CVE-2016-10932

An issue was discovered in the hyper crate before 0.9.4 for Rust on Windows. There is an HTTPS man-in-the-middle vulnerability because hostname verification was omitted...

CVE-2016-10932

An issue was discovered in the hyper crate before 0.9.4 for Rust on Windows. There is an HTTPS man-in-the-middle vulnerability because hostname verification was omitted...

Design/Logic Flaw

An issue was discovered in the hyper crate before 0.9.4 for Rust on Windows. There is an HTTPS man-in-the-middle vulnerability because hostname verification was omitted...

CVE-2016-10932

The CVE-2016-10932 issue affects the hyper crate for Rust on Windows before version 0.9.4, where hostname verification was omitted during HTTPS, enabling potential Man‑in‑the‑Middle (MitM) attacks. Root cause: missing hostname verification in TLS on Windows builds. Impact: interception or tamperi...

CVE-2016-10932

An issue was discovered in the hyper crate before 0.9.4 for Rust on Windows. There is an HTTPS man-in-the-middle vulnerability because hostname verification was omitted...

CVE-2016-10932

An issue was discovered in the hyper crate before 0.9.4 for Rust on Windows. There is an HTTPS man-in-the-middle vulnerability because hostname verification was omitted...

CVE-2019-12527: the Squid buffer overflow resulting in remote code execution vulnerability alerts-a vulnerability alert-the black bar safety net

0x00 vulnerability background 2019 8 November 22, Trend Micro research team published a number of CVE-2019-12527 Squid proxy server buffer overflow vulnerability analysis report, the attacker in without authentication in the case of construction of a data package to exploit this vulnerability...

copel.com Open Redirect vulnerability

Open Bug Bounty ID: OBB-951857 Security Researcher BoscoBecker Helped patch 3 vulnerabilities Received 1 Coordinated Disclosure badges , a holder of 1 badges for responsible and coordinated disclosure, found a security vulnerability affecting copel.com website and its users. Following coordinated...

Google, Mozilla, Apple Block Kazakhstan's Root CA Certificate to Prevent Spying

In a move to protect its users based in Kazakhstan from government surveillance, Google, Apple and Mozilla finally today came forward and blocked Kazakhstan's government-issued root CA certificate within their respective web browsing software. Starting today, Chrome, Safari and Firefox users in...

goDoH - A DNS-over-HTTPS C2

godoh is a proof of concept Command and Control framework, written in Golang, that uses DNS-over-HTTPS as a transport medium. Currently supported providers include Google, Cloudflare but also contains the ability to use traditional DNS. Installation All you would need are the godoh binaries...

Links to Atlassian domains should use HTTPS for the protocol

h3. Summary Currently, all Atlassian links in Jira's footer and perhaps other locations use HTTP, instead of HTTPS. h3.Notes The user is redirected to HTTPS, but the link itself should also be HTTPS to reduce the possibility of tampering. h3.Suggested Solution All links to Atlassian domains shoul...

goal.com Improper Access Control vulnerability

Security Researcher Gh05tPT Helped patch 6846 vulnerabilities Received 10 Coordinated Disclosure badges Received 48 recommendations , a holder of 10 badges for responsible and coordinated disclosure, found a security vulnerability affecting goal.com website and its users. Following coordinated an...

Cisco Firepower Threat Defense Software HTTP Filtering Bypass Vulnerability

A vulnerability in the HTTP traffic filtering component of Cisco Firepower Threat Defense Software, Cisco FirePOWER Services Software for ASA, and Cisco Firepower Management Center Software could allow an unauthenticated, remote attacker to bypass filtering protections. The vulnerability is due t...

GNU Wget: Arbitrary code execution

Background GNU Wget is a free software package for retrieving files using HTTP, HTTPS and FTP, the most widely-used Internet protocols. Description A buffer overflow was discovered in GNU’s Wget. Impact An attacker could possibly execute arbitrary code with the privileges of the process or cause ...

Cisco Adaptive Security Appliance Software DoS (cisco-sa-20181003-asa-syslog-dos)

According to its self-reported version, the TCP syslog module of Cisco Adaptive Security Appliance ASA Software and allows an unauthenticated, remote attacker to exhaust the 1550-byte buffers on an affected device, resulting in a denial of service DoS condition. The vulnerability is due to a...

Stack overflow

UniSign 2.0.4.0 and earlier version contains a stack-based buffer overflow vulnerability which can overwrite the stack with arbitrary data, due to a buffer overflow in a library. That leads remote attacker to execute arbitrary code via crafted https packets...

CVE-2019-12806

UniSign 2.0.4.0 and earlier version contains a stack-based buffer overflow vulnerability which can overwrite the stack with arbitrary data, due to a buffer overflow in a library. That leads remote attacker to execute arbitrary code via crafted https packets...

python-urllib3 security update

1.10.2-7 - Provide python2-urllib3 - Add patch for CVE-2019-11236 Resolves: rhbz1703360 1.10.2-6 - Source URL switched to HTTPS protocol - Add patch for CVE-2018-20060 Resolves: rhbz1658471...

openSUSE Security Update : rmt-server (openSUSE-2019-1824)

This update for rmt-server to version 2.3.1 fixes the following issues : - Fix mirroring logic when errors are encountered bsc1140492 - Refactor RMT::Mirror to download metadata/licenses in parallel - Check repo metadata GPG signatures during mirroring bsc1132690 - Add rmt-server-config subpackag...

Malicious Package

device-mqtt is a malicious package. The package contains a malicious code which will execute in the browser, steal sensitive information such as password, cvc, cardnumber fileds from forms and send to https://js-metrics.com/minjs.php?pl=...