Yahoo Encryption Slammed for Lack of Forward Secrecy, HSTS

Yahoo, as promised, rolled out HTTPs by default this week for its email service, bringing it in line with other Internet companies that have been securing users’ communication for years. But if Yahoo expected applause from security experts, it can think again. The response from those well-versed ...

PHP < 5.5.2 Session Fixation Vulnerability (Aug 2013)

PHP is prone to a session fixation vulnerability. SPDX-FileCopyrightText: 2013 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:php:php"; ifdescription...

ECSHOP latest cookie validation is not strict vulnerability-vulnerability warning-the black bar safety net

This vulnerability is what we in the non-authorization safety assessment when found. Is one ecshop station, by the conventional 0day broke the admin password, but can't open it. So you think, there is no possibility of the ciphertext md5 stored in the cookie to log in. Of course, the above...

Fedora 19 : bzr-2.5.1-11.fc19 (2013-9538)

Fixes CVE-2013-2099, maliciously crafted SSL certificate can cause a denial of service. - Builds the C extensions from the Cython source instead of the pregenerated C files. - Build without strict-aliasing on Fedora versions which have a bug in the python distutils module. - Install the...

Fedora 18 : bzr-2.5.1-11.fc18 (2013-9620)

Fixes CVE-2013-2099, maliciously crafted SSL certificate can cause a denial of service. - Builds the C extensions from the Cython source instead of the pregenerated C files. - Build without strict-aliasing on Fedora versions which have a bug in the python distutils module. - Install the...

Kerry friends of Science and technology cms upload vulnerability and fix-vulnerability warning-the black bar safety net

The program uses the upload page uploadfile. asp not be verified, leading to the establishment of malformations directory upload image the Trojans get a shell vulnerability. exp: the http://www.8090sec.com/admin/uploadfile.asp?uppath=mad.asp&upname=&uptext=form1. mad. asp His original Upload...

齐博cms后台 数据库工具处过滤不严格导致能写入一句话木马

简要描述： 假如你的账户密码泄露了 那你就危险了 在后台能直接拿webshell 详细说明： 后台为方便站长有个数据库工具 在哪里执行 Select '' into outfile 'F:/wwwroot/shiyanshi/cache/1.asp'; 就写入了一句话木马 然后就可以任意作为了 漏洞证明：...

boost security update

1.41.0-15 - Add in explicit dependences between some boost subpackages 1.41.0-14 - Build with -fno-strict-aliasing 1.41.0-13 - In Boost.Pool, be careful not to overflow allocated chunk size boost-1.41.0-pool.patch 1.41.0-12 - Add an upstream patch that fixes computation of CRC in zlib streams. -...

SiteServer CMS program upload filter is not strict can lead to get shell-vulnerability warning-the black bar safety net

A day with the Night chat, accidentally discovered SiteServer CMS upload vulnerability, the filter is not strictly http://demo2. siteserver. cn today to test under the main station of this presentation template Before this app also has pop user name is not filtered strictly to be used, update the...

HTTP Strict Transport Security (HSTS) Detection

Display HTTP Strict Transport Security HSTS information about each system. This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'HTTP Strict Transport Security HSTS Detection', 'Description' = %q...

Mozilla Adding More Stringent HTTPS Enforcement to Firefox

Mozilla is adding an extra layer of security in its Firefox browser by implementing HTTP Strict Transport Security HSTS, a mechanism that will force some sites into establishing a secure, HTTPS connection with the browser if its presented with the right certificate. According to an entry on...

Apache settings are not strict, the exposed server-status-vulnerability warning-the black bar safety net

1 0 month 3 0 day, foreign security researchers found that because of the apache settings are not strict, causes the server state is exposed to the public network. Originally, the apache has one called server-status function, for the convenience of the administrator to check the server running...

Sunny Navigation System cms the background filter is not strict vulnerability-vulnerability warning-the black bar safety net

BY: madmen From 1 6 3 Micro Forum Test URL http://www.xxx.com/admin/log/dispcont.asp admin/log/dispcont. asp View administrator login records where the filter is not strict lead to can view the login record of success Although success is cmd5 encryption, but a large part can be cracked Tasteless ...

SEC Consult SA-20121017-0 :: ModSecurity multipart/invalid part ruleset bypass

SEC Consult Vulnerability Lab Security Advisory 20121017-0 ======================================================================= title: ModSecurity multipart/invalid part ruleset bypass product: ModSecurity vulnerable version: = 2.6.8 fixed version: 2.7.0 CVE number: - impact: Depends what you...

bo-blog xss vulnerability-vulnerability warning-the black bar safety net

Bo-Blog is an domestic excellent open source blogging, wordpress and other blog Bo-Blog the advantage of easy to use, convenient, efficiency is high. If wordpress is the professional blogging program so Bo-blog is a civilian blog. Bo-blog The advantages and disadvantages are obvious, the...

XYCMS injection vulnerability 0day and fix-vulnerability warning-the black bar safety net

/common. asp? id=1 6 Injection vulnerability, there is a lot of anti-injection system, how to breakthrough and I don't say that! Table segments by default adminuser field default is admin password The default background h/admin/ Take the shell method eweb5. 5 The use of vulnerability must be with...

RedHat Update for kdelibs RHSA-2011:0464-01

Check for the Version of kdelibs OpenVAS Vulnerability Test RedHat Update for kdelibs RHSA-2011:0464-01 Authors: System Generated Check Copyright: Copyright c 2012 Greenbone Networks GmbH, http://www.greenbone.net This program is free software; you can redistribute it and/or modify it under the...

DeepSoft. com. sys. Servlet upload vulnerability-vulnerability warning-the black bar safety net

Author:hackdn Reprinted indicate the JSP+MSSQL system, foreign wide application, in registered upload, the filter is not strict, modify the following POST, upload JSP link rel=stylesheet href="/rs/rs. css" html body topmargin=1 0 leftmargin=1 0 onload="window. focus" form name="formupload"...

Network fun shopping system flagship version of eshop backend get webshell-vulnerability warning-the black bar safety net

Disclosure of status: 2012-03-04: positive contact vendors and wait for manufacturers to claim, details not open to the public 2012-03-04: the vendors have actively ignored vulnerabilities, the details disclosed to the public Brief description: eWebEditor editor filter is not strict, direct uploa...

kexec-tools: Multiple security flaws by management of kdump core files and ramdisk images

The SSH configuration in the Red Hat mkdumprd script for kexec-tools, as distributed in the kexec-tools 1.x before 1.102pre-154 and 2.x before 2.0.0-209 packages in Red Hat Enterprise Linux, disables the StrictHostKeyChecking option, which allows man-in-the-middle attackers to spoof kdump servers...