Windows Meterpreter (Reflective Injection x64), Windows x64 Reverse HTTPS Stager (winhttp)

Inject the meterpreter server DLL via the Reflective Dll Injection payload staged. Requires Windows XP SP2 or newer. Tunnel communication over HTTPS Windows x64 winhttp This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework...

[USN-2591-1] curl vulnerabilities

========================================================================== Ubuntu Security Notice USN-2591-1 April 30, 2015 curl vulnerabilities ========================================================================== A security issue affects these releases of Ubuntu and its derivatives: - Ubun...

hispanic-jobs.com XSS vulnerability

Vulnerable URL: http://www.hispanic-jobs.com/search.php?search=%3E%3C/title%3E%27%22%3E%3Cmarquee%3E%3Ch1%3Etest%3C/%20h1%3E%3C/marquee%3ESCRIPT%3E%22%3E%27%3E%3CSCRIPT%3Ealert%28/XSSPOSED/%29%3C/SCRIPT%3E Details: Description| Value ---|--- Patched:| Yes, at 22.08.2017 Latest check for patch:|...

Mozilla Moving Toward Full HTTPS Enforcement in Firefox

The Mozilla Foundation is initiating the process to phase out insecure HTTP connections in the Firefox browser. The decision is part of a broader movement to encrypt the Web, which in the case of Mozilla Firefox, means permitting only encrypted HTTPS browser connections. Mozilla is the developer ...

USN-2591-1: curl vulnerabilities

Paras Sethia discovered that curl could incorrectly re-use NTLM HTTP credentials when subsequently connecting to the same host over HTTP. CVE-2015-3143 Hanno Böck discovered that curl incorrectly handled zero-length host names. If a user or automated system were tricked into using a specially...

[SECURITY] [DSA 3240-1] curl security update

------------------------------------------------------------------------- Debian Security Advisory DSA-3240-1 [email protected] http://www.debian.org/security/ Alessandro Ghedini April 29, 2015 http://www.debian.org/security/faq -...

Google Releases Password Alert Extension for Chrome

Google is rolling out a new extension for Chrome that will monitor users’ logins and warn them if they enter a Google password on a non-Google page, a move designed to help protect users against phishing attacks. The new extension, called Password Alert, works for both consumer accounts and Googl...

Debian Security Advisory DSA 3240-1 (curl - security update)

It was discovered that cURL, an URL transfer library, if configured to use a proxy server with the HTTPS protocol, by default could send to the proxy the same HTTP headers it sends to the destination server, possibly leaking sensitive information. OpenVAS Vulnerability Test $Id: deb3240.nasl 6609...

PT-2015-6080

Name of the Vulnerable Software and Affected Versions libcurl versions prior to 7.42.1 Description The issue arises from the default configuration of libcurl, where custom HTTP headers are sent to both the proxy and destination server. This might allow remote proxy servers to obtain sensitive...

DSA-3240-1 curl - security update

Bulletin has no description...

(Mobile Pwn2Own) Amazon App Store HTTPS Downgrade Vulnerability

This vulnerability allows remote attackers to transmit unencrypted traffic on the Amazon App Store. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. All the HTML content within the Amazon App Store is transmitted...

Vulnerabilities in the Debian GNU/Linux operating system that allow a remote attacker to compromise the confidentiality, integrity, and accessibility of protected information

The multiple vulnerabilities in the apt-transport-https package of the Debian GNU/Linux operating system may lead to breaches of the confidentiality, integrity, and accessibility of protected information. These vulnerabilities can be exploited remotely...

[SECURITY] Fedora 22 Update: curl-7.40.0-3.fc22

curl is a command line tool for transferring data with URL syntax, supporti ng FTP, FTPS, HTTP, HTTPS, SCP, SFTP, TFTP, TELNET, DICT, LDAP, LDAPS, FILE, I MAP, SMTP, POP3 and RTSP. curl supports SSL certificates, HTTP POST, HTTP PUT, FTP uploading, HTTP form based upload, proxies, cookies,...

Critical SSL Vulnerability Leaves 25,000 iOS Apps Vulnerable to Hackers

A critical vulnerability resides in AFNetworking could allow an attacker to cripple the HTTPS protection of 25,000 iOS apps available in Apple's App Store via man-in-the-middle MITM attacks. AFNetworking is a popular open-source code library that lets developers drop networking capabilities into...

NetNanny Found Using Shared Private Key, Root CA

An issue with the content-control software NetNanny could open users’ systems up to man-in-the-middle MiTM attacks, HTTPS spoofing and intercept, researchers warned Monday. First released in 1995, the internet filtering service is primarily used by parents to control their children’s online...

How to Disable Mixed Content Security Warning in Google Chrome

If you are really upset with Chrome browsers warnings that your HTTPS enabled website contains unsecured third-party contents that sometimes force your users to close the tab, Google has solved this problem for you. With the release of the next version of Google's popular browser, Chrome 43, it m...

NetNanny uses a shared private key and root CA

Overview NetNanny uses a shared private key and root Certificate Authority CA, making systems broadly vulnerable to HTTPS spoofing. Description NetNanny installs a Man-in-the-Middle MITM proxy as well as a new trusted root CA certificate. The certificate used by NetNanny is shared among all...

Google Moving Its Ad Services to Fully Encrypted Platform

Encryption is one of the major steps to be taken by every big technology giant in order to protect its users over the Internet, and, among those, Google has set an admirable example by gradually moving all of its online services to use strong HTTPS encryption. So far, Google encrypted email by...

CVE-2015-1247

Removed by vendor...

Is this vulnerability? The researchers accused the world's largest Dating site Match login pages not using HTTPS-bug warning-the black bar safety net

! American researcher Scott Bryner pointed out, the world's largest Dating website, Match. com login page don't for any reason by HTTPS jump for HTTP, which means that the transmission of user passwords not protected by encryption, and this problem has been there for weeks and no one attention...