地图 / SSL Not Enforced

SSL Not Enforced

其他弱点 / Unlabeled / #1425

厂商: Secret
严重程度: 未评级
赏金: —
弱点: Unlabeled
研究员: @anshuman_bh
披露日期: 2014-03-16
资产: —
CVE: —

该报告还没有中文解读。

原文摘录

摘自原文（784 字符中的一小部分）

Although by default, all the communication in the Secret web app happens over HTTPS, if this is changed to HTTP, the requests are still normally processed.

默认不展示报告全文。以上为简短摘录，完整复现过程请阅读原文。版权归研究员与 Secret 所有。

时间线

2014-02-14报告提交
2014-03-16公开披露

阅读 HackerOne 原文 ↗作者 @anshuman_bh · 版权归作者与 Secret 所有

同类报告

June 2022 Incident ReportHackerOne · 2022-07-01 HTML-injection in PDF-export leads to LFIVisma Public · — · $500 DOM XSS on duckduckgo.com searchDuckDuckGo · 2020-06-14 An attacker can archive and unarchive any structured scope object on HackerOneHackerOne · 2022-04-18 Java (Maven): Actually fix the use of insecure protocol to download/upload artifactsGitHub Security Lab · — · $4,000 Handling of `tracking` command allows making arbitrary blind requests with user's cookies from Grammarly Extension's originSuperhuman (formerly Grammarly) · 2019-08-01