UBUNTU-CVE-2020-12412

By navigating a tab using the history API, an attacker could cause the address bar to display the incorrect domain with the https:// scheme, a blocked port number such as '1', and without a lock icon while controlling the page contents. This vulnerability affects Firefox 70...

CVE-2020-12412: Undefined Security Weakness

By navigating a tab using the history API, an attacker could cause the address bar to display the incorrect domain with the https:// scheme, a blocked port number such as '1', and without a lock icon while controlling the page contents. This vulnerability affects Firefox 70...

ClearPass Policy Manager Unauthenticated Remote Command Execution Exploit

!/usr/bin/env bash ClearPass Policy Manager Unauthenticated Remote Command Execution in the WebUI CVE-2020-7115 For best results use OpenSSL/libcrypto shipped with RHEL/CentOS 7.x. Questions? Contact email protected. if "$" -ne 4 ; then echo "Usage: basename $0 remote host remote port local host...

Exploit for Path Traversal in F5 Big-Ip_Access_Policy_Manager

PoC for CVE-2020-5902 this just sample PoC to...

Man-in-the-middle (MitM)

github.com/containous/traefik is vulnerable to man-in-the-middle attack. It does not establish a mutual TLS verification for HTTPS sessions when the error ERRBADSSLCLIENTAUTHCERT occurs...

CVE-2019-20894

Traefik 2.x, in certain configurations, allows HTTPS sessions to proceed without mutual TLS verification in a situation where ERRBADSSLCLIENTAUTHCERT should have occurred...

CVE-2019-20894

Traefik 2.x, in certain configurations, allows HTTPS sessions to proceed without mutual TLS verification in a situation where ERRBADSSLCLIENTAUTHCERT should have occurred...

Design/Logic Flaw

Traefik 2.x, in certain configurations, allows HTTPS sessions to proceed without mutual TLS verification in a situation where ERRBADSSLCLIENTAUTHCERT should have occurred...

CVE-2019-20894

Traefik 2.x, in certain configurations, allows HTTPS sessions to proceed without mutual TLS verification in a situation where ERRBADSSLCLIENTAUTHCERT should have occurred...

CVE-2019-20894

Traefik 2.x, in certain configurations, allows HTTPS sessions to proceed without mutual TLS verification in a situation where ERRBADSSLCLIENTAUTHCERT should have occurred...

CVE-2019-20894

CVE-2019-20894 : Traefik 2.x can allow HTTPS sessions to proceed without mutual TLS verification in certain configurations, where an ERR_BAD_SSL_CLIENT_AUTH_CERT would be expected. This describes a gap in mutual TLS authentication that could expose confidentiality to a man-in-the-middle. The prov...

CVE-2020-15502

The DuckDuckGo application through 5.58.0 for Android, and through 7.47.1.0 for iOS, sends hostnames of visited web sites within HTTPS .ico requests to servers in the duckduckgo.com domain, which might make visit data available temporarily at a Potentially Unwanted Endpoint. NOTE: the vendor has...

CVE-2020-15502

The DuckDuckGo application through 5.58.0 for Android, and through 7.47.1.0 for iOS, sends hostnames of visited web sites within HTTPS .ico requests to servers in the duckduckgo.com domain, which might make visit data available temporarily at a Potentially Unwanted Endpoint. NOTE: the vendor has...

Code injection

The DuckDuckGo application through 5.58.0 for Android, and through 7.47.1.0 for iOS, sends hostnames of visited web sites within HTTPS .ico requests to servers in the duckduckgo.com domain, which might make visit data available temporarily at a Potentially Unwanted Endpoint. NOTE: the vendor has...

CVE-2020-15502

The DuckDuckGo application through 5.58.0 for Android, and through 7.47.1.0 for iOS, sends hostnames of visited web sites within HTTPS .ico requests to servers in the duckduckgo.com domain, which might make visit data available temporarily at a Potentially Unwanted Endpoint. NOTE: the vendor has...

CVE-2020-15502

The CVE-2020-15502 entry describes an information disclosure in the DuckDuckGo mobile apps: versions 5.58.0 for Android and 7.47.1.0 for iOS send hostnames of visited sites inside HTTPS .ico requests to duckduckgo.com, potentially exposing visit data to a Potentially Unwanted Endpoint. The core i...

CVE-2019-20894: Improper Certificate Validation

Traefik 2.x, in certain configurations, allows HTTPS sessions to proceed without mutual TLS verification in a situation where ERRBADSSLCLIENTAUTHCERT should have occurred...

CVE-2020-15502: Exposure of Sensitive Information to an Unauthorized Actor

The DuckDuckGo application through 5.58.0 for Android, and through 7.47.1.0 for iOS, sends hostnames of visited web sites within HTTPS .ico requests to servers in the duckduckgo.com domain, which might make visit data available temporarily at a Potentially Unwanted Endpoint. NOTE: the vendor has...

Man-in-the-Middle (MitM)

fastdfs-client is vulnerable to man-in-the-middle MitM. The vulnerability is possible because it does not use a secure channel HTTPS to download dependencies in Maven Build, allowing an MitM to intercept the channel to inject malicious code into the library to infect the builds being produced...

CVE-2020-14058

An issue was discovered in Squid before 4.12 and 5.x before 5.0.3. Due to use of a potentially dangerous function, Squid and the default certificate validation helper are vulnerable to a Denial of Service when opening a TLS connection to an attacker-controlled server for HTTPS. This occurs becaus...