USN-3457-1: curl vulnerability

Brian Carpenter discovered that curl incorrectly handled IMAP FETCH response lines. A remote attacker could use this issue to cause curl to crash, resulting in a denial of service, or possibly execute arbitrary code...

Legal Robot: Non-HTTPS link on blog

Hi, @legalrobot I found another venturebeat.com URL without HTTPS in https://www.legalrobot-uat.com/press/ I hope you fix this Screenshot attached bellow Cheers, Ph0b0s...

Design/Logic Flaw

In F5 BIG-IP PEM 12.1.0 through 12.1.2 when downloading the Type Allocation Code TAC database file via HTTPS, the server's certificate is not verified. Attackers in a privileged network position may be able to launch a man-in-the-middle attack against these connections. TAC databases are used in...

CVE-2017-6144

In F5 BIG-IP PEM 12.1.0 through 12.1.2 when downloading the Type Allocation Code TAC database file via HTTPS, the server's certificate is not verified. Attackers in a privileged network position may be able to launch a man-in-the-middle attack against these connections. TAC databases are used in...

CVE-2017-6144

In F5 BIG-IP PEM 12.1.0 through 12.1.2 when downloading the Type Allocation Code TAC database file via HTTPS, the server's certificate is not verified. Attackers in a privileged network position may be able to launch a man-in-the-middle attack against these connections. TAC databases are used in...

CVE-2017-6144

CVE-2017-6144 affects F5 BIG-IP PEM 12.1.0–12.1.2, where downloading the TAC database over HTTPS does not verify the server certificate. This enables potential man‑in‑the‑middle tampering or information disclosure by an attacker in a privileged network position. Affected components rely on TAC da...

QIWI: apache access.log leakage via long request on https://rapida.ru/

Issue access.log is leaked by attacker who trying send many requests. Explain: Honestly i don't know how the bug is happened, but i guess if the access.log is too large, it will dump some part into the response, and attacker happily get it. Reproduce: 1. Access to https://rapida.ru/search/?q= 2...

Juniper Junos HTTPS Server Certificate AV Vulnerability (JSA10822)

According to its self-reported version number, the remote Junos device is affected by a vulnerability in that the HTTPS server certificate is not verified before downloading anti-virus updates. C Tenable Network Security, Inc. include'compat.inc'; if description scriptid104041; scriptversion"1.7"...

CVE-2017-6144: Improper Certificate Validation

In F5 BIG-IP PEM 12.1.0 through 12.1.2 when downloading the Type Allocation Code TAC database file via HTTPS, the server's certificate is not verified. Attackers in a privileged network position may be able to launch a man-in-the-middle attack against these connections. TAC databases are used in...

PT-2017-16914

Name of the Vulnerable Software and Affected Versions F5 BIG-IP PEM versions 12.1.0 through 12.1.2 Description The issue concerns a lack of server certificate verification when downloading the Type Allocation Code TAC database file via HTTPS. This could allow attackers in a privileged network...

CVE-2017-10166

Vulnerability in the Oracle Security Service component of Oracle Fusion Middleware subcomponent: C Oracle SSL API. Supported versions that are affected are FMW: 11.1.1.9.0 and 12.1.3.0.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTPS to compromis...

CVE-2017-10166

Vulnerability in the Oracle Security Service component of Oracle Fusion Middleware subcomponent: C Oracle SSL API. Supported versions that are affected are FMW: 11.1.1.9.0 and 12.1.3.0.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTPS to compromis...

PT-2017-11158

Name of the Vulnerable Software and Affected Versions Oracle Fusion Middleware versions 11.1.1.9.0 and 12.1.3.0.0 Description The issue allows an unauthenticated attacker with network access via HTTPS to compromise the Oracle Security Service component. This can result in unauthorized update,...

About the security content of Apple Support 1.2 for iOS - Apple Support

About Apple security updates For our customers' protection, Apple doesn't disclose, discuss, or confirm security issues until an investigation has occurred and patches or releases are available. Recent releases are listed on the Apple security updates page. For more information about security, se...

SSL Certificate Contains Weak RSA Key (Infineon TPM / ROCA)

At least one of the X.509 certificates sent by the remote host has an RSA key that appears to be generated improperly, most likely by a TPM Trusted Platform Module produced by Infineon Technologies. A third party may be able to recover the private key from the certificate's public key. This may...

changeme - A Default Credential Scanner

A default credential scanner. About Getting default credentials added to commercial scanners is often difficult and slow. changeme is designed to be simple to add new credentials without having to write any code or modules. changeme keeps credential data separate from code. All credentials are...

Anti-DDOS - Anti DDOS Bash Script

Programming Languages : BASH RUN root@ismailtasdelen: bash ./anti-ddos.sh Cloning an Existing Repository Clone with HTTPS git clone https://github.com/ismailtasdelen/Anti-DDOS.git Cloning an Existing Repository Clone withSSH git clone [email protected]:ismailtasdelen/Anti-DDOS.git Download...

Design/Logic Flaw

Juniper Networks Junos OS on SRX series devices do not verify the HTTPS server certificate before downloading anti-virus updates. This may allow a man-in-the-middle attacker to inject bogus signatures to cause service disruptions or make the device not detect certain types of attacks. Affected...

CVE-2017-10620

Juniper Networks Junos OS on SRX series devices do not verify the HTTPS server certificate before downloading anti-virus updates. This may allow a man-in-the-middle attacker to inject bogus signatures to cause service disruptions or make the device not detect certain types of attacks. Affected...

CVE-2017-10620 SRX Series: Antivirus updates are downloaded without verification

Juniper Networks Junos OS on SRX series devices do not verify the HTTPS server certificate before downloading anti-virus updates. This may allow a man-in-the-middle attacker to inject bogus signatures to cause service disruptions or make the device not detect certain types of attacks. Affected...