Information disclosure

An information-disclosure issue was discovered in Postman through 6.3.0. It validates a server's X.509 certificate and presents an error if the certificate is not valid. Unfortunately, the associated HTTPS request data is sent anyway. Only the response is not displayed. Thus, all contained...

Linux Meterpreter, Reverse HTTPS Inline

Run the Meterpreter / Mettle server payload stageless This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework Module generated by tools/modules/generatemettlepayloads.rb module MetasploitModule CachedSize = 1062084 include...

areuea.org XSS vulnerability

Open Bug Bounty ID: OBB-678478 Description| Value ---|--- Affected Website:| areuea.org Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

CVE-2018-16955

The login function of Oracle WebCenter Interaction Portal 10.3.3 is vulnerable to reflected cross-site scripting XSS. The content of the inhiredirect parameter, when prefixed with the https:// scheme, is unsafely reflected in a HTML META tag in the HTTP response. NOTE: this CVE is assigned by MIT...

USN-3765-2: curl vulnerability

USN-3765-1 fixed a vulnerability in curl. This update provides the corresponding update for Ubuntu 12.04 ESM. Original advisory details: It was discovered that curl incorrectly handled certain inputs. An attacker could possibly use this to execute arbitrary code...

USN-3765-1: curl vulnerability

It was discovered that curl incorrectly handled certain inputs. An attacker could possibly use this to execute arbitrary code...

About the security content of Apple Support 2.4 for iOS - Apple Support

About Apple security updates For our customers' protection, Apple doesn't disclose, discuss, or confirm security issues until an investigation has occurred and patches or releases are available. Recent releases are listed on the Apple security updates page. For more information about security, se...

About the security content of Apple Support 2.4 for iOS

About the security content of Apple Support 2.4 for iOS This document describes the security content of Apple Support 2.4 for iOS. About Apple security updates For our customers' protection, Apple doesn't disclose, discuss, or confirm security issues until an investigation has occurred and patche...

Code injection

Insecure permissions in Lone Wolf Technologies loadingDOCS 2018-08-13 allow remote attackers to download any confidential files via https requests for predictable URLs...

CVE-2018-15502

The CVE-2018-15502 entry concerns Lone Wolf Technologies loadingDOCS. An insecure permissions flaw in the 2018-08-13 version allows remote attackers to download confidential files by issuing HTTPS requests to predictable URLs. The root cause is inadequate access controls on resources, enabling un...

CVE-2018-2460

SAP Business One Android application, version 1.2, does not verify the certificate properly for HTTPS connection. This allows attacker to do MITM attack...

Design/Logic Flaw

SAP Business One Android application, version 1.2, does not verify the certificate properly for HTTPS connection. This allows attacker to do MITM attack...

CVE-2018-2460

SAP Business One Android application, version 1.2, does not verify the certificate properly for HTTPS connection. This allows attacker to do MITM attack...

PT-2018-15577

Name of the Vulnerable Software and Affected Versions SAP Business One Android application version 1.2 Description The issue allows an attacker to perform a Man-In-The-Middle MITM attack due to improper verification of the certificate for HTTPS connections. Recommendations For SAP Business One...

Lenovo Replacing Distrusted GeoTrust Certificates With New DigiCert Certificates - US

Lenovo Security Advisory: LEN-24497 Scope of Impact: Industry-wide. Anyone using a GeoTrust certificate will need to update to DigiCert. Major browsers will stop trusting GeoTrust certificates as early as October. Summary Description: Many Lenovo sites use PKI certificates issued by the GeoTrust...

Lenovo Replacing Distrusted GeoTrust Certificates With New DigiCert Certificates - Lenovo Support US

No description provided...

CVE-2018-6320

CVE-2018-6320 affects Pulse Connect Secure (PCS) and Pulse Policy Secure (PPS) where login.cgi improperly validates the http(s) Host header. Affected versions: PCS 8.1RX pre-8.1R12 and 8.3RX pre-8.3R2; PPS 5.2RX pre-5.2R9 and 5.4RX pre-5.4R2. The issue arises from trusting the Host header receive...

CVE-2018-1000664

daneren2005 DSub for Subsonic Android client version 5.4.1 contains a CWE-295: Improper Certificate Validation vulnerability in HTTPS Client that can result in Any non-CA signed server certificate, including self signed and expired, are accepted by the client. This attack appear to be exploitable...

CVE-2018-1000664

daneren2005 DSub for Subsonic Android client version 5.4.1 contains a CWE-295: Improper Certificate Validation vulnerability in HTTPS Client that can result in Any non-CA signed server certificate, including self signed and expired, are accepted by the client. This attack appear to be exploitable...

Input validation

daneren2005 DSub for Subsonic Android client version 5.4.1 contains a CWE-295: Improper Certificate Validation vulnerability in HTTPS Client that can result in Any non-CA signed server certificate, including self signed and expired, are accepted by the client. This attack appear to be exploitable...