PT-2025-50538

Name of the Vulnerable Software and Affected Versions Mobile application affected versions not specified Description A missing certificate validation allows an attacker positioned upstream to intercept and decrypt TLS traffic from the mobile application. This interception enables the attacker to...

EUVD-2017-9359

Malware in sbrugna...

CVE-2022-32906

This issue was addressed with using HTTPS when sending information over the network. This issue is fixed in Apple Music 3.9.10 for Android. A user in a privileged network position may intercept SSL/TLS connections...

CVE-2022-36173

FreshService macOS Agent 4.4.0 and FreshServce Linux Agent 3.4.0 are vulnerable to TLS Man-in-The-Middle via the FreshAgent client and scheduled update service...

Data exfiltration techniques

Data exfiltration is the last stage of the kill chain in a generally targeted attack on an organisation. Whilst many excellent papers and tools are available for various techniques this is our attempt to pull all these together. This could also be used as a crib sheet for fellow pen testers who a...

Information disclosure

TitanHQ WebTitan Gateway has incorrect certificate validation for the TLS interception feature...

CVE-2017-18227

TitanHQ WebTitan Gateway has incorrect certificate validation for the TLS interception feature...

CVE-2017-18227

TitanHQ WebTitan Gateway has incorrect certificate validation for the TLS interception feature...

CVE-2017-18227

TitanHQ WebTitan Gateway has an incorrect certificate validation in its TLS interception feature, as described by CVE-2017-18227. The vulnerability relates to improper certificate handling within the TLS interception functionality of WebTitan Gateway. Connected documents corroborate the issue, bu...

Android Private Internet Access Denial Of Service

Original post here: http://wwws.nightwatchcybersecurity.com/2017/10/25/advisory-pia-android-app-cve-2017-15882/ SUMMARY The Android application provided by Private Internet Access PIA VPN service can be crashed by downloading a large file containing a list of current VPN servers. This can be...

On Vulnerable iOS Apps, macOS Macros Malware, and More

Mike Mimoso and Chris Brook preview RSA 2017 and discuss the previous week’s news including the report on how a handful of iOS apps are vulnerable to interception attacks, macro malware coming to MacOS, a new Uber open source module. Show notes: Popular iOS Apps Vulnerable to TLS Interception...

Popular iOS Apps Vulnerable to TLS Interception Attacks

Dozens of iOS mobile banking, medical and other applications handling sensitive user information are vulnerable to man-in-the-middle attacks where TLS traffic can be intercepted. Of the 76 apps analyzed by Sudo Security Group, 19 are considered high-risk where financial or medical credentials, or...

Amazon Linux: Security Advisory (ALAS-2016-713)

The remote host is missing an update for the SPDX-FileCopyrightText: 2016 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

RedHat Update for squid34 RHSA-2016:1140-01

The remote host is missing an update for the SPDX-FileCopyrightText: 2016 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

squid security update

CentOS Errata and Security Advisory CESA-2016:1138 An update for squid is now available for Red Hat Enterprise Linux 6. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity...

Moderate: Red Hat Security Advisory: squid security update

An update for squid is now available for Red Hat Enterprise Linux 6. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the...

squid: multiple issues in ESI processing

Buffer overflow and input validation flaws were found in the way Squid processed ESI responses. If Squid was used as a reverse proxy, or for TLS/HTTPS interception, a remote attacker able to control ESI components on an HTTP server could use these flaws to crash Squid, disclose parts of the stack...

squid: SIGSEGV in ESIContext response handling

An incorrect reference counting flaw was found in the way Squid processes ESI responses. If Squid is configured as reverse-proxy, for TLS/HTTPS interception, an attacker controlling a server accessed by Squid, could crash the squid worker, causing a Denial of Service attack...

RHEL 6 : squid34 (RHSA-2016:1140)

The remote Redhat Enterprise Linux 6 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2016:1140 advisory. The squid34 packages provide version 3.4 of Squid, a high-performance proxy caching server for web clients, supporting FTP, Gopher, and HTTP...

Apple iOS Messages Message Disclosure Vulnerability

Apple iOS, OS X, and watchOS are all products of Apple Inc. Apple iOS is an operating system developed for mobile devices; watchOS is a smartwatch operating system; and Apple OS X is an Apple operating system. An information disclosure vulnerability exists in the implementation of Messages in iOS...