http-generator NSE Script

Displays the contents of the "generator" meta tag of a web page default: / if there is one. Script Arguments http-generator.path Specify the path you want to check for a generator meta tag default to '/'. http-generator.redirects Specify the maximum number of redirects to follow defaults to 3...

OP5 license.php Remote Command Execution

This file is part of the Metasploit Framework and may be subject to redistribution and commercial restrictions. Please see the Metasploit Framework web site for more information on licensing and terms of use. http://metasploit.com/framework/ require 'msf/core' class Metasploit3 'OP5 license.php...

MS12-006: Vulnerability in SSL/TLS Could Allow Information Disclosure (2643584)

The remote host is affected by an information disclosure vulnerability, known as BEAST, in the SSL 3.0 and TLS 1.0 protocols due to a flaw in the way the initialization vector IV is selected when operating in cipher-block chaining CBC modes. A man-in-the-middle attacker can exploit this to obtain...

Google Chrome HTTPS Address Bar Spoofing

Google awarded one of our security researchers a Chromium Security Reward for an HTTPS address bar spoofing bug in Chrome 14 and 15 although it may be present in older versions too. The bug was fixed in Chrome 16, most browsers seem to be updated and we're happy to share technical details with th...

Google Chrome HTTPS地址栏欺骗漏洞

Google Chrome是一个由Google公司开发的开源网页浏览器。 Google Chrome 14和15在HTTPS地址栏的实现上存在欺骗漏洞，攻击者可利用此漏洞诱使用户访问恶意站点，泄露其证书和个人数据。 0 Google Chrome 15 Google Chrome 14 厂商补丁： Google ------ 目前厂商已经发布了升级补丁以修复这个安全问题，请到厂商的主页下载： http://www.google.com...

PHP Hash Table Collision Proof Of Concept

Exploit for php platform in category dos / poc ''' This script was written by Christian Mehlmauer Original PHP Payloadgenerator taken from https://github.com/koto/blog-kotowicz-net-examples/tree/master/hashcollision CVE : CVE-2011-4885 requires Python 2.7 Examples: - Make a single Request, wait f...

PHP Hash Table Collision - Denial of Service (PoC)

PHP Hash Table Collision - Denial of Service PoC ! /usr/bin/env python """ This script was written by Christian Mehlmauer https://twitter.com/!/FireFart Sourcecode online at: https://github.com/FireFart/HashCollision-DOS-POC Original PHP Payloadgenerator taken from...

PHP 5.3.x Hash Collision Proof Of Concept Code

''' This script was written by Christian Mehlmauer Original PHP Payloadgenerator taken from https://github.com/koto/blog-kotowicz-net-examples/tree/master/hashcollision CVE : CVE-2011-4885 requires Python 2.7 Examples: - Make a single Request, wait for the response and save the response to...

[SECURITY] [DSA 2368-1] lighttpd security update

--------------------------------------------------------------------------- Debian Security Advisory DSA-2368-1 [email protected] http://www.debian.org/security/ Nico Golde Dec 20th, 2011 http://www.debian.org/security/faq -...

CVE-2011-4849

The Control Panel in Parallels Plesk Panel 10.4.4build20111103.18 does not set the secure flag for a cookie in an https session, which makes it easier for remote attackers to capture this cookie by intercepting its transmission within an http session, as demonstrated by cookies used by help.php a...

CVE-2011-4728

The Server Administration Panel in Parallels Plesk Panel 10.2.0build1011110331.18 does not set the secure flag for a cookie in an https session, which makes it easier for remote attackers to capture this cookie by intercepting its transmission within an http session, as demonstrated by cookies us...

Design/Logic Flaw

The Control Panel in Parallels Plesk Panel 10.4.4build20111103.18 does not set the secure flag for a cookie in an https session, which makes it easier for remote attackers to capture this cookie by intercepting its transmission within an http session, as demonstrated by cookies used by help.php a...

CVE-2011-4849

The CVE-2011-4849 entry affects Parallels Plesk Panel 10.4.4_build20111103.18, where the Control Panel does not set the Secure flag on cookies during HTTPS sessions. This can allow an attacker to capture the cookies by intercepting HTTP traffic, as demonstrated by cookies used by help.php and oth...

SuSE 10 Security Update : Mozilla XULrunner (ZYPP Patch Number 7427)

Mozilla XULRunner 1.9.1 was updated to version 1.9.1.18 to fix the following security issue : - Several invalid HTTPS certificates were placed on the certificate blacklist to prevent their misuse. MFSA 2011-11 %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The text description of this plugi...

SuSE 10 Security Update : Mozilla Firefox (ZYPP Patch Number 7421)

MozillaFirefox was updated to version 3.6.16 to fix several security issues : - Several invalid HTTPS certificates were placed on the certificate blacklist to prevent their misuse. MFSA 2011-11 - Several memory safety bugs in the browser engine used in Firefox and other Mozilla-based products hav...

[SECURITY] Fedora 15 Update: nginx-1.0.10-1.fc15

Nginx engine x is an HTTPS server, HTTPS reverse proxy and IMAP/POP3 proxy server written by Igor Sysoev...

Your Android Phone is Spying On You, Use custom ROM To Protect your Privacy

Your Android Phone is Spying On You, Use custom ROM To Protect your Privacy In this digital age, privacy is more important than ever. Just because you "don't have anything to hide," does not mean that you shouldn't value your privacy or fight for it when companies do things like this, especially...

Fedora 14 : nss-3.12.10-7.fc14 (2011-15586)

This security update revokes trust in DigiCert Sdn. Bhd Intermediate Certificate Authority from NSS - rhbz751674 It was found that the Malaysia-based Digicert Sdn. Bhd. subordinate Certificate Authority CA issued HTTPS certificates with weak keys. This update renders any HTTPS certificates signed...

Google Implements Forward Secrecy

Google is stepping up their security game in a big way for the second time this year: introducing a more secure browsing method known as forward secrecy in Gmail and a number of other Web-based services, according to a post on the GoogleOnlineSecurity blog. In recent months, the Silicon Valley...

Medium: nss

Issue Overview: It was found that the Malaysia-based Digicert Sdn. Bhd. subordinate Certificate Authority CA issued HTTPS certificates with weak keys. This update renders any HTTPS certificates signed by that CA as untrusted. This covers all uses of the certificates, including SSL, S/MIME, and co...