Security Bulletin: OpenSSL security vulnerabilities in IBM Storwize V7000 Unified (CVE-2014-3570, CVE-2014-3571, CVE-2014-3572, CVE-2014-8275, CVE-2015-0204, CVE-2015-0205, CVE-2015-0206)

Summary A fix is available for IBM Storwize V7000 Unified, for the OpenSSL security vulnerabilities found in January 2015. Vulnerability Details OpenSSL is used in IBM Storwize V7000 Unified for providing communication security by encrypting data being transmitted. CVEID: CVE-2014-3570 DESCRIPTIO...

Code injection

IBM BigFix Platform 9.2 and 9.5 transmits sensitive or security-critical data in clear text in a communication channel that can be sniffed by unauthorized actors. IBM X-Force ID: 143745...

CVE-2018-1600

IBM BigFix Platform 9.2 and 9.5 transmits sensitive or security-critical data in clear text in a communication channel that can be sniffed by unauthorized actors. IBM X-Force ID: 143745...

The Internet of Everything and digital privacy: what you need to know

If you don’t already own Internet of Things IoT devices, you likely will soon. IoT-enabled devices are physical gadgets with built-in Internet connectivity that allow data transmission; often this happens in the background with no indication to the user that anything is happening. The IoT is more...

Papenmeier WiFi Baby Monitor Free Lite 2.02.2 - Remote Audio Record

Papenmeier WiFi Baby Monitor Free Lite 2.02.2 - Remote Audio Record Whilst analysing a number of free communication based applications on the Google Play Store, I took a look at WiFi Baby Monitor: Free & Lite the free version of WiFi Baby Monitor. Although the premium version offered users the...

CVE-2017-15998

In the "NQ Contacts Backup & Restore" application 1.1 for Android, DES encryption with a static key is used to secure transmitted contact data. This makes it easier for remote attackers to obtain cleartext information by sniffing the network...

CVE-2017-15998

In the "NQ Contacts Backup & Restore" application 1.1 for Android, DES encryption with a static key is used to secure transmitted contact data. This makes it easier for remote attackers to obtain cleartext information by sniffing the network...

CVE-2017-15999

In the "NQ Contacts Backup & Restore" application 1.1 for Android, no HTTPS is used for transmitting login and synced user data. When logging in, the username is transmitted in cleartext along with an SHA-1 hash of the password. The attacker can either crack this hash or use it for further attack...

CVE-2017-15581

CVE-2017-15581 affects the Android application Diary with lock (WriteDiary) version 4.72. The issue is that neither HTTPS nor other encryption is used for transmitting data during LoginActivity or NoteActivity, despite product documentation indicating it’s for sensitive personal information. This...

CVE-2017-5652

The CVE-2017-5652 entry concerns Apache Impala (incubating) versions 2.7.0–2.8.0 where one port used by the StatestoreSubscriber did not employ the secure Thrift transport when TLS was enabled. This allowed an attacker with network access to eavesdrop on plaintext data traversing that port, const...

CVE-2016-0238

IBM Security Guardium 9.0, 9.1, 9.5, 10.0, and 10.1 transmits sensitive data in cleartext in the query of the request. This could allow an attacker to obtain sensitive information using man in the middle techniques. IBM X-Force ID: 110409...

CVE-2016-0238

CVE-2016-0238 affects IBM Security Guardium 9.0/9.1/9.5 and 10.0/10.1 (including 10.1.2). Root cause: cleartext transmission of sensitive data in the query of the request, enabling potential MITM access to sensitive information. Impact: confidentiality impact (low per CVSS 3.0) with no integrity ...

CVE-2016-0238

IBM Security Guardium 9.0, 9.1, 9.5, 10.0, and 10.1 transmits sensitive data in cleartext in the query of the request. This could allow an attacker to obtain sensitive information using man in the middle techniques. IBM X-Force ID: 110409...

Code injection

The L2TP Client in MikroTik RouterOS versions 6.83.3 and 6.37.4 does not enable IPsec encryption after a reboot, which allows man-in-the-middle attackers to view transmitted data unencrypted and gain access to networks on the L2TP server by monitoring the packets for the transmitted data and...

Intel® Ethernet Controller X710/XL710 NVM Security Vulnerability

Summary: A security vulnerability in the Intel® Ethernet Controller X710, Intel® Ethernet Controller XL710 family of products Fortville and Intel® Ethernet Connection X722 has been found in the Non-Volatile Flash Memory NVM image. Description: A security vulnerability in the Intel® Ethernet...

Doing things the NTP----CVE-2016-7434 vulnerability analysis-vulnerability warning-the black bar safety net

The NTP Protocol Analysis with CVE-2016-7434 About the client and the NTP server, the NTP Protocol interaction, the synchronous time of process I is no longer described in detail, with a pair of figure can be a brief description of the time synchronization process, in this process, the data take...

QQ browser privacy disclosure report-vulnerability warning-the black bar safety net

0x00 description QQ browser is Tencent development of a web browser, for Android, Windows, Mac and iOS and other platforms. Compared to the built-in browser, QQ browser provides richer functionality, for example, increase the tag window, and integrating the chat platform, etc. In the report a...

Midea's i+ smart refrigerator has design logic flaws

The Midea i+ Smart Refrigerator is a smart home appliance developed by Midea Group. Midea's i+ Smart Refrigerator is susceptible to man-in-the-middle attacks due to the insecure protocol for transmitting data and the lack of validation of what is transmitted on the client and server side. The lac...

Apple testing Ultra-Fast Li-Fi Wireless Technology for Future iPhones

Apple to make future iPhones compatible with a cutting-edge technology that has the capability to transmit data at 100 times the speed of WiFi, suggests the code found within the iOS firmware. Apple may ship future iPhones with Li-Fi capabilities, a new technology that may end up replacing the...

ownCloud: apps.owncloud.com: SSL Session cookie without secure flag set

URL: https://apps.owncloud.com/usermanager/login.php Issue detail The following cookie was issued by the application and does not have the secure flag set: PHPSESSID=27caghhkfjvuso3mmiqajqt2n4; path=/; HttpOnly The cookie appears to contain a session token, which may increase the risk associated...