Downloads Resources over HTTP

Overview Affected versions of httpsync insecurely download an executable over an unencrypted HTTP connection. In scenarios where an attacker has a privileged network position, it is possible to intercept the response and replace the executable with a malicious one, resulting in code execution on...

Downloads Resources over HTTP

Overview Affected versions of ibapi insecurely download an executable over an unencrypted HTTP connection. In scenarios where an attacker has a privileged network position, it is possible to intercept the response and replace the executable with a malicious one, resulting in code execution on the...

Downloads Resources over HTTP

Overview Affected versions of alto-saxophone insecurely download an executable over an unencrypted HTTP connection. In scenarios where an attacker has a privileged network position, it is possible to intercept the response and replace the executable with a malicious one, resulting in code executi...

HackerOne: Non-secure requests are not automatically upgraded to HTTPS

Non-secure requests to hackerone.com e.g. http://hackerone.com are not automatically upgraded to HTTPS. This is not something you would notice when you use the latest version of modern web browsers such as Google Chrome or Firefox, because hackerone.com is HSTS preloaded. When a domain is...

About the security content of tvOS 9.2.2

About the security content of tvOS 9.2.2 This document describes the security content of tvOS 9.2.2. About Apple security updates For our customers' protection, Apple doesn't disclose, discuss, or confirm security issues until an investigation has occurred and patches or releases are available...

Apple iOS NSURL Certificate Validation Vulnerability

Apple iOS is the latest operating system that runs on Apple's iPhone and iPod touch devices. Apple iOS has a certificate validation vulnerability in NSURL when the certificate is changed, allowing attackers in a privileged network location to intercept SSL/TLS links...

Apple iOS Security Mechanism Bypass Vulnerability

Apple iOS is the latest operating system that runs on Apple's iPhone and iPod touch devices. A security vulnerability exists in Apple iOS that allows a remote user in a privileged network location, configured with a local user, to accept untrusted credentials via the lock screen...

APPLE-SA-2015-08-13-2 OS X Yosemite v10.10.5 and Security Update 2015-006

APPLE-SA-2015-08-13-2 OS X Yosemite v10.10.5 and Security Update 2015-006 OS X Yosemite v10.10.5 and Security Update 2015-006 is now available and addresses the following: apache Available for: OS X Mavericks v10.9.5, OS X Yosemite v10.10 to v10.10.4 Impact: Multiple vulnerabilities existed in...

DSA-3029-1 nginx - security update

Bulletin has no description...

nginx < 1.6.1 / 1.7.4 SMTP STARTTLS Command Injection

The version of nginx installed on the remote host is 1.5.6 or higher, 1.6.x prior to 1.6.1, or 1.7.x prior to 1.7.4. It is, therefore, affected by a command injection vulnerability. A flaw exists in the function 'ngxmailsmtpstarttls' within the file 'src/mail/ngxmailsmtphandler.c' whereby input t...

APPLE-SA-2014-04-22-4 AirPort Base Station Firmware Update 7.7.3

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 APPLE-SA-2014-04-22-4 AirPort Base Station Firmware Update 7.7.3 AirPort Base Station Firmware Update 7.7.3 is now available and addresses the following: Available for: AirPort Extreme and AirPort Time Capsule base stations with 802.11ac Impact: An...

Apple iTunes < 11.1.4 Multiple Vulnerabilities (uncredentialed check)

The version of Apple iTunes on the remote host is prior to version 11.1.4. It is, therefore, affected by multiple vulnerabilities : - The included versions of the WebKit, libxml, and libxslt components in iTunes contain several errors that can lead to memory corruption and arbitrary code executio...

iTunes < 11.1.4 Tutorials Content Injection (Mac OS X)

The version of iTunes installed on the remote Mac OS X host is a version prior to 11.1.4. It is, therefore, affected by an error related to the iTunes Tutorials window that could allow an attacker in a privileged network location to inject content. C Tenable Network Security, Inc...

Apple iTunes < 11.1.4 Multiple Vulnerabilities (credentialed check)

The version of Apple iTunes installed on the remote Windows host is older than 11.1.4. It is, therefore, potentially affected by several issues : - The included versions of WebKit, libxml, and libxslt contain several errors that could lead to memory corruption and possibly arbitrary code executio...