886 matches found
Majority of Sites Fail Mozilla's Comprehensive Security Review
A majority of the top 1 million websites earn an “F” letter grade when it comes to adopting defensive security technology that protect visitors from XSS vulnerabilities, man-in-the-middle attacks, and cookie hijacking. The failing grades come from a comprehensive analysis published this week by t...
OSRAM SYLVANIA Osram Lightify Home Man-in-the-Middle Attack Vulnerability
OSRAM SYLVANIA Osram Lightify Home is a set of open IoT platforms for automated control of lighting devices from OSRAM Germany. OSRAM SYLVANIA Osram Lightify Home A security vulnerability exists in versions 2016-07-26 and earlier, which stems from the program's failure to use SSL pinning.An...
Starbucks: Full Api Access and Run All Functions via Starbucks App
The tested application is Starbucks Turkey Android App. https://play.google.com/store/apps/details?id=com.starbucks.tr&hl=en All these things are made without any login. I did not login the app. 1. I tried to intercept traffic between starbucks app and server with burp suite. I could not be...
Hyundai Patches Leaky Blue Link Mobile App
Hyundai Motor America has patched a vulnerability in its Blue Link mobile application that exposed personal and vehicle information to an attacker. Updated versions of the app 3.9.6 were released to Google Play and the Apple App Store on March 8, a little more than one month after Rapid7 learned...
Starscream 2.0.3 SSL Pinning Bypass Vulnerability
WebSocket.swift in Starscream versions 2.0.3 and below allows an SSL Pinning bypass because of incorrect management of the certValidated variable it can be set to true but cannot be set to false. An attacker can achieve traffic interception from a man-in-the-middle position, first by resetting th...
CVE-2016-5052
OSRAM SYLVANIA Osram Lightify Home through 2016-07-26 does not use SSL pinning...
CVE-2016-5052
OSRAM SYLVANIA Osram Lightify Home through 2016-07-26 does not use SSL pinning...
CVE-2016-5057
OSRAM SYLVANIA Osram Lightify Pro through 2016-07-26 does not use SSL pinning...
Buffer overflow
OSRAM SYLVANIA Osram Lightify Pro through 2016-07-26 does not use SSL pinning...
Buffer overflow
OSRAM SYLVANIA Osram Lightify Home through 2016-07-26 does not use SSL pinning...
CVE-2016-5052
OSRAM SYLVANIA Osram Lightify Home is affected by CVE-2016-5052. The issue stems from the product’s failure to use SSL pinning in versions up to 2016-07-26, allowing a potential attacker to perform a man-in-the-middle (MITM) attack and intercept SSL/TLS traffic. The CNVD entry confirms the vulner...
CVE-2016-5057
OSRAM SYLVANIA Osram Lightify Pro through 2016-07-26 does not use SSL pinning...
CVE-2016-5052
OSRAM SYLVANIA Osram Lightify Home through 2016-07-26 does not use SSL pinning...
Design/Logic Flaw
WebSocket.swift in Starscream before 2.0.4 allows an SSL Pinning bypass because pinning occurs in the stream function this is too late; pinning should occur in the initStreamsWithData function...
CVE-2017-7192
WebSocket.swift in Starscream before 2.0.4 allows an SSL Pinning bypass because of incorrect management of the certValidated variable it can be set to true but cannot be set to false...
CVE-2017-5887
WebSocket.swift in Starscream before 2.0.4 allows an SSL Pinning bypass because pinning occurs in the stream function this is too late; pinning should occur in the initStreamsWithData function...
CVE-2017-7192
WebSocket.swift in Starscream before 2.0.4 allows an SSL Pinning bypass because of incorrect management of the certValidated variable it can be set to true but cannot be set to false...
CVE-2017-5887
WebSocket.swift in Starscream before 2.0.4 allows an SSL Pinning bypass because pinning occurs in the stream function this is too late; pinning should occur in the initStreamsWithData function...
Design/Logic Flaw
WebSocket.swift in Starscream before 2.0.4 allows an SSL Pinning bypass because of incorrect management of the certValidated variable it can be set to true but cannot be set to false...