CloudFlare Deploys ChaCha20-Poly1305 Encryption Across Sites

After rolling out free SSL for its users last fall, CloudFlare has deployed a new level of encryption on its service that hardens and speeds up the user experience, especially when accessing domains via mobile browsers. The form of encryption, a relatively new transport layer cipher suite known a...

The Pirate Bay relaunch is FBI's Honeypot? Pirate Bay Team Responds,'NO WAY'

After almost two months of untimely and unexpected outage, The Pirate Bay TPB finally came back this weekend. But the re-launch of the infamous torrent-indexing website raised a question among those suspicious about this new setup — Is it really The Pirate Bay? A few days back we reported that Th...

CloudFlare Rolls Out Free SSL

In a move that will essentially double the number of SSL-protected sites on the Web in the space of 24 hours, CloudFlare on Monday said that it was enabling SSL for all of its more than two million customers for free. The new service is called Universal SSL, and the company is making it available...

Cloudflare: Apache mod_negotiation filename bruteforcing

Vulnerability description modnegotiation is an Apache module responsible for selecting the document that best matches the clients capabilities, from one of several available documents. If the client provides an invalid Accept header, the server will respond with a 406 Not Acceptable error...

Cloudflare: User can request for password reset link without giving his website, eventhough he have it

Hi, I found that , when a user ask for password reset at https://www.cloudflare.com/login He need to give his email address as well as one of the sites if he have . But your site is sending password reset link to the user who have added websites to his account , but not entering any one of the na...

Cloudflare: Potential XSS vulnerability to HTML minification

I have already reported it through email but I was advised to post it here. Original request: https://support.cloudflare.com/hc/requests/166005 The issue --------- The HTML minification function optimizes the HTML content without validating the HTML syntax. In particular circumstances this may le...

Dramatic Drop in Vulnerable NTP Servers Used in DDoS Attacks

While patching of webservers vulnerable to the Heartbleed OpenSSL bug may have stalled, the same cannot be said about repairs to NTP servers that could be leveraged in devastating amplification attacks. A spate of distributed denial-of-service attacks DDoS tore through companies in January and...

Largest DDoS Attack Hit Hong Kong Democracy Voting Website

Hackers and cyber attacks are getting evil and worst nightmare for companies day-by-day. Just last week a group of hackers ruined the code-hosting and software collaboration platform, ‘Code Spaces’ by destroying their Amazon cloud server, complete data and its backup files too. Recently, the...

Cloudflare: CSRF and No password requirement in this URL Billing Info

An attacker can launch requests on his victim's behalf on the billing info page. There is a requirement of CSRF token on this page https://www.cloudflare.com/billing-information Awaiting your reply...

Cloudflare: Password reset threshold not set

Your web application https://www.cloudflare.com does not have a password reset threshold set. this means that your client and users account can be flooded with password reset emails which can result in spam to the mailer's inbox. You should implement a threshold to prevent this attack...

Cloudflare: Bug Report

Vulnerability description modnegotiation is an Apache module responsible for selecting the document that best matches the clients capabilities, from one of several available documents. If the client provides an invalid Accept header, the server will respond with a 406 Not Acceptable error...

Cloudflare: User's data leak

Hacker can steal user's data via js callbacks via JSONP. In account panel some user's data returned from server by ajax queries in json and can be stealed by callbacks, https://www.cloudflare.com/ajax/stats/stats2.html?callback=logFunction Vector: 1 Victim should be authorized on cloudflare 2...

Cloudflare: Threat control information leak

The information displayed on the threat control page is retrieved using AJAX calls to the API, however the access token atok which is sent along with the requests is not checked by the receiving end. In addition, a callback function name can be supplied to the API. Combined, these factors allow a...

Cloudflare: Security issue with your "bag" script

This is an old issue that has been fixed, but in since I reported it before you started your Bug Bounty program I was advised to report it here again. These are the requests in your issue tracker: http://support.cloudflare.com/tickets/44767 original vulnerability report...

Cloudflare: Cookie missing the Secure flag

Cookie cfduid missing the Secure flag Summary: The Secure flag was missing on the cookie: This may allow the cookie to be transferred over an insecure channel. .the cookies are cfduid cfeffload cfeffload...

Cloudflare: Flash-based XSS in cdnjs.cloudflare.com subdomain

Hi, There's a Flash-based XSS on cdnjs.cloudflare.com. Proof-of-Concept: 1.Click on the link: https://cdnjs.cloudflare.com/ajax/libs/zeroclipboard/1.0.8/ZeroClipboard.swf?id=%22catcheif!self.aself.a=!alertdocument.domain//&width&height 2.You shall see a Javascript alertfunction executing in...

Cloudflare: System Status Update CSRF

The atok token can be any oold used token it works very well...

Cloudflare: XSS - http://js.cloudflare.com

Hi. I want to report to you a Reflected XSScross site scripting vulnerability that I found in Cloudflare web-application and in a considerable percent can affect the safety of the users . Generally, an "attacker" can use XSS to send a malicious script to an unsuspecting user. The end user's brows...

Cloudflare: Apache Multiviews are enabled

You have enabled Apache Multiviews on your server that pose a potential risk. Turn this feature off...

Cloudflare: csrf on password change functionality

It was observed that the web application ‘www.cloudflare.com’ is vulnerable to cross site request forgery attacks via FORM field reconstruction. Risk : An attacker could force an already authenticated user to perform actions that he or she didn’t intend to do, such as account creation, Updating...