CVE-2014-6922

The KFAI Community Radio aka com.skyblue.pra.kfai application 2.0.4 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

CVE-2014-6922

The CVE-2014-6922 entry refers to the KFAI Community Radio (Android app, package com.skyblue.pra.kfai) version 2.0.4, which does not verify X.509 certificates when connecting to SSL servers. This behavior enables man-in-the-middle attackers to spoof servers and exfiltrate sensitive information vi...

Design/Logic Flaw

The WebSEAL component in IBM Security Access Manager for Web 7.x before 7.0.0-ISS-WGA-IF0009 and 8.x before 8.0.0-ISS-WGA-FP0005, when e-community SSO is enabled, allows remote attackers to cause a denial of service component hang via unspecified vectors...

[SECURITY] Fedora 20 Update: tomcat-7.0.52-1.fc20

Tomcat is the servlet container that is used in the official Reference Implementation for the Java Servlet and JavaServer Pages technologies. The Java Servlet and JavaServer Pages specifications are developed by Sun under the Java Community Process. Tomcat is developed in an open and participator...

Paypal Inc BB #32 - Multiple Persistent Vulnerabilities

Document Title: =============== Paypal Inc BB 32 - Multiple Persistent Vulnerabilities References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=716 Release Date: ============= 2014-09-22 Vulnerability Laboratory ID VL-ID: ==================================== 716...

Paypal Inc BB #32 - Multiple Persistent Vulnerabilities

Document Title: =============== Paypal Inc BB 32 - Multiple Persistent Vulnerabilities References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=716 Release Date: ============= 2014-09-22 Vulnerability Laboratory ID VL-ID: ==================================== 716...

New Initiative Simply Secure Aims to Make Security Tools Easier to Use

The dramatic revelations of large-scale government surveillance and deep penetration of the Internet by intelligence services and other adversaries have increased the interest of the general public in tools such as encryption software, anonymity services and others that previously were mainly of...

Two final thoughts from the PCI Community Meeting

The 2014 North American PCI Community Meeting has drawn to a close, but the messages and lessons learned will continue to resonate with me long after Ive returned home to Denver. There were two messages from the SSC this week that really struck a chord with me and I wanted to expand on why I thin...

CVE-2012-4240

SQL injection vulnerability in modules/calendar/json.php in Group-Office community before 4.0.90 allows remote authenticated users to execute arbitrary SQL commands via the sort parameter...

CVE-2012-4240

SQL injection vulnerability in modules/calendar/json.php in Group-Office community before 4.0.90 allows remote authenticated users to execute arbitrary SQL commands via the sort parameter...

CVE-2012-4240

Group-Office Calendar SQL Injection (CVE-2012-4240) affects Group-Office community versions prior to 4.0.90. The vulnerability lies in modules/calendar/json.php where the sort parameter is unsafely injected into an ORDER BY SQL clause. An authenticated user can exploit this to cause database erro...

PCI Community Meeting Keynote

Admiral James Stavridis delivered this mornings PCI Community Meeting keynote presentation, Sailing the Cyber Sea: The New Realities of 21st Century Security to an engaged and near-capacity crowd. Admiral Stavridis, a four-star admiral and former NATO Supreme Allied Commander, touched briefly on...

Forensics Session Takeaways from Day 2

Day two of the PCI Community Meeting presented an array of security topics ranging from best practices, EMV, security awareness, and more. I had the pleasure of sitting in on a forensics presentation, which leveraged information from a variety of industry leaders and provided valuable insight int...

PCI Community Meeting - EMV Chip Update

Randy Vanderhoof, Executive Director, EMV Migration Forum EMF, presented the EMV Chip Update today at Day Two of the PCI Community Meeting. The session provided attendees with insights into the EMV chip migration process in the U.S. and how this impacts PCI security efforts...

Mozilla 1024-Bit Deprecation Leaves 107,000 Sites Untrusted

When Firefox 32 shipped this week, Mozilla also officially ended its support of 1024-bit certificate authority certificates in its trusted store. While it still takes a considerable amount of resources to factor and crack a 1024-bit RSA key, important organizations such as NIST have been advising...

SNMP Authorization

This script allows users to enter the information required to authorize and login via SNMP. These data are used by tests that require authentication. SPDX-FileCopyrightText: 2014 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respectiv...

ARRIS / Motorola SBG6580 Cable Modem SNMP Enumeration Module

This module allows SNMP enumeration of the ARRIS / Motorola SURFboard SBG6580 Series Wi-Fi Cable Modem Gateway. It supports the username and password for the device user interface as well as wireless network keys and information. The default community used is "public". This module requires...

Community Health data leak suspected of the use of the Heartbleed vulnerability-a vulnerability warning-the black bar safety net

When the Heartbleed OpenSSL vulnerability in 4 months is discovered, the security community many experts are warning that the vulnerability could be used to expose sensitive data, although at the time also there is no evidence that attackers are actively using Heartbleed vulnerability. And now, a...

Heartbleed Aftershocks: Community Health Systems Breach, 4.5 Million Records Lost

The news this week that hackers from China compromised 4.5 million customer records held by Community Health Systems is just the latest indication that companies are not adequately protecting the information of the consumers they serve...

Heartbleed Exploit Linked to Community Health Data Breach

Update: The Heartbleed OpenSSL vulnerability is now the centerpiece of the Community Health Systems data breach. Dave Kennedy, CEO of security consultancy TrustedSec, said yesterday that three sources close to the CHS investigation told him that a Heartbleed exploit was the hackers’ initial way i...