Missing 'Cache-Control' Header

The HTTP 'Cache-Control' header is used to specify directives for caching mechanisms. The server did not return or returned an invalid 'Cache-Control' header which means page containing sensitive information password, credit card, personal data, social security number, etc could be stored on clie...

Mozilla: Errors in the handling of CORS preflight request headers (MFSA 2015-111)

Mozilla Firefox before 41.0 and Firefox ESR 38.x before 38.3 allow remote attackers to bypass CORS preflight protection mechanisms by leveraging 1 duplicate cache-key generation or 2 retrieval of a value from an incorrect HTTP Access-Control- response header...

CVE-2015-4520: Undefined Security Weakness

Mozilla Firefox before 41.0 and Firefox ESR 38.x before 38.3 allow remote attackers to bypass CORS preflight protection mechanisms by leveraging 1 duplicate cache-key generation or 2 retrieval of a value from an incorrect HTTP Access-Control- response header...

PT-2015-2178

Name of the Vulnerable Software and Affected Versions Mozilla Firefox versions prior to 41.0 Firefox ESR versions 38.x prior to 38.3 Description The issue is related to errors in security settings, allowing a remote attacker to bypass CORS protection mechanisms. This can be achieved by either...

CVE-2014-1418

Django 1.4 before 1.4.13, 1.5 before 1.5.8, 1.6 before 1.6.5, and 1.7 before 1.7b4 does not properly include the 1 Vary: Cookie or 2 Cache-Control header in responses, which allows remote attackers to obtain sensitive information or poison the cache via a request from certain browsers...

DEBIAN-CVE-2014-1418

Django 1.4 before 1.4.13, 1.5 before 1.5.8, 1.6 before 1.6.5, and 1.7 before 1.7b4 does not properly include the 1 Vary: Cookie or 2 Cache-Control header in responses, which allows remote attackers to obtain sensitive information or poison the cache via a request from certain browsers...

PYSEC-2014-19

Django 1.4 before 1.4.13, 1.5 before 1.5.8, 1.6 before 1.6.5, and 1.7 before 1.7b4 does not properly include the 1 Vary: Cookie or 2 Cache-Control header in responses, which allows remote attackers to obtain sensitive information or poison the cache via a request from certain browsers...

CVE-2014-1418: Undefined Security Weakness

Django 1.4 before 1.4.13, 1.5 before 1.5.8, 1.6 before 1.6.5, and 1.7 before 1.7b4 does not properly include the 1 Vary: Cookie or 2 Cache-Control header in responses, which allows remote attackers to obtain sensitive information or poison the cache via a request from certain browsers...

UBUNTU-CVE-2014-1418

Django 1.4 before 1.4.13, 1.5 before 1.5.8, 1.6 before 1.6.5, and 1.7 before 1.7b4 does not properly include the 1 Vary: Cookie or 2 Cache-Control header in responses, which allows remote attackers to obtain sensitive information or poison the cache via a request from certain browsers...

PT-2020-7503

Name of the Vulnerable Software and Affected Versions: MediaWiki CentralNotice extension versions 1.19.x through 1.19.8 MediaWiki CentralNotice extension versions 1.20.x through 1.20.7 MediaWiki CentralNotice extension versions 1.21.x through 1.21.2 Description: The issue allows remote attackers ...

Fingerprinting the author of the ZeuS Botnet !

The source code of the ZeuS Botnet is now available for Download. Derek Jones the author this article imagine there are a few organizations who would like to talk to the authors of this code. All developers have coding habits, that is they usually have a particular way of writing each coding...

Cross site request forgery (csrf)

Polipo 1.0.4, and possibly other versions, allows remote attackers to cause a denial of service crash via a request with a Cache-Control header that lacks a value for the max-age field, which triggers a segmentation fault in the httpParseHeaders function in httpparse.c, and possibly other...

httpd mod_cache segfault

cacheutil.c in the modcache module in Apache HTTP Server httpd, when caching is enabled and a threaded Multi-Processing Module MPM is used, allows remote attackers to cause a denial of service child processing handler crash via a request with the 1 s-maxage, 2 max-age, 3 min-fresh, or 4 max-stale...