Lucene search
+L

1473 matches found

OpenVAS
OpenVAS
added 2015/04/26 12:00 a.m.45 views

Debian Security Advisory DSA 3238-1 (chromium-browser - security update)

Several vulnerabilities were discovered in the chromium web browser. CVE-2015-1235 A Same Origin Policy bypass issue was discovered in the HTML parser. CVE-2015-1236 Amitay Dobo discovered a Same Origin Policy bypass in the Web Audio API. CVE-2015-1237 Khalil Zhani discovered a use-after-free iss...

7.5CVSS0.3AI score0.02951EPSS
SaveExploits3References1
OSV
OSV
added 2015/04/26 12:00 a.m.42 views

DSA-3238-1 chromium-browser - security update

Bulletin has no description...

7.5CVSS8.1AI score0.02951EPSS
SaveExploits3
OpenVAS
OpenVAS
added 2015/04/25 12:00 a.m.72 views

Debian: Security Advisory (DSA-3238-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2015 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

7.5CVSS7.5AI score0.02951EPSS
SaveExploits3References3
OSV
OSV
added 2015/04/19 12:00 a.m.9 views

UBUNTU-CVE-2015-1244

The URLRequest::GetHSTSRedirect function in urlrequest/urlrequest.cc in Google Chrome before 42.0.2311.90 does not replace the ws scheme with the wss scheme whenever an HSTS Policy is active, which makes it easier for remote attackers to obtain sensitive information by sniffing the network for...

5CVSS7.3AI score0.01435EPSS
SaveExploits0References6
RedHat Linux
RedHat Linux
added 2015/04/16 8:33 a.m.10 views

chromium-browser: HSTS bypass in WebSockets

The URLRequest::GetHSTSRedirect function in urlrequest/urlrequest.cc in Google Chrome before 42.0.2311.90 does not replace the ws scheme with the wss scheme whenever an HSTS Policy is active, which makes it easier for remote attackers to obtain sensitive information by sniffing the network for...

5CVSS7.4AI score0.01435EPSS
SaveExploits0References5
Tenable Nessus
Tenable Nessus
added 2015/04/16 12:00 a.m.36 views

Google Chrome < 42.0.2311.90 Multiple Vulnerabilities

The version of Google Chrome installed on the remote Windows host is prior to 42.0.2311.90. It is, therefore, affected by multiple vulnerabilities as referenced in the 201504stable-channel-update14 advisory. - Multiple unspecified vulnerabilities in Google Chrome before 42.0.2311.90 allow attacke...

7.5CVSS8.9AI score0.02951EPSS
SaveExploits1References26
Tenable Nessus
Tenable Nessus
added 2015/04/16 12:00 a.m.40 views

Google Chrome < 42.0.2311.90 Multiple Vulnerabilities

The version of Google Chrome installed on the remote macOS host is prior to 42.0.2311.90. It is, therefore, affected by multiple vulnerabilities as referenced in the 201504stable-channel-update14 advisory. - Multiple unspecified vulnerabilities in Google Chrome before 42.0.2311.90 allow attackers...

7.5CVSS8.9AI score0.02951EPSS
SaveExploits1References26
ArchLinux
ArchLinux
added 2015/04/14 12:00 a.m.51 views

ruby: permissive certificate verification

After reviewing RFC 6125 and RFC 5280, multiple violations were found of matching hostnames and particularly wildcard certificates. Rubys OpenSSL extension will now provide a string-based matching algorithm which follows more strict behavior, as recommended by these RFCs. In particular, matching ...

4.7CVSS1.6AI score0.02815EPSS
SaveExploits0References3
RubySec
RubySec
added 2015/04/13 12:00 a.m.48 views

Ruby OpenSSL Hostname Verification

After reviewing RFC 6125 and RFC 5280, we found multiple violations of matching hostnames and particularly wildcard certificates. Ruby’s OpenSSL extension will now provide a string-based matching algorithm which follows more strict behavior, as recommended by these RFCs. In particular, matching o...

5.9CVSS1.7AI score0.02815EPSS
SaveExploits0References1Affected Software1
FreeBSD
FreeBSD
added 2015/04/13 12:00 a.m.55 views

Ruby -- OpenSSL Hostname Verification Vulnerability

Ruby Developers report: After reviewing RFC 6125 and RFC 5280, we found multiple violations of matching hostnames and particularly wildcard certificates. Ruby’s OpenSSL extension will now provide a string-based matching algorithm which follows more strict behavior, as recommended by these RFCs. I...

5.9CVSS6.4AI score0.02815EPSS
SaveExploits0References1
Cvelist
Cvelist
added 2015/04/10 2:00 p.m.33 views

CVE-2015-1090

CFNetwork in Apple iOS before 8.3 does not delete HTTP Strict Transport Security HSTS state information in response to a Safari history-clearing action, which allows attackers to obtain sensitive information by reading a history file...

4.8AI score0.01485EPSS
SaveExploits0References4
Hacker One
Hacker One
added 2015/03/12 4:34 p.m.28 views

itBit Exchange: ITBit Vulnerable to SSLSTrip

www.itbit.com details: High Level, description It is possible for a malicious user to capture credential information of a www.itbit.com user with the use of SSLStrip. The scenario is that if a user is in a internet cafe and browses the internet while a malicious user intercepts his traffic, the w...

6.6AI score
SaveExploits0
OSV
OSV
added 2015/02/25 12:00 a.m.10 views

UBUNTU-CVE-2015-0832

Mozilla Firefox before 36.0 does not properly recognize the equivalence of domain names with and without a trailing . dot character, which allows man-in-the-middle attackers to bypass the HPKP and HSTS protection mechanisms by constructing a URL with this character and leveraging access to an X.5...

5CVSS6.9AI score0.01052EPSS
SaveExploits0References6
seebug.org
seebug.org
added 2015/01/14 12:00 a.m.26 views

Mao10CMS v3.0.2 储存型xss

简要描述: rt 详细说明: 过滤不严。 以官网为例。 社区发布新话题 成功加载了js 地址 http://www.mao10.com/post-1772.html 然后用户的cookie就来了。。。 漏洞证明:...

7.1AI score
SaveExploits0
Tenable Nessus
Tenable Nessus
added 2015/01/07 12:00 a.m.32 views

OracleVM 2.2 : ntp (OVMSA-2015-0002)

The remote OracleVM system is missing necessary patches to address critical security updates : - don't generate weak control key for resolver CVE-2014-9293 - don't generate weak MD5 keys in ntp-keygen CVE-2014-9294 - fix buffer overflows via specially-crafted packets CVE-2014-9295 - increase...

7.5CVSS7.1AI score0.79069EPSS
SaveExploits8References8
Tenable Nessus
Tenable Nessus
added 2015/01/05 12:00 a.m.23 views

Fedora 20 : pyxdg-0.25-5.fc20 (2014-16357)

Fix CVE-2014-1624 pyxdg: TOCTOU race condition in getruntimedir when strict=False Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without...

3.3CVSS5.3AI score0.00317EPSS
SaveExploits0References3
Tenable Nessus
Tenable Nessus
added 2014/11/26 12:00 a.m.22 views

OracleVM 2.2 : ntp (OVMSA-2009-0036)

The remote OracleVM system is missing necessary patches to address critical security updates : - fix DoS with mode 7 packets 532639, CVE-2009-3563 - compile with -fno-strict-aliasing %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The package checks in this plugin were extracted from OracleV...

6.4CVSS7.5AI score0.32059EPSS
SaveExploits3References2
Hacker One
Hacker One
added 2014/07/15 3:54 a.m.52 views

Automattic: Missing HSTS header in https://app.simplenote.com

Hi, Vulnerable Website: https://app.simplenote.com I tested the website using firefox add-on called: Strict Transport Security Detector https://addons.mozilla.org/en-US/firefox/addon/strict-transport-security-d/ HSTS addresses the following threats: User bookmarks or manually types...

6.8AI score
SaveExploits0
Hacker One
Hacker One
added 2014/06/07 4:34 p.m.28 views

Factlink: Criptographic Issue: Strisct Transport Security with not good max age..(TOO SHORT!)

Issue: Strict Transport Security with too short max age. Description: Your site use a good "Strict Transport Security" but with short MAX AGE! Severity: See more information below. Proof of Concept by ssllabs.com 100% affidability: "Strict Transport Security HSTS Yes max-age=2592000 TOO SHORT les...

6.7AI score
SaveExploits0
NVD
NVD
added 2014/05/26 4:29 a.m.21 views

CVE-2013-3046

The Meeting Server in IBM Sametime 8.x through 8.5.2.1 and 9.x through 9.0.0.1 does not send the HSTS Strict-Transport-Security header, which makes it easier for man-in-the-middle attackers to hijack sessions or obtain sensitive information by leveraging the presence of HTTP requests...

4.3CVSS5.9AI score0.00415EPSS
SaveExploits0References2
Rows per page
Query Builder