Design/Logic Flaw

Squid before 4.4 has XSS via a crafted X.509 certificate during HTTPS error page generation for certificate errors...

CVE-2018-19131

CVE-2018-19131 affects Squid prior to 4.4, enabling cross-site scripting via a crafted X.509 certificate during HTTP(S) error page generation for certificate errors. Connected advisories confirm the issue and provide fixes: Amazon Linux 2 ALAS2-2023-2310 lists updated squid packages (e.g., squid-...

FanDuel: Passive mixed content issues on the site https://*.fanduel.com

Hello. Summary: While browsing the sites https://www.fanduel.com and https://subscriptionapi.fanduel.com found a mixed content error on the site with HTTPS. This error is located at https://www.fanduel.com/press and https://subscriptionapi.fanduel.com/press. Image are uploaded to the site via HTT...

CVE-2018-19131

Squid before 4.4 has XSS via a crafted X.509 certificate during HTTPS error page generation for certificate errors. Recent assessments: travisbgreen at April 21, 2020 10:49pm UTC reported: Bottom line: The commonName property of the certificate that signs the “failed to connect securely” error pa...

Cisco Energy Management Suite Detection

Detection of Cisco Energy Management Suite. The script sends a connection request to the server and attempts to detect Cisco Energy Management Suite and to extract its version. SPDX-FileCopyrightText: 2018 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are...

Oracle Linux 7 : wget (ELSA-2018-3052)

The remote Oracle Linux 7 host has a package installed that is affected by a vulnerability as referenced in the ELSA-2018-3052 advisory. - Fix CVE-2018-0494 1576106 Tenable has extracted the preceding description block directly from the Oracle Linux security advisory. Note that Nessus has not...

"https Improper Access Control vulnerability

Open Bug Bounty ID: OBB-695407 Description| Value ---|--- Affected Website:| "https Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| IAC Improper Access Control / CWE-284 CVSSv3 Score:| 6.5...

Possible XSS vulnerability in Rack

There is a possible vulnerability in Rack. This vulnerability has been assigned the CVE identifier CVE-2018-16471. Versions Affected: All. Not affected: None. Fixed Versions: 2.0.6, 1.6.11 Impact ------ There is a possible XSS vulnerability in Rack. Carefully crafted requests can impact the data...

F5 Networks BIG-IP : HTTPS monitor vulnerability (K05112543)

F5 BIG-IP 13.0.0-13.0.1, 12.1.0-12.1.3.6, or 11.2.1-11.6.3.2 HTTPS health monitors do not validate the identity of the monitored server. CVE-2018-5542 Impact This vulnerability may allow unauthorized disclosure and modification of monitor traffic by an attacker with a privileged network position...

USN-3805-2: curl vulnerability

USN-3805-1 fixed a vulnerability in curl. This update provides the corresponding update for Ubuntu 12.04 ESM. Original advisory details: Brian Carpenter discovered that the curl command-line tool incorrectly handled error messages. A remote attacker could possibly use this issue to obtain sensiti...

Loadbalancer.org Enterprise VA MAX 8.3.2 - Remote Code Execution

Loadbalancer.org Enterprise VA MAX 8.3.2 - Remote Code Execution Exploit Title: Loadbalancer.org Enterprise VA MAX 8.3.2 - Remote Code Execution Date: 2018-07-24 Exploit Authors: Jakub Palaczynski Vendor Homepage: https://www.loadbalancer.org/ Version: . Such JavaScript is stored in "Apache User...

RHEL 7 : wget (RHSA-2018:3052)

The remote Redhat Enterprise Linux 7 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2018:3052 advisory. The wget packages provide the GNU Wget file retrieval utility for HTTP, HTTPS, and FTP protocols. Security Fixes: wget: Cookie injection allows...

Moderate: Red Hat Security Advisory: wget security and bug fix update

An update for wget is now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the C...

Insufficiently Protected Credentials in Requests

The Requests package through 2.19.1 before 2018-09-14 for Python sends an HTTP Authorization header to an http URI upon receiving a same-hostname https-to-http redirect, which makes it easier for remote attackers to discover credentials by sniffing the network...

GEOVAP Reliance 4 SCADA/HMI

1. EXECUTIVE SUMMARY CVSS v3 6.1 ATTENTION: Exploitable remotely/low skill level to exploit Vendor: GEOVAP Equipment: Reliance 4 SCADA/HMI Vulnerability: Cross-site Scripting 2. RISK EVALUATION Successful exploitation of this vulnerability could allow an unauthenticated attacker to use HTTP proxy...

AudioCodes 440HD / 450HD IP Phone 3.1.2.89 Man-In-The-Middle

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 Advisory ID: SYSS-2018-026 Product: 440HD / 450HD IP Phone Manufacturer: AudioCodes Affected Versions: = 3.1.2.89 Tested Versions: VC3.1.1.43.1, VC3.1.2.89 Vulnerability Type: X.509 validation - Man-in-the-Middle CWE-300 Risk Level: Medium Solution...

CVE-2018-12403

If a site is loaded over a HTTPS connection but loads a favicon resource over HTTP, the mixed content warning is not displayed to users. This vulnerability affects Firefox 63...

KLA11341 Multiple vulnerabilities in Mozilla Firefox and Mozilla Firefox ESR

Multiple serious vulnerabilities were found in Mozilla Firefox and Mozilla Firefox ESR. Malicious users can exploit these vulnerabilities to bypass security restrictions, cause denial of service, gain privileges, read local files, spoof user interface and execute arbitrary code. Below is a comple...

SUSE SLES12 Security Update : clamav (SUSE-SU-2018:2323-2)

This update for clamav to version 0.100.1 fixes the following issues : The following security vulnerabilities were addressed : CVE-2018-0360: HWP integer overflow, infinite loop vulnerability bsc1101410 CVE-2018-0361: PDF object length check, unreasonably long time to parse relatively small file...

SUSE-SU-2018:2323-2 Security update for clamav

This update for clamav to version 0.100.1 fixes the following issues: The following security vulnerabilities were addressed: - CVE-2018-0360: HWP integer overflow, infinite loop vulnerability bsc1101410 - CVE-2018-0361: PDF object length check, unreasonably long time to parse relatively small fil...