CVE-2018-2704

CVE-2018-2704 affects the Oracle Banking Payments component of Oracle Financial Services Applications (subcomponent: Payments Core). The vulnerability is present in supported versions 12.3.0 and 12.4.0 and is exploitable over the network via HTTP by a low-privileged attacker, potentially granting...

CVE-2018-2708

Vulnerability in the Oracle Banking Payments component of Oracle Financial Services Applications subcomponent: Payments Core. Supported versions that are affected are 12.3.0 and 12.4.0. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise...

CVE-2018-2707

Vulnerability in the Oracle Banking Corporate Lending component of Oracle Financial Services Applications subcomponent: Core module. Supported versions that are affected are 12.3.0 and 12.4.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromi...

CVE-2018-2705

Vulnerability in the Oracle Banking Payments component of Oracle Financial Services Applications subcomponent: Payments Core. Supported versions that are affected are 12.3.0 and 12.4.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Orac...

CVE-2018-2705

CVE-2018-2705 affects Oracle Banking Payments (Payments Core) in Oracle Financial Services Applications, with affected versions 12.3.0 and 12.4.0. The vulnerability is exploitable by a low-privilege attacker who has network access via HTTP and can compromise Oracle Banking Payments, potentially l...

CVE-2018-2648

CVE-2018-2648 affects Oracle FLEXCUBE Universal Banking (Infrastructure subcomponent) within Oracle Financial Services Applications. Affected supported versions include 11.3.0, 11.4.0, 12.0.1, 12.0.2, 12.0.3, 12.1.0, 12.2.0, 12.3.0, and 12.4.0. The vulnerability is exploitable by a low-privilege ...

CVE-2018-2707

The CVE-2018-2707 entry describes a vulnerability in the Oracle Banking Corporate Lending component of Oracle Financial Services Applications (Core module). Affected versions are 12.3.0 and 12.4.0. The flaw allows a low-privileged attacker with network access via HTTP to compromise Oracle Banking...

Unspecified Vulnerability in Oracle Banking Payments (CNVD-2018-02394)

Oracle Banking Payments is a complete payment processing solution. An unspecified vulnerability exists in the Payments Core component of Oracle Banking Payments. An attacker could exploit this vulnerability to compromise integrity and availability...

Unspecified Vulnerability in Oracle Banking Payments (CNVD-2018-02393)

Oracle Banking Payments is a complete payment processing solution. An unspecified vulnerability exists in the Payments Core component of Oracle Banking Payments. An attacker could exploit the vulnerability to compromise confidentiality...

Unspecified Vulnerability in Oracle FLEXCUBE Universal Banking (CNVD-2018-02390)

Oracle FLEXCUBE Universal Banking is a real-time, online, comprehensive global core banking solution covering retail, corporate and investment banking. An unspecified vulnerability exists in the Security Management System component of Oracle FLEXCUBE Universal Banking. An attacker could exploit...

Unspecified Vulnerability in Oracle Banking Payments

Oracle Banking Payments is a complete payment processing solution. An unspecified vulnerability exists in the Payments Core component of Oracle Banking Payments. An attacker could exploit this vulnerability to compromise confidentiality, integrity, and availability...

Unspecified Vulnerability in Oracle FLEXCUBE Universal Banking (CNVD-2018-02389)

Oracle FLEXCUBE Universal Banking is a real-time, online, comprehensive global core banking solution covering retail, corporate and investment banking. An unspecified vulnerability exists in the Infrastructure component of Oracle FLEXCUBE Universal Banking. An attacker could exploit this...

Threat Round Up for January 5 - 12

Today, Talos is publishing a glimpse into the most prevalent threats we've observed between January 05 and January 12. As with previous round-ups, this post isn't meant to be an in-depth analysis. Instead, this post will summarize the threats we've observed by highlighting key behavior...

SQL Injection Vulnerability in Process Banking Infrastructure Platform of Beijing Yinsan Gold Service Technology Co.

The basic platform of process bank is to take the process as the object of IT system implementation, intending to build a commercial bank "assembly line" work platform, according to the product, business line, the process of IT curing, optimization, and ultimately build a complete set of IT syste...

Not So Crystal Clear - Zeus Variant Spoils Ukrainian Holiday

This post was authored by Edmund Brumaghin with contributions from Ben Baker, Dave Maynor and Matthew Molyett. Introduction Talos has observed a cyber attack which was launched using the official website of Ukraine-based accounting software developer Crystal Finance Millennium CFM. This vector is...

CHM Help Files Deliver Brazilian Banking Trojan

Security researchers are warning of a new spam campaign targeting Brazilian institutions that contain Compiled HTML file attachments that are used to deliver a banking Trojan. Spam messages contain a malicious CHM attachment called “comprovante.chm”, wrote Rodel Mendrez, senior security researche...

Kaspersky Security Bulletin. Overall statistics for 2017

All the statistics used in this report were obtained using Kaspersky Security Network KSN, a distributed antivirus network that works with various anti-malware protection components. The data was collected from KSN users who agreed to provide it. Millions of Kaspersky Lab product users from 213...

Newly Uncovered 'MoneyTaker' Hacker Group Stole Millions from U.S. & Russian Banks

Security researchers have uncovered a previously undetected group of Russian-speaking hackers that has silently been targeting Banks, financial institutions, and legal firms, primarily in the United States, UK, and Russia. Moscow-based security firm Group-IB published a 36-page report on Monday,...

Threat Round Up for Dec 01 - Dec 08

Today, Talos is publishing a glimpse into the most prevalent threats we've observed between December 01 and December 08. As with previous round-ups, this post isn't meant to be an in-depth analysis. Instead, this post will summarize the threats we've observed by highlighting key behavior...

Banking Apps Found Vulnerable to MITM Attacks

Leading US and UK-based banks have patched a flaw found in their Android and iOS mobile apps that allowed adversaries to conduct man-in-the-middle attacks to steal customer credentials and view and manipulate network traffic. According to researchers at the School of Computer Science at the...