449 matches found
Chris Vickery on Amazon S3 Data Leaks
Mike Mimoso talks to Chris Vickery of UpGuard of the recent rash of Amazon S3 data leaks. Vickery uncovers of the commonalities among these leaks, some of which include AWS misconfigurations and mismanagement of third-party partner relationships. Download: ChrisVickeryonAmazonS3DataLeaks.mp3...
What Triggers HTTPS Chrome Browser Warnings?
A lot of hours go into debugging the cause of and tweaking the HTTPS error warnings that pop up in Google’s Chrome browser. Researchers from Google, Purdue University, the International Institute of Information Technology Hyderabad, and the Leibniz University of Hanover Germany have spent the las...
CVE-2017-9798
Apache httpd allows remote attackers to read secret data from process memory if the Limit directive can be set in a user's .htaccess file, or if httpd.conf has certain misconfigurations, aka Optionsbleed. This affects the Apache HTTP Server through 2.2.34 and 2.4.x through 2.4.27. The attacker...
CVE-2017-9798
CVE-2017-9798 affects the Apache HTTP Server (httpd) up to 2.4.27 and 2.2.34. A use-after-free flaw in how httpd handles invalid/previously unregistered HTTP methods specified by the Limit directive (used in .htaccess or certain httpd.conf configurations) can allow a remote, unauthenticated attac...
CVE-2017-9798
Apache httpd allows remote attackers to read secret data from process memory if the Limit directive can be set in a user's .htaccess file, or if httpd.conf has certain misconfigurations, aka Optionsbleed. This affects the Apache HTTP Server through 2.2.34 and 2.4.x through 2.4.27. The attacker...
CVE-2017-9798
Apache httpd allows remote attackers to read secret data from process memory if the Limit directive can be set in a user's .htaccess file, or if httpd.conf has certain misconfigurations, aka Optionsbleed. This affects the Apache HTTP Server through 2.2.34 and 2.4.x through 2.4.27. The attacker...
UBUNTU-CVE-2017-9798
Apache httpd allows remote attackers to read secret data from process memory if the Limit directive can be set in a user's .htaccess file, or if httpd.conf has certain misconfigurations, aka Optionsbleed. This affects the Apache HTTP Server through 2.2.34 and 2.4.x through 2.4.27. The attacker...
Important: httpd24, httpd
Issue Overview: Apache httpd allows remote attackers to read secret data from process memory if the Limit directive can be set in a user's .htaccess file, or if httpd.conf has certain misconfigurations, aka Optionsbleed. The attacker sends an unauthenticated OPTIONS HTTP request when attempting t...
Spaghetti v0.1.1 - Web Application Security Scanner
Spaghetti is a web application security scanner tool. It is designed to find various default and insecure files, configurations, and misconfigurations. Spaghetti is built on python2.7 and can run on any platform which has a Python environment. Installation $ git clone...
Why Care About Data-Centric Security?
It’s no surprise that data breaches are evolving and becoming increasingly more complex. According to the Verizon 2017 Data Breach Investigation Report, data breaches are “complex affairs often involving some combination of human factors, hardware devices, exploited configurations or malicious...
Auto Lender Exposes Loan Data For Up To 1 Million Applicants
A California auto loan company left the names, addresses, credit scores and partial Social Security numbers of up to 1 million people exposed on an insecure online database. The company behind the database is Alliance Direct Lending Corporation, according to Kromtech Security Research Center, whi...
BeRoot - Windows Privilege Escalation Tool
BeRoots is a post exploitation tool to check commun Windows misconfigurations to find a way to escalate our privilege. A compiled version is available here. It will be added to the pupy project as a post exploitation module so it will be executed all in memory without touching the disk. Except on...
Pentesting Active Directory Environments: CrackMapExec
Pentesting Active Directory Environments: CrackMapExec CrackMapExec a.k.a CME is a post-exploitation tool that helps automate assessing the security of large Active Directory networks. Built with stealth in mind, CME follows the concept of “Living off the Land”: abusing built-in Active Directory...
The vulnerability of the iOS operating system allows a hacker to bypass the code access procedure and unlock the device.
The vulnerability of the SpringBoard component in the iOS operating system is related to security configuration errors. Exploiting this vulnerability allows a malicious individual to bypass the code access procedure and unlock the device using uncertain vectors...
MongoDB Security Audit: mongoaudit
MongoDB Security Audit mongoaudit is a CLI tool for auditing MongoDB servers, detecting poor security settings and performing automated penetration testing. It is widely known that there are quite a few holes in MongoDB’s default configuration settings. This fact, combined with abundant lazy syst...
Information disclosure
IBM Security Access Manager for Web could allow a remote attacker to obtain sensitive information due to security misconfigurations...
CVE-2016-3017
IBM Security Access Manager for Web could allow a remote attacker to obtain sensitive information due to security misconfigurations...
CVE-2016-3017
IBM Security Access Manager for Web could allow a remote attacker to obtain sensitive information due to security misconfigurations...
