901 matches found
IRCCloud: Host Header is not validated resulting in Open Redirect
Please see the attached screenshot where I am sending a request to irccloud.com with an invalid HOST header and I am getting redirected to that domain. This is because the HOST header is not validated to ensure that the request is originating from that target host or not...
Ecava IntegraXor Account Information Disclosure Vulnerability
Ecava IntegraXor is prone to an information disclosure vulnerability. SPDX-FileCopyrightText: 2014 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only if description...
Web Servers Slow HTTP Denial of Service
A denial of service vulnerability has been reported in all web servers. The vulnerability is due to the server's inability to handle multiple specially crafted TCP packets. Remote attackers can exploit this issue by continuously sending small TCP data packets to the server...
Malware Attacks Against Linux 2.6 Websites
The risks presented by unsupported operating systems are being called out in a large-scale attack on hundreds of websites. Hackers have hit web servers running a version of the Linux 2.6 kernel released seven years ago. The result is a multistage attack where compromised websites are spiked with...
Web servers PHPMyAdmin Misconfiguration Code Injection
A code injection vulnerability has been reported in PHPMyAdmin. The vulnerability is due to PHPMyAdmin misconfiguration. A remote attacker can exploit this vulnerability by sending a specially crafted HTTP request to the target...
Web Servers HTTP Response Splitter Cache Poisoning
A Cache Poisoning vulnerability has been identified in multiple web servers. The vulnerability is due to an error in the way the web server sanitizes user input. A remote attacker can exploit this vulnerability by sending a malicious request to the server...
GNU Wget Arbitrary File Download
GNU Wget is a computer program that allows users to retrieve content from web servers. The program can be used by attackers to download arbitrary files via a specially crafted HTTP request...
[ModSecurity v2.7] Open Source Web Application Firewall
ModSecurity is an embeddable web application firewall, which means it can be deployed as part of your existing web server infrastructure Apache, IIS7 and Nginx. This deployment method has certain advantages: 1. No changes to existing network. It only takes a few minutes to add ModSecurity to your...
[SSL Audit] Remotely scans web servers for SSL support
SSL Audit remotely scans web servers for SSL support, unlike other tools it is not limited to ciphers supported by SSL engines such as OpenSSL or NSS but can detect all known cipher suites. It features an innovative Fingerprinting engine that was never seen before. Fingerprint mode Experimental...
Half Million Users Affected in JP Morgan Ucard data breach
An attack on the computer networks of banking giant JP Morgan Chase & Co. may have exposed sensitive information belonging to 465,000 prepaid cash-card holders, according to a Reuters report. JP Morgan said the attack targeted Web servers handling its Ucard program in mid-September and that the...
Archlinux Ultimate Install Script
Install and configure archlinux has never been easier! You can try it first with a virtualbox Prerequisites A working internet connection Logged in as ‘root’ How to get it With git Increase cowspace partition: mount -o remount,size=2G /run/archiso/cowspace Get list of packages and install git:...
[OMENS v1.17] The framework for distributing Actionable Intelligence
OMENS Object Monitor for Enhanced Network Security was born out of the intrusion and intrusion attempts analysis that I have been doing over many years. I consistently run into intrusion attempts that existing IDS systems have difficulty detecting. OMENS is my attempt to better detect and...
CVE-2013-6628
net/socket/sslclientsocketnss.cc in the TLS implementation in Google Chrome before 31.0.1650.48 does not ensure that a server's X.509 certificate is the same during renegotiation as it was before renegotiation, which might allow remote web servers to interfere with trust relationships by...
CVE-2013-6628
net/socket/sslclientsocketnss.cc in the TLS implementation in Google Chrome before 31.0.1650.48 does not ensure that a server's X.509 certificate is the same during renegotiation as it was before renegotiation, which might allow remote web servers to interfere with trust relationships by...
TP-Link Cross Site Request Forgery Vulnerability
This write up goes into detail about how real world cross site request forgery attacks can be used to hijack DNS on TP-Link routers. I. Introduction Today the majority of wired Internet connections is used with an embedded NAT router, which allows using the same Internet connection with several...
Design/Logic Flaw
CFNetwork in Apple Mac OS X before 10.9 does not properly support Safari's deletion of session cookies in response to a reset operation, which makes it easier for remote web servers to track users via Set-Cookie HTTP headers...
CVE-2013-5167
CFNetwork in Apple Mac OS X before 10.9 does not properly support Safari's deletion of session cookies in response to a reset operation, which makes it easier for remote web servers to track users via Set-Cookie HTTP headers...
Apache HTTP Server Scoreboard Security Bypass Vulnerability - Windows
Apache HTTP Server is prone to a security bypass vulnerability. SPDX-FileCopyrightText: 2013 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:apache:httpserver...