HackerOne: Non-secure requests are not automatically upgraded to HTTPS

Non-secure requests to hackerone.com e.g. http://hackerone.com are not automatically upgraded to HTTPS. This is not something you would notice when you use the latest version of modern web browsers such as Google Chrome or Firefox, because hackerone.com is HSTS preloaded. When a domain is...

Cisco Small Business SG300 Denial of Service Vulnerability

Cisco Small Business SG300 is the SG300 series of smart switch products from Cisco. A security vulnerability in the web-management GUI implementation of the Cisco Small Business SG300 allows remote attackers to conduct denial-of-service attacks by sending specially crafted HTTPS requests...

The xsrf cookie token is not a 'secure' cookie for secure('https') requests

To prevent against man in the middle attacks the xsrf cookie token should have the 'secure' attribute set...