CVE-2017-15698

CVE-2017-15698 affects the Apache Tomcat Native Connector (tomcat-native library). It arises from improper handling of AIA-Extension fields longer than 127 bytes, causing the OCSP check to be skipped and potentially allowing invalid client certificates to be accepted. Confirmed fixes appear in up...

CVE-2017-15698

When parsing the AIA-Extension field of a client certificate, Apache Tomcat Native Connector 1.2.0 to 1.2.14 and 1.1.23 to 1.1.34 did not correctly handle fields longer than 127 bytes. The result of the parsing error was to skip the OCSP check. It was therefore possible for client certificates th...

Fixed in Apache Tomcat Native Connector 1.2.16

Note: The issue below was fixed in Apache Tomcat Native Connector 1.2.15 but the release vote for the 1.2.15 release candidate did not pass. Therefore, although users must download 1.2.16 to obtain a version that includes the fix for this issue, version 1.2.15 is not included in the list of...

careers.aia.com XSS vulnerability

Vulnerable URL: https://careers.aia.com/talentcommunity/subscribe/?slp=/talentcommunity/profile/%27-prompt%28%27OPENBUGBOUNTY%27%29-%27 Details: Description| Value ---|--- Patched:| Yes, at 18.08.2016 Latest check for patch:| 18.08.2016 11:05 GMT Vulnerability type:| XSS Vulnerability status:|...

aia-financial.co.id XSS vulnerability

Vulnerable URL: http://www.aia-financial.co.id/id/search.html?searchExecutor=%2Fid%2Fsearch=123=%22%3E%3Cimg%20src=x%20onerror=prompt/OPENBUGBOUNTY/%3E Details: Description| Value ---|--- Patched:| No Latest check for patch:| 30.07.2017 Vulnerability type:| XSS Vulnerability status:| Publicly...

direct.aia.co.th XSS vulnerability

Vulnerable URL: https://direct.aia.co.th/btoc/Product/LeadForm/form.jsp?productID=%22%3E%3Cscript%3Ealert%28%27OPENBUGBOUNTY%27%29%3C/script%3E Details: Description| Value ---|--- Patched:| No Latest check for patch:| 26.07.2017 Vulnerability type:| XSS Vulnerability status:| Publicly disclosed...

CVE-2013-3905

CVE-2013-3905 affects Microsoft Outlook components on Windows: Outlook 2007 SP3, 2010 SP1/SP2, 2013, and 2013 RT. The flaw is in how S/MIME certificate metadata is expanded, allowing remote attackers to obtain sensitive network configuration and state information by presenting a crafted S/MIME ce...

Unauthorized reading confirmation from Outlook

I've just got an interesting idea about how a malicious e-mail sender could try to get a unseen by the recipient reading confirmation, including the IP address of the recipient. I was working on S/MIME messages and I thought about the signature validation process, where some of the steps could...