CVE-2016-1772

The Top Sites feature in Apple Safari before 9.1 mishandles cookie storage, which makes it easier for remote web servers to track users via unspecified vectors...

Design/Logic Flaw

The Top Sites feature in Apple Safari before 9.1 mishandles cookie storage, which makes it easier for remote web servers to track users via unspecified vectors...

CVE-2016-1772

The Top Sites feature in Apple Safari before 9.1 mishandles cookie storage, which makes it easier for remote web servers to track users via unspecified vectors...

CVE-2016-1781

CVE-2016-1781 affects Apple WebKit in iOS before 9.3 and Safari before 9.1, where handling of attachment URLs could enable remote tracking of users via unspecified vectors. The Apple security content for Safari 9.1 (WebKit entry) indicates a concrete mitigation: a hidden web page may access devic...

IBM WebSphere Application Server Liberty Profile Multiple Vulnerabilities (swg21697368)

IBM WebSphere Application Server Liberty Profile is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2016 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

Apache Subversion mod_dav_svn Integer Overflow (CVE-2015-5343)

Heap overflow and out-of-bounds read vulnerabilities have been reported in the moddavsvn of Apache Subversion web servers. These vulnerabilities are caused by an integer overflow when parsing certain encoded requests. A remote, authenticated attacker could exploit this vulnerability by sending...

IBM WebSphere Application Server Liberty Arbitrary Code Execution Vulnerability (Mar 2016)

IBM WebSphere Application Server Liberty is prone to an arbitrary code execution vulnerability. SPDX-FileCopyrightText: 2016 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only...

IBM WebSphere Application Server Security Bypass Vulnerability (swg21681249)

IBM WebSphere Application Server is prone to a security bypass vulnerability. SPDX-FileCopyrightText: 2016 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

CTB-Locker Ransomware Spreading Rapidly, Infects Thousands of Web Servers

Ransomware has steadily evolved over the past decade, moving from isolated attacks on individual computers to wider campaigns that disrupt entire services. Families such as Cryptowall and Locky showed how quickly file-encrypting malware could spread across Windows systems. Researchers are now...

IBM WebSphere Application Server Information Disclosure Vulnerability (Feb 2016)

IBM WebSphere Application Server is prone to a remote information disclosure vulnerability SPDX-FileCopyrightText: 2016 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE ...

Firefox allows for control characters to be set in cookie names — Mozilla

Security researcher musicDespiteEverything previously reported an issue where illegal control characters were stored in as cookie values in violation of RFC6265. While fixing this issue, Mozilla developer Nicholas Hurley realized that the same issue applied to the names of cookies. These characte...

IBM WebSphere Application Server XSS Vulnerability (swg21644047)

IBM WebSphere Application Server is prone to a cross-site scripting XSS vulnerability. SPDX-FileCopyrightText: 2016 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

IBM WebSphere Application Server Security Bypass Vulnerability (Jan 2016)

IBM WebSphere Application Server is prone to a security bypass vulnerability. SPDX-FileCopyrightText: 2016 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

HP Virtual Table Server Detection

An HP Virtual Table Server VTS is listening on the remote host. VTS offers an alternative to standard parameterization for load and performance testing, and it is a component of HP LoadRunner and HP Performance Center. C Tenable Network Security, Inc. include"compat.inc"; if description...

Directory Browsing Enabled on /cgi-bin (deprecated)

The /cgi-bin directory on the remote web server is browsable. An unauthenticated, remote attacker can exploit this to disclose sensitive information. This plugin has been deprecated. Use webmirror3.nbin plugin ID 10662 instead to identify browsable directories. %NASLMINLEVEL 999999 C Tenable...

Enabled Directory Listing/Indexing Detection (HTTP)

The script attempts to identify directories with an enabled directory listing/indexing on a remote web server. SPDX-FileCopyrightText: 2015 SCHUTZWERK GmbH SPDX-FileCopyrightText: Improved code and additional detection routines since 2016 Greenbone AG Some text descriptions might be excerpted fro...

Firefox allows for control characters to be set in cookies — Mozilla

Security researcher musicDespiteEverything reported an issue when ASCII code 11 for vertical tab is stored in a cookie in violation of RFC6265. This may result in incorrect cookie handling by servers, resulting in the potential ability to set cookie values and read cookie data from users in conce...

Angler Exploit Kit Spreading Cryptowall 4.0

As expected, it didn’t take long for one of the most popular exploit kits, Angler, to start spreading the latest iteration of Cryptowall ransomware. A drive-by campaign that uses a one-two punch to drop Cryptowall 4.0 has been observed in the wild this week, according to researchers at Heimdal...

JBoss WildFly <= 9.0.2 RCE Vulnerability

JBoss WildFly is prone to a remote code execution RCE vulnerability. SPDX-FileCopyrightText: 2015 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

Code injection

CFNetwork in Apple iOS before 9.1 and OS X before 10.11.1 does not properly consider the uppercase-versus-lowercase distinction during cookie parsing, which allows remote web servers to overwrite cookies via unspecified vectors...