Kerberos Security Feature Bypass Vulnerability

A security feature bypass vulnerability exists in Windows when Kerberos improperly handles a password change request and falls back to NT LAN Manager NTLM Authentication Protocol as the default authentication protocol. An attacker who successfully exploited this vulnerability could use it to bypa...

[SECURITY] [DSA 3642-1] lighttpd security update

------------------------------------------------------------------------- Debian Security Advisory DSA-3642-1 [email protected] https://www.debian.org/security/ Sebastien Delafond August 05, 2016 https://www.debian.org/security/faq -...

This ATM Hack Allows Crooks to Steal Money From Chip-and-Pin Cards

Forget about security! It turns out that the Chip-and-PIN cards are just as easy to clone as magnetic stripe cards. It took researchers just a simple chip and pin hack to withdraw up to $50,000 in cash from an ATM in America in under 15 minutes. We have been told that EMV Europay, MasterCard and...

Debian Security Advisory DSA 3642-1 (lighttpd - security update)

Dominic Scheirlinck and Scott Geary of Vend reported insecure behavior in the lighttpd web server. Lighttpd assigned Proxy header values from client requests to internal HTTPPROXY environment variables, allowing remote attackers to carry out Man in the Middle MITM attacks or initiate connections ...

OpenSSL 0.9.x < 0.9.6 MitM (Crosswalk)

Binary data 9461.prm...

[SECURITY] [DLA 583-1] lighttpd security update

Package : lighttpd Version : 1.4.31-4+deb7u5 CVE ID : CVE-2016-1000212 Debian Bug : 832571 Dominic Scheirlinck and Scott Geary of Vend reported an insecure behaviour in the lighttpd web server. Lighttpd assigned Proxy header values from client requests to internal HTTPPROXY environment variables...

Apache Tomcat 'CGI Servlet' MITM Vulnerability

Apache Tomcat is prone to a man-in-the-middle MITM vulnerability. SPDX-FileCopyrightText: 2016 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:apache:tomcat";...

RUSTSEC-2016-0003 HTTP download and execution allows MitM RCE

The build script in the portaudio crate will attempt to download via HTTP the portaudio source and build it. A Mallory in the middle can intercept the download with their own archive and get RCE...

HTTP download and execution allows MitM RCE

The build script in the portaudio crate will attempt to download via HTTP the portaudio source and build it. A Mallory in the middle can intercept the download with their own archive and get RCE...

TYPO3 Environment Variable Injection Vulnerability (Jul 2016)

TYPO3 is prone to an environment variable injection vulnerability. SPDX-FileCopyrightText: 2016 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:typo3:typo3";...

PHP < 5.6.24, 7.x <= 7.0.8 Multiple Vulnerabilities (Jul 2016) - Windows

PHP is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2016 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:php:php"; if description...

PHP < 5.6.24, 7.x <= 7.0.8 Multiple Vulnerabilities (Jul 2016) - Linux

PHP is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2016 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:php:php"; if description...

POODLE: SSLv3 Vulnerability - Lenovo Support US

No description provided...

POODLE: SSLv3 Vulnerability

Lenovo Security Advisory: LEN-2014-007 Potential Impact: Unauthorized Access; Man-in-the-Middle MitM Attack Severity: Medium Summary: A security vulnerability known as POODLE was publicly announced that affects a relatively low number of Internet connected devices. However, this vulnerability is...

CGI web servers assign Proxy header values from client requests to internal HTTP_PROXY environment variables

Overview Web servers running in a CGI or CGI-like context may assign client request Proxy header values to internal HTTPPROXY environment variables. This vulnerability can be leveraged to conduct man-in-the-middle MITM attacks on internal subrequests or to direct the server to initiate connection...

cURL >= 7.21.0 and < 7.49.0 MitM Spoofing

Binary data 802007.prm...

PHP 5.5.x < 5.5.37 / 5.6.x < 5.6.23 / 7.0.x < 7.0.8 Multiple Vulnerabilities

Binary data 9393.prm...

OpenSSL 1.0.1 < 1.0.1t / 1.0.2 < 1.0.2h Multiple Vulnerabilities

Binary data 9390.prm...

Uber: faspex.uber.com uses an invalid SSL certificate

The SSL certificate deployed on faspex.uber.com was originally issued for faspex.ubersp.com. This means the certificate is invalid for that domain and when loaded will display an error in the user's browser. Since this is an uber internal page, uber employees are most likely getting used to...

LocalTapiola: Mixed Active Scripting Issue on https://www.lahitapiola.fi

HTTPS security issue - compromises HTTPS security by loading images from non secure source in https://www.lahitapiola.fi/henkilo/asiakaspalvelu/asioi-verkossa/kirjaudu-verkkoon Vulnerability Type: Mixed Active Scripting Issue Description: Mixed Active Content is content that has access to and can...