sslnuke

sslnuke —— 未经验证的 SSL 并不安全！ 我们都不止一次地听说过，未经验证的 SSL 并不安全。 如果 SSL 连接没有使用缓存的证书进行验证，那么任何攻击者都可以轻易地劫持它。 因此，在 2013 年，人们可能会认为我们已经彻底解决了这个问题。 浏览器会缓存证书，并在站点提供自验证证书（不应被信任）时非常醒目地警告用户， 浏览器厂商基本上已经解决了这个问题。然而，HTTPS 并不是唯一使用 SSL 的协议。 不幸的是，许多其他协议的客户端默认不进行验证，即使它们进行了验证，也无法保证证书的安全传输。 毕竟，有多少人愿意为自己的 FTPS 服务器花 50 美元购买 SSL...

lwebs.co.uk Open Redirect vulnerability

Vulnerable URL: http://lwebs.co.uk/go/news/53526/?url=https://www.xssposed.org/ Details: Description| Value ---|--- Patched:| No Latest check for patch:| 26.07.2017 Vulnerability type:| Open Redirect Vulnerability status:| Publicly disclosed Alexa Rank| 10307133 Google Pagerank| 0 VIP website...

sweetlocation.co.uk XSS vulnerability

Vulnerable URL: http://sweetlocation.co.uk/for-sale/404%22%3E%3Cimg+src%3dx+onerror%3dwindow.onerror%3dalert%3bthrow%2fxssposed%2f%3b%2f%2f%3E%3C/mode/sale/category/1 Details: Description| Value ---|--- Patched:| Yes, at 30.01.2016 Latest check for patch:| 30.01.2016 23:35 GMT Vulnerability type:...

intemz.su XSS vulnerability

Vulnerable URL: http://intemz.su/search.phtml?a=0=%3Cscript%3Ealert%28%2FXSSPOSED%2F%29%3B%3C%2Fscript%3E&=%3Cscript%3Ealert%28%2FXSSPOSED%2F%29%3B%3C%2Fscript%3E Details: Description| Value ---|--- Patched:| No Latest check for patch:| 25.07.2017 Vulnerability type:| XSS Vulnerability status:|...

CVE-2014-7758

The CVE-2014-7758 entry corresponds to the AMKAMAL Science Portfolio Android app (package com.wAMKAMALSciencePortfolio) version 0.1, where the vulnerability is an inability to verify X.509 certificates from SSL servers. The root cause is missing TLS/SSL certificate validation, which can allow man...

Information disclosure

The Gulf Coast Educators FCU aka com.metova.cuae.gcefcu application 1.0.27 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...