Zomato: Authentication Bypassing and Sensitive Information Disclosure on Verify Email Address in Registration Flow

The zomato.com web application is vulnerable to authentication bypassing and sensitive information disclosure. The flaw exist in “Verify Email Address” link which is received in a mail after registration. Once the user enters Full Name, Email Address and Password during registration, he/she is...

Android Security Advisory — 2016-03-18Stay organized with collectionsSave and categorize content based on your preferences.

Android Security Advisories are supplemental to the Nexus Security Bulletins. Refer to our summary page for more information about Security Advisories. Summary Google has become aware of a rooting application using an unpatched local elevation of privilege vulnerability in the kernel on some...

DEBIAN-CVE-2016-0800

The SSLv2 protocol, as used in OpenSSL before 1.0.1s and 1.0.2 before 1.0.2g and other products, requires a server to send a ServerVerify message before establishing that a client possesses certain plaintext RSA data, which makes it easier for remote attackers to decrypt TLS ciphertext data by...

PT-2016-1362

Name of the Vulnerable Software and Affected Versions OpenSSL versions prior to 1.0.1s OpenSSL versions prior to 1.0.2g Description The issue is related to the SSLv2 protocol, which requires a server to send a ServerVerify message before establishing that a client possesses certain plaintext RSA...

UBUNTU-CVE-2016-2085

The evmverifyhmac function in security/integrity/evm/evmmain.c in the Linux kernel before 4.5 does not properly copy data, which makes it easier for local users to forge MAC values via a timing side-channel attack...

McAfee Total Protection Denial of Service Vulnerability

McAfee Total Protection is a suite of antivirus software.McAfee File Lock is a file locking software that provides data encryption protection.McPvDrv.sys is one of the drivers. A security vulnerability in McPvDrv.sys in McAfee File Lock for McAfee Total Protection allows a local attacker to explo...

Nexus Security Bulletin - February 2016Stay organized with collectionsSave and categorize content based on your preferences.

We have released a security update to Nexus devices through an over-the-air OTA update as part of our Android Security Bulletin Monthly Release process. The Nexus firmware images have also been released to the Google Developer site. Builds LMY49G or later and Android M with Security Patch Level o...

RSA package for Python spoofing vulnerability

RSA package for Python is a Python RSA implementation that supports encryption and decryption, signing and verifying signatures, key generation and more. The 'verify' function of Python-RSA has a security vulnerability that allows a remote attacker to forge signatures using special signature...

Design/Logic Flaw

The verify function in the RSA package for Python Python-RSA before 3.3 allows attackers to spoof signatures with a small public exponent via crafted signature padding, aka a BERserk attack...

CVE-2016-1494

The verify function in the RSA package for Python Python-RSA before 3.3 allows attackers to spoof signatures with a small public exponent via crafted signature padding, aka a BERserk attack...

CVE-2016-1494

The CVE-2016-1494 issue affects the Python-RSA library’s verify function prior to version 3.3, enabling a Bleichenbacher ’06 style attack to forge signatures with a small public exponent via crafted padding (BERserk). This can allow an attacker to spoof valid signatures for the affected RSA keys....

CVE-2016-1494

The verify function in the RSA package for Python Python-RSA before 3.3 allows attackers to spoof signatures with a small public exponent via crafted signature padding, aka a BERserk attack...

BrainTest Malicious Android Apps Removed From Google Play

Update The Brain Test mobile malware family has once again been evicted from Google Play. Known for piggy-backing on fully functioning mobile applications, the malware’s various iterations try to root Android devices, download malicious APKs and inflate the Google Play ratings of other apps writt...

Oracle Linux 6 / 7 : openssl (ELSA-2015-2617)

The remote Oracle Linux 6 / 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2015-2617 advisory. - fix CVE-2015-3194 - certificate verify crash with missing PSS parameter - fix CVE-2015-3195 - X509ATTRIBUTE memory leak - fix CVE-2015-3196 - rac...

FreeBSD : openssl -- multiple vulnerabilities (4c8d1d72-9b38-11e5-aece-d050996490d0)

OpenSSL project reports : - BNmodexp may produce incorrect results on x8664 CVE-2015-3193 - Certificate verify crash with missing PSS parameter CVE-2015-3194 - X509ATTRIBUTE memory leak CVE-2015-3195 - Race condition handling PSK identify hint CVE-2015-3196 - Anon DH ServerKeyExchange with 0 p...

openssl -- multiple vulnerabilities

OpenSSL project reports: BNmodexp may produce incorrect results on x8664 CVE-2015-3193 Certificate verify crash with missing PSS parameter CVE-2015-3194 X509ATTRIBUTE memory leak CVE-2015-3195 Race condition handling PSK identify hint CVE-2015-3196 Anon DH ServerKeyExchange with 0 p parameter...

Vulnerability in OpenSSL - Certificate verify crash with missing PSS parameter

The signature verification routines will crash with a NULL pointer dereference if presented with an ASN.1 signature using the RSA PSS algorithm and absent mask generation function parameter. Since these routines are used to verify certificate signature algorithms this can be used to crash any...

wireshark security, bug fix, and enhancement update

1.10.14-7.0.1 - Add oracle-ocfs2-network.patch to allow disassembly of OCFS2 interconnect 1.10.14-7 - Rebase some tvbuff API from upstream to 1.10.14 - Fixes crash when tvblengthremaining is used - Related: CVE-2015-6244 1.10.14-6 - Security patch - Resolves: CVE-2015-3182 1.10.14-5 - Fix crash...

Nexus Security Bulletin - October 2015Stay organized with collectionsSave and categorize content based on your preferences.

We have released a security update to Nexus devices through an over-the-air OTA update as part of our Android Security Bulletin Monthly Release process. The Nexus firmware images have also been released to the Google Developer site. Builds LMY48T or later such as LMY48W and Android M with Securit...

MassVet Android Malicious App Scanner

Most Android malware samples can be found clinging to some sort of knockoff to a legitimate application. Hiding in plain sight like that, sometimes they find their way into Google Play or any one of the dozens of less-patrolled Android markets. Researchers at Indiana University believe they’ve co...