Weblate: hosted.weblate.org: X-XSS-Protection not enabled

Hi, X-Xss-Protection @https://hosted.weblate.org/ has not been set. This header is used to configure the built in reflective XSS protection found in Internet Explorer, Chrome and Safari Webkit. Valid settings for the header are 0, which disables the protection, 1 which enables the protection and ...

Phusion Passenger Elevation of Privilege Vulnerability

Phusion Passenger is an Apache module for deploying Ruby on Rails projects on Apache and Nginx web servers from Phusion Netherlands. An elevation of privilege vulnerability exists in versions of Phusion Passenger prior to 5.1.0. A local attacker can exploit this vulnerability to gain privileges...

Homebrew: Sensitive information disclosure via response headers on jenkins.brew.sh

While logging into jenkins.brew.sh site, the vulnerable nginx version is disclosed via response headers. There is a chance with known vulnerabilities this could be compromised. so better to avoid banner disclosure with "Server Tokens Prod off" modification in conf file. Please let me know if any...

DEBIAN-CVE-2016-10345

In Phusion Passenger before 5.1.0, a known /tmp filename was used during passenger-install-nginx-module execution, which could allow local attackers to gain the privileges of the passenger user...

UBUNTU-CVE-2016-10345

In Phusion Passenger before 5.1.0, a known /tmp filename was used during passenger-install-nginx-module execution, which could allow local attackers to gain the privileges of the passenger user...

Homebrew: Server version disclosure on [jenkins.brew.sh]

Hello Homebrew security team, I know this is a low severity issue but I thought to get you in notice will be best. The site jenkins.brew.sh discloses the Nginx server version. Impact The information is can be used by attacker for further finding of exploits and information gathering. curl -i...

Evilginx - MITM Attack Framework [Advanced Phishing With Two-factor Authentication Bypass]

Evilginx is a man-in-the-middle attack framework used for phishing credentials and session cookies of any web service. It's core runs on Nginx HTTP server, which utilizes proxypass and subfilter to proxy and modify HTTP content, while intercepting traffic between client and server. You can learn...

Kong and Wallarm Partner Up to Boost Microservices API Security

Wallarm has partnered with Mashape to provide the microservices community with API security. Mashape enterprise customers who use Kong API gateway can now quickly add API security protection without change in Kong user’s deployment. Read more about Kong and Wallarm partnership in this blog. Today...

Wallarm Teams up with NGINX Plus to Provide Advanced Security

Wallarm is excited to be a pioneer security vendor in NGINX Certified Module program and provide trusted and verified security functionality to NGINX Plus customers. “We are pleased to announce that Wallarm is now part of the NGINX Plus Certified Module program with the Wallarm Next Generation WA...

New Relic: SSL Padding Oracle On Downgraded Legacy Encryption (POODLE) Vulnerability

Hi, I get in touch to report that cloud.newrelic.com is vulnerable to CVE-2014-3566 POODLE. Websites that support SSLv3 and CBC-mode ciphers are potentially vulnerable to an active MITM Man-in-the-middle attack. This attack, called POODLE, is similar to the BEAST attack and also allows a network...

Farmer's Fridge Kiosk 2.0.0 Information Disclosure

Farmer's Fridge Kiosk 2.0.0 Unprotected Event Log Information Disclosure Vendor: Farmer's Fridge Product web page: http://www.farmersfridge.com Affected version: 2.0.0 Summary: Donat think of the Farmeras Fridge kiosk as a vending machine. Itas a veggie machine. And just as each salad is a culina...

FalconGate - A smart gateway to stop hackers and Malware attacks

A smart gateway to stop hackers, Malware and more... Motivation Cyber attacks are on the raise. Hacker and cyber criminals are continuously improving their methods and building new tools and Malware with the purpose of hacking your network, spying on you and stealing valuable data. Recently a new...

How to protect web applications on Google Cloud Platform with WAF?

Many of the developers we speak to are interested in taking advantage of Google Compute Cloud for developing and hosting their web applications. The advantages are many from reasonable costs to built in scalability to high level of availability built right into the platform. However, the develope...

Personalized User Focused Security: Stethoscope

Stethoscope is a web application that collects information from existing device data sources e.g., JAMF or LANDESK on a given user’s devices and gives them clear and specific recommendations for securing their systems. Stethoscope consists of two primary pieces: a Python-based back-end and a...

Airbnb: Nginx Version Disclosure

Hello, While i was testing airbnb i found nginx version disclosure in HTTP Response. Which can help attacker to gain information or an attacker might use the disclosed information to harvest specific security vulnerabilities for the version identified. URL: https://www.airbnb.com/ Version: 1.7.12...

WTServer 17.02 DLL Hijacking

Title: WTServer-17.02 - DLL Loading Arbitrary Code Execution + Credits / Discovery: Nassim Asrir + Author Email: [email protected] + Author Company: Henceforth Vendor: =============== http://wtserver.wtriple.com/ Download: ===========...

Ubiquiti Inc.: Content Spoofing or Text Injection in (403 forbidden page injection) and Nginx version disclosure via response header

Hello there, I know that this is Non-critical issue but i want you guys to be aware of it. 1. I have found a Content Spoofing or Text Injection in This url http://dl-origin.ubnt.com/ Go to this url...

openSUSE Security Update : nginx (openSUSE-2017-192)

This update for nginx fixes the following vulnerability : - CVE-2016-4450: Remote attackers could have caused a denial of service NULL pointer dereference and worker process crash via a crafted request, involving writing a client request body to a temporary file. %NASLMINLEVEL 70300 C Tenable...

OPENSUSE-SU-2017:0361-1 Security update for nginx

This update for nginx fixes the following vulnerability: - CVE-2016-4450: Remote attackers could have caused a denial of service NULL pointer dereference and worker process crash via a crafted request, involving writing a client request body to a temporary file...

OPENSUSE-SU-2017:0362-1 Security update for nginx

This update for nginx fixes the following vulnerability: - CVE-2016-4450: Remote attackers could have caused a denial of service NULL pointer dereference and worker process crash via a crafted request, involving writing a client request body to a temporary file...