X (Formerly Twitter): Incorrect param parsing in Digits web authentication

Hi, I would like to report an issue on Digits web authentication which allows attackers to retrieve the OAuth credential data of an application victims authorized. Detail Digits web authentication has strict validation on host and callbackurl. On the server side, the values are compared with the...

Symantec Domain-Validation Certificate Incorrect Character Handling Vulnerability

Symantec Domain-Validation Certificates are a set of certificates that provide encryption and authentication capabilities over SSL/TLS. Symantec DV Certificates do not properly handle specific characters in email addresses, allowing remote attackers to obtain legitimate DV SSL/TLS certificates wi...

Updated squid packages fix CVE-2015-3455

Updated squid packages fix security vulnerability: Squid configured with client-first SSL-bump does not correctly validate X509 server certificate domain / hostname fields CVE-2015-3455...

WePay: oauth redirect uri validation bug leads to open redirect and account compromise

according to: https://stage.wepay.com/developer/reference/oauth2 "redirecturi - The uri the user will be redirected to after authorization. Must have the same domain as the application." your current validation of this domain value is not sufficient. i setup my app with a website url of...

Two more Comodo registration authority accounts compromised !

Two more Comodo registration authority accounts compromised ! Certification company's humiliation drags on as hacker scalps two more Comodo registration authority accounts The Iranian hacker that managed to trick Comodo into issuing nine fraudulent certificates appears to have compromised two mor...

PT-2010-3462

Name of the Vulnerable Software and Affected Versions Apple Mac OS X versions 10.6.x through 10.6.4 Description The issue concerns the improper validation of cookie domains by CFNetwork, making it easier for remote web servers to track users by setting a cookie associated with a partial IP addres...

Mozilla NSS - NULL Character CA SSL Certificate Validation Security Bypass

source: https://www.securityfocus.com/bid/35888/info Mozilla Network Security Services NSS is prone to a security-bypass vulnerability because it fails to properly validate the domain name in a signed CA certificate, allowing attackers to substitute malicious SSL certificates for trusted ones. Th...

Firefox SSL Server Spoofing Vulnerability (Windows)

The host is installed with Mozilla Firefox browser and is prone to SSL server spoofing vulnerability. OpenVAS Vulnerability Test $Id: gbfirefoxsslspoofvulnwin.nasl 6530 2017-07-05 06:23:50Z cfischer $ Firefox SSL Server Spoofing Vulnerability Windows Authors: Nikita MR Copyright: Copyright c 2009...