Cisco TelePresence System Directory Information Disclosure Vulnerability

A vulnerability in the code retrieving directory information of Cisco TelePresence System CTS could allow an unauthenticated, remote attacker to intercept and read the content of a directory transferred between the CTS and the Cisco Unified Communications Manager Cisco UCM. The vulnerability is d...

Fedora 20 : perl-LWP-Protocol-https-6.04-4.fc20 (2014-6303)

This release fixes a server certification validation when a certificate authority is defined by HTTPSCADIR or HTTPSCAFILE environement variable. Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to...

[SECURITY] Fedora 20 Update: perl-LWP-Protocol-https-6.04-4.fc20

The LWP::Protocol::https module provides support for using HTTPS schemed URLs with LWP. This module is a plug-in to the LWP protocol handling, so you don't use it directly. Once the module is installed LWP is able to access sites using HTTP over SSL/TLS...

Facebook CSRF Tokens in Heavy Rotation to Ward off BREACH

The BREACH attack was the talk of Black Hat last summer. It was disclosed less than two months after the first Snowden leaks and helped renew focus on the security of online communication and the protocols guarding ecommerce and messaging. What BREACH did was throw a wrench into cross-site reques...

ReddAPI: Strict Transport Security Misconfiguration

URL :- https://www.reddapi.com/docs/ Description :- There was no "Strict-Transport-Security" header in the server response. Remediation detail :- A Strict-Transport-Security HTTP header should be sent with each HTTPS response. The syntax is as follows: Strict-Transport-Security: max-age=;...

CVE-2014-3263

The ScanSafe module in Cisco IOS 15.33M allows remote attackers to cause a denial of service device reload via HTTPS packets that require tower processing, aka Bug ID CSCum97038...

Design/Logic Flaw

The server in Symantec Workspace Streaming SWS before 7.5.0.749 allows remote attackers to access files and functionality by sending a crafted XMLRPC request over HTTPS...

CVE-2014-1649

The server in Symantec Workspace Streaming SWS before 7.5.0.749 allows remote attackers to access files and functionality by sending a crafted XMLRPC request over HTTPS...

CVE-2014-1649

Symantec Workspace Streaming (SWS) server before 7.5.0.749 has an information disclosure/arbitrary file upload vulnerability in its XML-RPC handling (notably the ManagementAgentServer.putFile path), due to lack of proper access-control validation on XMLRPC requests. This allows remote, unauthenti...

CVE-2014-3263

Cisco IOS Software ScanSafe module (15.3(3)M) is affected by CVE-2014-3263, where unauthenticated, remote attackers can trigger a denial of service (device reload) by sending HTTPS packets that must be redirected to a ScanSafe tower, via Bug ID CSCum97038. The concrete impact is a reload of the t...

CVE-2014-1649

The server in Symantec Workspace Streaming SWS before 7.5.0.749 allows remote attackers to access files and functionality by sending a crafted XMLRPC request over HTTPS...

CVE-2014-3263

The ScanSafe module in Cisco IOS 15.33M allows remote attackers to cause a denial of service device reload via HTTPS packets that require tower processing, aka Bug ID CSCum97038...

CVE-2014-1649: Undefined Security Weakness

The server in Symantec Workspace Streaming SWS before 7.5.0.749 allows remote attackers to access files and functionality by sending a crafted XMLRPC request over HTTPS...

CVE-2014-3263: Improper Input Validation

The ScanSafe module in Cisco IOS 15.33M allows remote attackers to cause a denial of service device reload via HTTPS packets that require tower processing, aka Bug ID CSCum97038...

Cisco IOS Software ScanSafe Vulnerability

A vulnerability in the content scanning module of Cisco IOS Software could allow an unauthenticated, remote attacker to cause a reload of the affected device. The vulnerability occurs when processing HTTPS packets that need to be redirected to a ScanSafe tower. An attacker could exploit this...

Design/Logic Flaw

Android OS before 2.2 does not display the correct SSL certificate in certain cases, which might allow remote attackers to spoof trusted web sites via a web page containing references to external sources in which 1 the certificate of the last loaded resource is checked, instead of for the main...

CVE-2010-4832: Undefined Security Weakness

Android OS before 2.2 does not display the correct SSL certificate in certain cases, which might allow remote attackers to spoof trusted web sites via a web page containing references to external sources in which 1 the certificate of the last loaded resource is checked, instead of for the main...

joola.io: HTTP Strict Transport Security (HSTS) Policy Not Enabled

Dear Team, Step-by-step instructions on how to reproduce the problem: It was found the application is vulnerable to HTTP Strict Transport Security HSTS Policy Not Enabled. HTTP Strict Transport Security HSTS is an opt-in security enhancement that is specified by a web application through the use ...

Fake Digital Certificates Found in the Wild While Observing Facebook SSL Connections

Visiting a website certified with an SSL certificate doesn’t mean that the website is not bogus. Secure Sockets Layer SSL protect the web users in two ways, it uses public key encryption to encrypt sensitive information between a user’s computer and a website, such as usernames, passwords, or...

Service Worker - first draft published

The first draft of the service worker spec was published today! It's been a collaborative effort between Google, Samsung, Mozilla and others, and implementations for Chrome and Firefox are being actively developed. Anyone interesting in the web competing with native apps should be excited by this...