openSUSE: Security Advisory for rmt-server (openSUSE-SU-2019:1824-1)

The remote host is missing an update for the Copyright C 2020 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

CVE-2019-17002

If upgrade-insecure-requests was specified in the Content Security Policy, and a link was dragged and dropped from that page, the link was not upgraded to https. This vulnerability affects Firefox 70...

Design/Logic Flaw

If upgrade-insecure-requests was specified in the Content Security Policy, and a link was dragged and dropped from that page, the link was not upgraded to https. This vulnerability affects Firefox 70...

CVE-2019-17002

If upgrade-insecure-requests was specified in the Content Security Policy, and a link was dragged and dropped from that page, the link was not upgraded to https. This vulnerability affects Firefox 70...

CVE-2019-17002

If upgrade-insecure-requests was specified in the Content Security Policy, and a link was dragged and dropped from that page, the link was not upgraded to https. This vulnerability affects Firefox 70...

CVE-2019-17002

If upgrade-insecure-requests was specified in the Content Security Policy, and a link was dragged and dropped from that page, the link was not upgraded to https. This vulnerability affects Firefox 70...

CVE-2019-17002

If upgrade-insecure-requests was specified in the Content Security Policy, and a link was dragged and dropped from that page, the link was not upgraded to https. This vulnerability affects Firefox 70...

New SHA-1 Attack

There's a new, practical, collision attack against SHA-1: In this paper, we report the first practical implementation of this attack, and its impact on real-world security with a PGP/GnuPG impersonation attack. We managed to significantly reduce the complexity of collisions attack against SHA-1: ...

CVE-2019-17002: Undefined Security Weakness

If upgrade-insecure-requests was specified in the Content Security Policy, and a link was dragged and dropped from that page, the link was not upgraded to https. This vulnerability affects Firefox 70...

denniskirk.com Cross Site Scripting vulnerability

Open Bug Bounty ID: OBB-1060679 Security Researcher mhthnz Helped patch 0 vulnerabilities Received 0 Coordinated Disclosure badges , found a security vulnerability affecting denniskirk.com website and its users. Following coordinated and responsible vulnerability disclosure guidelines of the ISO...

PT-2020-07: Arbitrary file reading in Oracle WebLogic Server

A vulnerability in Oracle WebLogic Server allows remote attackers to read local files in the context of the web server using a service URL and a specially crafted request. To exploit the vulnerability an adversary should have an administrative account. Access to the administrative panel is not...

oncletom.io Improper Access Control vulnerability

Open Bug Bounty ID: OBB-1052161 Security Researcher geeknik Helped patch 8961 vulnerabilities Received 8 Coordinated Disclosure badges Received 21 recommendations , a holder of 8 badges for responsible and coordinated disclosure, found a security vulnerability affecting oncletom.io website and it...

CVE-2018-3739

A flaw was found in https-proxy-agent, prior to version 2.2.0. It was discovered https-proxy-agent passes an auth option to the Buffer constructor without proper sanitization. This could result in a Denial of Service through the usage of all available CPU resources and data exposure through an...

rp3.tv Cross Site Scripting vulnerability

Open Bug Bounty ID: OBB-1048262 Security Researcher VighneshGupta Helped patch 132 vulnerabilities Received 3 Coordinated Disclosure badges Received 2 recommendations , a holder of 3 badges for responsible and coordinated disclosure, found a security vulnerability affecting rp3.tv website and its...

vidrepur.com Cross Site Scripting vulnerability

Open Bug Bounty ID: OBB-1045655 Security Researcher KhanJanny Helped patch 3060 vulnerabilities Received 9 Coordinated Disclosure badges Received 38 recommendations , a holder of 9 badges for responsible and coordinated disclosure, found a security vulnerability affecting vidrepur.com website and...

Cisco NX-OS Software NX-API Arbitrary Code Execution Vulnerability

According to its self-reported version, Cisco NX-OS Software is affected by a vulnerability in the NX-API feature of Cisco NX-OS Software that could allow an authenticated, local attacker to execute arbitrary code as root. The vulnerability is due to incorrect input validation in the NX-API...

Inspecting TLS Web Traffic - Part 2

In the first blog post I covered why HTTPS web traffic has grown to unprecedented levels, provided a TLS primer and looked at the basic concept of intercepting and inspecting HTTPS web traffic with Man-In-The-Middle techniques MITM. In the second part, I will dive a bit deeper into how the TLS MI...

U.S. Dept Of Defense: Leaked DB credentials on https://██████████.mil/███

Summary: Information disclosure with login credentials for ms-sql database exposed. Description: I've found a PHP info file disclosed on https://█████.mil/██████ containing login credentials for a database cloud server ███████ as well as information on the host system such as hostname, username a...

Design/Logic Flaw

Some analytics data was sent using HTTP rather than HTTPS. This was addressed by no longer sending this analytics data. This issue is fixed in Texture 5.11.10 for iOS, Texture 4.22.0.4 for Android. An attacker in a privileged network position may be able to intercept analytics data...

CVE-2019-8632

Some analytics data was sent using HTTP rather than HTTPS. This was addressed by no longer sending this analytics data. This issue is fixed in Texture 5.11.10 for iOS, Texture 4.22.0.4 for Android. An attacker in a privileged network position may be able to intercept analytics data...