9439 matches found
CVE-2019-8632
CVE-2019-8632 concerns Texture’s analytics data being sent over HTTP instead of HTTPS. The issue affects Texture versions prior to the fixed releases and could allow interception of analytics data by an attacker in a privileged network position. The connected sources specify fixed versions: Textu...
Security Bulletin: IBM 10x vulnerability in IBM Control Center could allow a remote attacker to obtain sensitive information (CVE-2016-0341)
Summary IBM 10x vulnerability in IBM Control Center could allow a remote attacker to obtain sensitive information. Vulnerability Details CVEID: CVE-2016-0341 DESCRIPTION: IBM 10x could allow a malicious user to obtain highly sensitive information due to missing configurations of HTTPS. CVSS Base...
Inspecting TLS Web Traffic - Part 1
In this series of blogs I'm going to talk about how the continued move towards all web traffic being encrypted has impacted enterprise security. In this blog I'm going to focus on the basics - what is encrypted web traffic and how can you proactively control this. TLS encryption is the de-facto...
ipdj.pt Improper Access Control vulnerability
Security Researcher MiguelSantareno Helped patch 1012 vulnerabilities Received 12 Coordinated Disclosure badges Received 19 recommendations , a holder of 12 badges for responsible and coordinated disclosure, found a security vulnerability affecting ipdj.pt website and its users. Following...
SUSE SLED12 / SLES12 Security Update : strongswan (SUSE-SU-2019:3266-1)
This update for strongswan provides the following fixes : Security issues fixed : CVE-2018-5388: Fixed a buffer underflow which may allow to a remote attacker with local user credentials to resource exhaustion and denial of service while reading from the socket bsc1094462. CVE-2018-10811: Fixed a...
Siemens SIMATIC CP 343-1/CP 443-1 Modules and SIMATIC S7-300/S7-400 CPUs Vulnerabilities (Update B)
As of January 10, 2023, CISA will no longer be updating ICS security advisories for Siemens product vulnerabilities beyond the initial advisory. For the most up-to-date information on vulnerabilities in this advisory, please seeSiemens' ProductCERT Security Advisories CERT Services | Services |...
Stripo Inc: SSRF in Export template to ActiveCampaign
Summary: I found a SSRF vulneranility in export template to email marketing platform ActiveCampaign. Steps To Reproduce: add details for how we can reproduce the issue 1. Login to your account in 1. Go to https://my.stripo.email/cabinet//templates/ 1. Click on Create your first mail & select one...
Apk-Mitm - A CLI Application That Prepares Android APK Files For HTTPS Inspection
A CLI application that automatically prepares Android APK files for HTTPS inspection Inspecting a mobile app's HTTPS traffic using a proxy is probably the easiest way to figure out how it works. However, with the Network Security Configuration introduced in Android 7 and app developers trying to...
casualrandki.com Cross Site Scripting vulnerability
Open Bug Bounty ID: OBB-1033259 Security Researcher Gh05tPT Helped patch 6892 vulnerabilities Received 10 Coordinated Disclosure badges Received 48 recommendations , a holder of 10 badges for responsible and coordinated disclosure, found a security vulnerability affecting casualrandki.com website...
cautplaceri.com Cross Site Scripting vulnerability
Open Bug Bounty ID: OBB-1033258 Security Researcher Gh05tPT Helped patch 6892 vulnerabilities Received 10 Coordinated Disclosure badges Received 48 recommendations , a holder of 10 badges for responsible and coordinated disclosure, found a security vulnerability affecting cautplaceri.com website...
ruinedcast.com Cross Site Scripting vulnerability
Security Researcher g0bl1nsec Helped patch 3608 vulnerabilities Received 4 Coordinated Disclosure badges Received 3 recommendations , a holder of 4 badges for responsible and coordinated disclosure, found a security vulnerability affecting ruinedcast.com website and its users. Following coordinat...
cio.com Cross Site Scripting vulnerability
Open Bug Bounty ID: OBB-1032453 Security Researcher tester19 Helped patch 12 vulnerabilities Received 1 Coordinated Disclosure badges Received 2 recommendations , a holder of 1 badges for responsible and coordinated disclosure, found a security vulnerability affecting cio.com website and its user...
Yachtcontrol 2019-10-06 Remote Code Execution Exploit #RCE
Exploit for windows platform in category remote exploits Exploit Title: Yachtcontrol Webapplication - Unauthenticated Remote Code Execution Exploit Author: Hodorsec Vendor Homepage: http://www.yachtcontrol.nl/en/ Software Link: http://download.yachtcontrol.nl/klant/Software/ &...
coffee-shop.focus.tv Cross Site Scripting vulnerability
Open Bug Bounty ID: OBB-1030448 Security Researcher devl00p Helped patch 2581 vulnerabilities Received 10 Coordinated Disclosure badges Received 15 recommendations , a holder of 10 badges for responsible and coordinated disclosure, found a security vulnerability affecting coffee-shop.focus.tv...
Fronius Solar Inverter Series Insecure Communication / Path Traversal
SEC Consult Vulnerability Lab Security Advisory ======================================================================= title: Multiple vulnerabilites product: Fronius Solar Inverter Series vulnerable version: SW Version =3.14.1 vuln 2: 3.12.5 - HM 1.10.5, see solution section below CVE number:...
Android Ups the Mobile Security Ante with Default TLS Encryption
A full 80 percent of Android apps are encrypting their traffic by default, according to a Transport Layer Security TLS adoption update from Google. That percentage is even greater for apps targeting Android 9 and higher, with 90 percent of those encrypting traffic by default, the tech giant said ...
Anviz CrossChex Buffer Overflow
Waits for broadcasts from Ainz CrossChex looking for new devices, and returns a custom broadcast, triggering a stack buffer overflow. Module Options msf use exploit/windows/misc/crosschex/devicebof msf undefineddevicebof show actions ...actions... msf undefineddevicebof set ACTION msf...
LY Corporation: SSRF on music.line.me through getXML.php
The reporter found an endpoint through which limited SSRF could be achieved. It was only possible to issue GET requests served over HTTPS. LFI was not possible. The maximum impact found for this issue was minor service disruption and/or limited information leakage...
httpd: mod_http2: possible crash on late upgrade
A vulnerability was found in Apache HTTP Server 2.4.34 to 2.4.38. When HTTP/2 was enabled for a http: host or H2Upgrade was enabled for h2 on a https: host, an Upgrade request from http/1.1 to http/2 that was not the first request on a connection could lead to a misconfiguration and crash. Server...
