Yahoo Encryption Slammed for Lack of Forward Secrecy, HSTS

Yahoo, as promised, rolled out HTTPs by default this week for its email service, bringing it in line with other Internet companies that have been securing users’ communication for years. But if Yahoo expected applause from security experts, it can think again. The response from those well-versed ...

HTTP Strict Transport Security (HSTS) Detection

Display HTTP Strict Transport Security HSTS information about each system. This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'HTTP Strict Transport Security HSTS Detection', 'Description' = %q...

Mozilla Adding More Stringent HTTPS Enforcement to Firefox

Mozilla is adding an extra layer of security in its Firefox browser by implementing HTTP Strict Transport Security HSTS, a mechanism that will force some sites into establishing a secure, HTTPS connection with the browser if its presented with the right certificate. According to an entry on...

Google Chrome Secure Cookie Security Bypass Vulnerability - Windows

Google Chrome is prone to a security bypass vulnerability. SPDX-FileCopyrightText: 2011 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Google Chrome Secure Cookie Security Bypass Vulnerability - Mac OS X

Google Chrome is prone to a security bypass vulnerability. SPDX-FileCopyrightText: 2011 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

CVE-2008-7295

Microsoft Internet Explorer cannot properly restrict modifications to cookies established in HTTPS sessions, which allows man-in-the-middle attackers to overwrite or delete arbitrary cookies via a Set-Cookie header in an HTTP response, related to lack of the HTTP Strict Transport Security HSTS...

CVE-2008-7294

Google Chrome before 4.0.211.0 cannot properly restrict modifications to cookies established in HTTPS sessions, which allows man-in-the-middle attackers to overwrite or delete arbitrary cookies via a Set-Cookie header in an HTTP response, related to lack of the HTTP Strict Transport Security HSTS...

Design/Logic Flaw

Mozilla Firefox before 4 cannot properly restrict modifications to cookies established in HTTPS sessions, which allows man-in-the-middle attackers to overwrite or delete arbitrary cookies via a Set-Cookie header in an HTTP response, related to lack of the HTTP Strict Transport Security HSTS...

CVE-2008-7293

Mozilla Firefox before 4 cannot properly restrict modifications to cookies established in HTTPS sessions, which allows man-in-the-middle attackers to overwrite or delete arbitrary cookies via a Set-Cookie header in an HTTP response, related to lack of the HTTP Strict Transport Security HSTS...

CVE-2008-7294

Google Chrome before 4.0.211.0 cannot properly restrict modifications to cookies established in HTTPS sessions, which allows man-in-the-middle attackers to overwrite or delete arbitrary cookies via a Set-Cookie header in an HTTP response, related to lack of the HTTP Strict Transport Security HSTS...

CVE-2008-7296: Undefined Security Weakness

Apple Safari cannot properly restrict modifications to cookies established in HTTPS sessions, which allows man-in-the-middle attackers to overwrite or delete arbitrary cookies via a Set-Cookie header in an HTTP response, related to lack of the HTTP Strict Transport Security HSTS includeSubDomains...

To Combat Firesheep, Microsoft's Bing Looking Into SSL

Microsoft’s Bing is looking into SSL and other privacy settings for the next version of their search engine. Currently the site strips SSL when forced into HTTPS and in turn, brings up an advisory on browsers signaling an unsafe connection. Introduced at Toorcon, the Firefox extension allows...

Firefox 4 to Include HTTP Strict Transport Security Support

In an effort to help mitigate man-in-the-middle attacks that make normal HTTP connections look like secured HTTPS sessions, Mozilla is adding support in Firefox 4 for a new technology called HTTP Strict Transport Security that enables site operators to tell browsers to always request an HTTPS...

Design/Logic Flaw

Google Chrome before 4.1.249.1036 does not have the expected behavior for attempts to delete Web SQL Databases and clear the Strict Transport Security STS state, which has unspecified impact and attack vectors...

CVE-2010-1230

Google Chrome before 4.1.249.1036 does not have the expected behavior for attempts to delete Web SQL Databases and clear the Strict Transport Security STS state, which has unspecified impact and attack vectors...

CVE-2010-1230

CVE-2010-1230 affects Google Chrome prior to 4.1.249.1036. The issue concerns incorrect behavior when attempting to delete Web SQL Databases and clear STS state. The impact is described as unspecified; no exploit vectors are provided in the documents. Severity is CVSS v2 base score 10.0 (HIGH). N...

CVE-2010-1230: Exposure of Sensitive Information to an Unauthorized Actor

Google Chrome before 4.1.249.1036 does not have the expected behavior for attempts to delete Web SQL Databases and clear the Strict Transport Security STS state, which has unspecified impact and attack vectors...

Strict Transport Security (STS) Detection

The remote web server implements Strict Transport Security STS. The goal of STS is to make sure that a user does not accidentally downgrade the security of his or her browser. All unencrypted HTTP connections are redirected to HTTPS. The browser is expected to treat all cookies as 'secure' and to...

Non-compliant Strict Transport Security (STS)

The remote web server implements Strict Transport Security. However, it does not respect all the requirements of the STS draft standard. C Tenable Network Security, Inc. include"compat.inc"; if description scriptid42823; scriptversion"$Revision: 1.7 $"; scriptcvsdate"$Date: 2014/09/19 20:19:00 $"...