Insecure Cookies

noVNC did not provide support for secure cookies in an HTTPS session. This causes browsers to send session cookies in an insecure HTTP channel. An attacker who is able to intercept traffic will be able to capture cookie information and access the application on behalf of the user...

Privilege Escalation

cfme is vulnerable to privilege escalation attacks. The vulnerability exists as Red Hat CloudForms 3.1 Management Engine CFME before 5.3 allows remote authenticated users to access sensitive controllers and actions via a direct HTTP or HTTPS request...

Man-in-the-Middle (MitM)

rubygems is vulnerable to man-in-the-middle attack MitM. HTTPS connection are redirected to HTTP, which allows for an attacker to sniff network traffic and obtain confidential information or modify a gem during installation...

CVE-2017-2411

In iOS before 11.2, exchange rates were retrieved from HTTP rather than HTTPS. This was addressed by enabling HTTPS for exchange rates...

Design/Logic Flaw

In iOS before 11.2, exchange rates were retrieved from HTTP rather than HTTPS. This was addressed by enabling HTTPS for exchange rates...

CVE-2017-2411

The CVE-2017-2411 entry describes an issue in iOS prior to 11.2 where exchange rates were fetched over HTTP instead of HTTPS. Apple’s security content (iOS 11.2) documents this under the Calculator entry, noting that an attacker on a privileged network could alter currency conversion rates. The r...

CVE-2017-2411

In iOS before 11.2, exchange rates were retrieved from HTTP rather than HTTPS. This was addressed by enabling HTTPS for exchange rates...

Apache 2.4.x < 2.4.26 Multiple Vulnerabilities

According to its banner, the version of Apache running on the remote host is 2.4.x prior to 2.4.26. It is, therefore, affected by the following vulnerabilities : - An authentication bypass vulnerability exists due to third-party modules using the apgetbasicauthpw function outside of the...

Aegir HTTPS - Moderately critical - Access bypass - SA-CONTRIB-2019-003

Aegir is a Web hosting control panel program that provides a Drupal-based graphical interface designed to simplify deploying, managing and upgrading an entire network of Drupal, Wordpress and CiviCRM Web sites. The Hosting HTTPS module is a commonly used piece of the Aegir platform. This module...

mkcert: valid HTTPS certificates for localhost

or for any other name The web is moving to HTTPS, preventing network attackers from observing or injecting page contents. But HTTPS needs TLS certificates, and while deployment is increasingly a solved issue thanks to the ACME protocol and Lets Encrypt, development still mostly ends up happening...

mkcert: valid HTTPS certificates for localhost

or for any other names The web is moving to HTTPS, preventing network attackers from observing or injecting page contents. But HTTPS needs TLS certificates, and while deployment is increasingly a solved issue thanks to the ACME protocol and Let's Encrypt, development still mostly ends up happenin...

WAS Target Scanning for PCI

This plugin reports http addresses for http and https pages of a scanned system. C Tenable Network Security, Inc. include'compat.inc'; if description scriptid109394; scriptversion"1.3"; scriptsetattributeattribute:"pluginmodificationdate", value:"2022/05/24"; scriptnameenglish:"WAS Target Scannin...

SUSE SLED15 / SLES15 Security Update : clamav (SUSE-SU-2018:2230-1)

This update for clamav to version 0.100.1 fixes the following issues: The following security vulnerabilities were addressed : - CVE-2018-0360: HWP integer overflow, infinite loop vulnerability bsc1101410 - CVE-2018-0361: PDF object length check, unreasonably long time to parse relatively small fi...

New Kickass Torrents Site: List of New 2024 Proxies and Alternatives

Kickass Torrents KAT cr was once a hugely popular online portal, renowned for its vast archive of movies, music, TV shows, and other media. It was a treasure trove for those seeking rare content and for users looking to share their creations. However, Kickass Torrents faced significant opposition...

CVE-2018-15465

A vulnerability in the authorization subsystem of Cisco Adaptive Security Appliance ASA Software could allow an authenticated, but unprivileged levels 0 and 1, remote attacker to perform privileged actions by using the web management interface. The vulnerability is due to improper validation of...

CVE-2018-15465 Cisco Adaptive Security Appliance Software Privilege Escalation Vulnerability

A vulnerability in the authorization subsystem of Cisco Adaptive Security Appliance ASA Software could allow an authenticated, but unprivileged levels 0 and 1, remote attacker to perform privileged actions by using the web management interface. The vulnerability is due to improper validation of...

CVE-2018-15465 Cisco Adaptive Security Appliance Software Privilege Escalation Vulnerability

A vulnerability in the authorization subsystem of Cisco Adaptive Security Appliance ASA Software could allow an authenticated, but unprivileged levels 0 and 1, remote attacker to perform privileged actions by using the web management interface. The vulnerability is due to improper validation of...

CVE-2018-15465

CVE-2018-15465 affects Cisco ASA software, where the authorization subsystem fails to properly validate user privileges in the web management interface. An authenticated but unprivileged user (levels 0/1) can issue specific HTTPS requests to perform privileged actions, potentially exposing sensit...

Cisco Adaptive Security Appliance Software Privilege Escalation Vulnerability

A vulnerability in the authorization subsystem of Cisco Adaptive Security Appliance ASA Software could allow an authenticated, but unprivileged levels 0 and 1, remote attacker to perform privileged actions by using the web management interface. The vulnerability is due to improper validation of...

Kaspersky: Web protection component in Anti-Virus products family ignores HSTS security policy

Summary Kaspersky Internet Security seems to ignore the Strict-Transport-Security HTTP header. This allows Man-in-the-Middle attacks on websites that would normally be immune to them. The only requirement is the user confirming the certificate override, something that can be achieved by social...