTTPS by default (with Cloudflare) for all U.S. users

If you use the Firefox web browser, here's an important update that you need to be aware of. Starting today, Mozilla is activating the DNS-over-HTTPS security feature by default for all Firefox users in the U.S. by automatically changing their DNS server configuration in the settings. That means,...