7985 matches found
ruinedcast.com Cross Site Scripting vulnerability
Security Researcher g0bl1nsec Helped patch 3608 vulnerabilities Received 4 Coordinated Disclosure badges Received 3 recommendations , a holder of 4 badges for responsible and coordinated disclosure, found a security vulnerability affecting ruinedcast.com website and its users. Following coordinat...
cio.com Cross Site Scripting vulnerability
Open Bug Bounty ID: OBB-1032453 Security Researcher tester19 Helped patch 12 vulnerabilities Received 1 Coordinated Disclosure badges Received 2 recommendations , a holder of 1 badges for responsible and coordinated disclosure, found a security vulnerability affecting cio.com website and its user...
Yachtcontrol 2019-10-06 Remote Code Execution Exploit #RCE
Exploit for windows platform in category remote exploits Exploit Title: Yachtcontrol Webapplication - Unauthenticated Remote Code Execution Exploit Author: Hodorsec Vendor Homepage: http://www.yachtcontrol.nl/en/ Software Link: http://download.yachtcontrol.nl/klant/Software/ &...
coffee-shop.focus.tv Cross Site Scripting vulnerability
Open Bug Bounty ID: OBB-1030448 Security Researcher devl00p Helped patch 2581 vulnerabilities Received 10 Coordinated Disclosure badges Received 15 recommendations , a holder of 10 badges for responsible and coordinated disclosure, found a security vulnerability affecting coffee-shop.focus.tv...
Fronius Solar Inverter Series Insecure Communication / Path Traversal
SEC Consult Vulnerability Lab Security Advisory ======================================================================= title: Multiple vulnerabilites product: Fronius Solar Inverter Series vulnerable version: SW Version =3.14.1 vuln 2: 3.12.5 - HM 1.10.5, see solution section below CVE number:...
Android Ups the Mobile Security Ante with Default TLS Encryption
A full 80 percent of Android apps are encrypting their traffic by default, according to a Transport Layer Security TLS adoption update from Google. That percentage is even greater for apps targeting Android 9 and higher, with 90 percent of those encrypting traffic by default, the tech giant said ...
Anviz CrossChex Buffer Overflow
Waits for broadcasts from Ainz CrossChex looking for new devices, and returns a custom broadcast, triggering a stack buffer overflow. Module Options msf use exploit/windows/misc/crosschex/devicebof msf undefineddevicebof show actions ...actions... msf undefineddevicebof set ACTION msf...
LY Corporation: SSRF on music.line.me through getXML.php
The reporter found an endpoint through which limited SSRF could be achieved. It was only possible to issue GET requests served over HTTPS. LFI was not possible. The maximum impact found for this issue was minor service disruption and/or limited information leakage...
httpd: mod_http2: possible crash on late upgrade
A vulnerability was found in Apache HTTP Server 2.4.34 to 2.4.38. When HTTP/2 was enabled for a http: host or H2Upgrade was enabled for h2 on a https: host, an Upgrade request from http/1.1 to http/2 that was not the first request on a connection could lead to a misconfiguration and crash. Server...
CVE-2011-4968
nginx http proxy module does not verify peer identity of https origin server which could facilitate man-in-the-middle attack MITM...
DEBIAN-CVE-2011-4968
nginx http proxy module does not verify peer identity of https origin server which could facilitate man-in-the-middle attack MITM...
CVE-2011-4968
nginx http proxy module does not verify peer identity of https origin server which could facilitate man-in-the-middle attack MITM...
UBUNTU-CVE-2011-4968
nginx http proxy module does not verify peer identity of https origin server which could facilitate man-in-the-middle attack MITM...
CVE-2011-4968
nginx http proxy module does not verify peer identity of https origin server which could facilitate man-in-the-middle attack MITM...
DuckDuckGo Will Automatically Encrypt More Sites You Visit
If a site offers HTTPS, DuckDuckGo's Smarter Encryption will take you there...
NSA Releases Cyber Advisory: Managing Risk from Transport Layer Security Inspection
The National Security Agency NSA has released a Cyber Advisory that addresses managing risk from Transport Layer Security Inspection TLSI. This short, informative document defines TLSI a security process that allows incoming traffic to be decrypted, inspected, and re-encrypted, explains some risk...
The vulnerability of the Symfony software platform for developing and managing web applications lies in the lack of use of various CSRF tokens for HTTP and HTTPS requests. This allows attackers to gain unauthorized access to protected information.
The vulnerability of the Symfony software platform for developing and managing web applications is related to the lack of use of various CSRF tokens for HTTP and HTTPS communications. Exploiting this vulnerability could allow a malicious actor, operating remotely, to gain unauthorized access to...
Threat Analysis Unit (TAU) Threat Intelligence Notification: OSX.Yort
In March of 2019 Kaspersky published an article about the Lazarus APT group continued targeting of financial entities. Their report noted that this new campaign being tracked was targeting both Windows and macOS users. The campaign used both malicious PowerShell scripts on windows as well as macO...
RedPeanut - A Small RAT Developed In .Net Core 2 And Its Agent In .Net 3.5/4.0
RedPeanut is a small RAT developed in .Net Core 2 and its agent in .Net 3.5 / 4.0. RedPeanut code execution is based on shellcode generated with DonutCS. It is therefore a hybrid, although developed in .Net it does not rely solely on the Assembly.Load. This increases the detection surface, but...
indiacom.com Cross Site Scripting vulnerability
Open Bug Bounty ID: OBB-1018159 Security Researcher IAMMUSTAFA Helped patch 521 vulnerabilities Received 9 Coordinated Disclosure badges Received 51 recommendations , a holder of 9 badges for responsible and coordinated disclosure, found a security vulnerability affecting indiacom.com website and...