CVE-2016-0323

The CVE-2016-0323 issue affects Liberty for Java running in IBM Bluemix when bound to the Auto-Scaling for Bluemix service, specifically versions prior to 2.7-20160321-1358. The Auto-Scaling agent can disable SSL certificate validation, bypassing the HTTPS trust-management feature. The IBM Bluemi...

icedtea security update

CentOS Errata and Security Advisory CESA-2016:0778 An update for icedtea-web is now available for Red Hat Enterprise Linux 6. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed...

icedtea-web: unexpected permanent authorization of unsigned applets

It was discovered that IcedTea-Web did not properly sanitize applet URLs when storing applet trust settings. A malicious web page could use this flaw to inject trust-settings configuration, and cause applets to be executed without user approval...

ThisData: Host Header Poisoning in thisdata.com

ThisData made inappropriate use of the user-supplied host header, which could have resulted in a user being redirected to an arbitrary domain under some circumstances. On other pages, the header was used within metadata values like the canonical URL. 7H0R4PP4N was very thorough and helpful as we...

Open Source Intelligence and Forensics : Maltego

Maltego is an open source intelligence and forensics application Maltego is a visual link analysis tool that, out the box, comes with open source intelligence OSINT plugins, called transforms. The tool offers real-time data mining and information gathering as well as the representation of this...

HP System Management Homepage (SMH) AddXECert Remote DoS

The HP System Management Homepage SMH application running on the remote web server is affected by a denial of service vulnerability due to improper handling of the Common Name in a certificate uploaded via /proxy/AddXECert. An unauthenticated, remote attacker can exploit this, via a crafted...

IBM Bluemix Liberty for Java Security Bypass Vulnerability

IBM Bluemix Liberty for Java is a set of dynamic application server runtime environments based on IBM Bluemix Platform as a Service, PaaS products from IBM in the United States. A security bypass vulnerability exists in Liberty for Java in versions prior to IBM Bluemix 2.7-20160321-1358, which ca...

The vulnerability of the Android operating system allows a hacker to replace the server

The vulnerability of the caching function in the TrustManagerImpl class TrustManagerImpl.java of the Conscrypt component in the Android operating system is related to security configuration errors. Exploiting this vulnerability could allow a malicious actor to replace servers by accessing...

Receiver pass through is failing with Storefront when we are trying to launch application across domains/forests.

We have two domains “Domain1.com" and "Domain2.com" in different forest. External two way trust relationship exists between 2 domains. XenApp and XML servers are in “Domain2.com" domain and Store front servers are in “Domain1.com" domain. Few users in "Domain1.com" domain is part of a global grou...

What is Certificate Transparency? How It helps Detect Fake SSL Certificates

Do you know there is a huge encryption backdoor still exists on the Internet that most people don't know about? I am talking about the traditional Digital Certificate Management System… the weakest link, which is completely based on trust, and it has already been broken several times. To ensure t...

CVE-2016-1766

The Profiles component in Apple iOS before 9.3 does not properly validate certificates, which allows attackers to spoof an MDM profile trust relationship via unspecified vectors...

CVE-2016-1766

The Profiles component in Apple iOS before 9.3 does not properly validate certificates, which allows attackers to spoof an MDM profile trust relationship via unspecified vectors...

McAfee VirusScan Enterprise < 8.8 Patch 7 Protected Resource Access Bypass (SB10151)

The version of McAfee VirusScan Enterprise VSE installed on the remote Windows host is prior to 8.8 Patch 7. It is, therefore, affected by a flaw in its self-protection mechanism when applying rules to access settings, which are used to determine what applications and associated actions can be...

CVE-2016-0818

The caching functionality in the TrustManagerImpl class in TrustManagerImpl.java in Conscrypt in Android 4.x before 4.4.4, 5.x before 5.1.1 LMY49H, and 6.x before 2016-03-01 mishandles the distinction between an intermediate CA and a trusted root CA, which allows man-in-the-middle attackers to...

NSA's Rogers Quiet on Apple-FBI Debate at RSA

SAN FRANCISCO—National Security Agency and U.S. Cyber Command director Admiral Michael S. Rogers stood before tens of thousands of RSA Conference attendees on Tuesday and asked for help. In what has almost become a speaking slot reserved for the government to use as a recruiting pitch of some sor...

Gitminer - Automatic Search For GitHub

Advanced search tool and automation in Github. This tool aims to facilitate research by code or code snippets on github through the site's search page. MOTIVATION Demonstrates the fragility of trust in public repositories to store codes with sensitive information. REQUERIMENTS argparse requests...

[SECURITY] Fedora 22 Update: monotone-1.1-13.fc22

monotone is a free, distributed version control system. It provides fully disconnected operation, manages complete tree versions, keeps its state in a local transactional database, supports overlapping branches and extensible metadata, exchanges work over plain network protocols, performs...

[SECURITY] Fedora 23 Update: monotone-1.1-13.fc23

monotone is a free, distributed version control system. It provides fully disconnected operation, manages complete tree versions, keeps its state in a local transactional database, supports overlapping branches and extensible metadata, exchanges work over plain network protocols, performs...

affiliate.traders-trust.com XSS vulnerability

Vulnerable URL: http://affiliate.traders-trust.com/scripts/banner.php?aaid=60039752aed9dc3b7f7bid=f04775a0=1&refx2s6d;=%22%3E%3Csvg/onload=prompt%28/XSSPOSED/%29%3E Details: Description| Value ---|--- Patched:| Yes, at 26.07.2017 Latest check for patch:| 26.07.2017 17:31 GMT Vulnerability type:|...

Microsoft Windows - Kerberos Security Feature Bypass (MS16-014)

Microsoft Windows - Kerberos Security Feature Bypass MS16-014 Exploit Title: Windows Kerberos Security Feature Bypass Date: 12-02-2016 Exploit Author: Nabeel Ahmed Tested on: Windows 7 Professional x32/x64 CVE : CVE-2016-0049 Category: Local Exploit 1 Prerequisites: - Standard Windows 7 Fully...