Invincea Dell Protected Workspace Protection Bypass

Summary Multiple security flaws exists in InvProtectDrv.sys which is a part of Invincea Dell Protected Workspace 5.1.1-22303. Weak restrictions on the driver communication channel and additonal insufficient checks allow any application to turn off some of the protection mechanisms provided by the...

Code injection

A Man-in-the-Middle issue was discovered in Hyundai Motor America Blue Link 3.9.5 and 3.9.4. Communication channel endpoints are not verified, which may allow a remote attacker to access or influence communications between the identified endpoints...

PT-2017-16864

Name of the Vulnerable Software and Affected Versions Hyundai Motor America Blue Link versions 3.9.4 through 3.9.5 Description A Man-in-the-Middle issue was discovered, where communication channel endpoints are not verified. This may allow a remote attacker to access or influence communications...

CVE-2017-6052: Channel Accessible by Non-Endpoint

A Man-in-the-Middle issue was discovered in Hyundai Motor America Blue Link 3.9.5 and 3.9.4. Communication channel endpoints are not verified, which may allow a remote attacker to access or influence communications between the identified endpoints...

Code injection

An issue was discovered in St. Jude Medical Merlin@home, versions prior to Version 8.2.2 RF models: EX1150; Inductive models: EX1100; and Inductive models: EX1100 with MerlinOnDemand capability. The identities of the endpoints for the communication channel between the transmitter and St. Jude...

CVE-2017-5149

An issue was discovered in St. Jude Medical Merlin@home, versions prior to Version 8.2.2 RF models: EX1150; Inductive models: EX1100; and Inductive models: EX1100 with MerlinOnDemand capability. The identities of the endpoints for the communication channel between the transmitter and St. Jude...

CVE-2017-5149

An issue was discovered in St. Jude Medical Merlin@home, versions prior to Version 8.2.2 RF models: EX1150; Inductive models: EX1100; and Inductive models: EX1100 with MerlinOnDemand capability. The identities of the endpoints for the communication channel between the transmitter and St. Jude...

CVE-2016-8358

An issue was discovered in Smiths-Medical CADD-Solis Medication Safety Software, Version 1.0; 2.0; 3.0; and 3.1. The affected software does not verify the identities at communication endpoints, which may allow a man-in-the-middle attacker to gain access to the communication channel between...

CVE-2016-8358

CVE-2016-8358 concerns Smiths Medical CADD-Solis Medication Safety Software (versions 1.0, 2.0, 3.0, 3.1). The root issue is that the software does not verify identities at communication endpoints, enabling a potential man-in-the-middle to access the communication channel between endpoints. The v...

CVE-2016-8358: Origin Validation Error

An issue was discovered in Smiths-Medical CADD-Solis Medication Safety Software, Version 1.0; 2.0; 3.0; and 3.1. The affected software does not verify the identities at communication endpoints, which may allow a man-in-the-middle attacker to gain access to the communication channel between...

XMPP Clients User Impersonation Vulnerability

Exploit for multiple platform in category local exploits Multiple XMPP Clients User Impersonation Vulnerability Summary ------- An incorrect implementation of XEP-0280: Message Carbons0 in multiple XMPP clients allows a remote attacker to impersonate any user, including contacts, in the vulnerabl...

CVE-2017-5390

The JSON viewer in the Developer Tools uses insecure methods to create a communication channel for copying and viewing JSON or HTTP headers data, allowing for potential privilege escalation. This vulnerability affects Thunderbird 45.7, Firefox ESR 45.7, and Firefox 51...

ICMP IP Tunnel: ICMPTunnel

icmptunnel works by encapsulating your IP traffic in ICMP echo packets and sending them to your own proxy server. The proxy server decapsulates the packet and forwards the IP traffic. The incoming IP packets which are destined for the client are again encapsulated in ICMP reply packets and sent...

iBackDoor: High-Risk Code Hits iOS Apps

Introduction FireEye mobile researchers recently discovered potentially “backdoored” versions of an ad library embedded in thousands of iOS apps originally published in the Apple App Store. The affected versions of this library embedded functionality in iOS apps that used the library to display...

Hacking Air-Gapped Computers Using Heat

An air-gapped computer system isolated from the Internet and other computers that are connected to external networks believes to be the most secure computers on the planet -- Yeah?? You need to think again before calling them 'safe'. A group of Israeli security researchers at the Cyber Security...

GLSA-201310-10 : PolarSSL: Multiple vulnerabilities

The remote host is affected by the vulnerability described in GLSA-201310-10 PolarSSL: Multiple vulnerabilities Multiple vulnerabilities have been discovered in PolarSSL. Please review the CVE identifiers referenced below for details. Impact : A remote attacker might be able to cause Denial of...

PolarSSL: Multiple vulnerabilities

Background PolarSSL is a cryptographic library for embedded systems. Description Multiple vulnerabilities have been discovered in PolarSSL. Please review the CVE identifiers referenced below for details. Impact A remote attacker might be able to cause Denial of Service, conduct a man-in-the middl...

CVE-2013-5502

The web interface in Cisco MediaSense does not properly protect the client-server communication channel, which allows remote attackers to obtain sensitive query string or cookie information via unspecified vectors, aka Bug ID CSCuj23344...

CVE-2013-5502

Summary: The Cisco MediaSense web interface contains a vulnerability where the client–server communication is not properly protected, allowing an unauthenticated, remote attacker to collect sensitive information (e.g., query strings and cookies) by intercepting traffic. This is due to an insecure...

CVE-2013-0141

Summary (CVE-2013-0141): A directory traversal vulnerability in McAfee ePolicy Orchestrator (ePO) allows a remote attacker to upload arbitrary files via a crafted request over the Agent-Server communication channel, demonstrated by writing to the Software/ directory. It affects ePO versions prior...