979 matches found
CVE-2017-9035
Trend Micro ServerProtect for Linux 3.0 before CP 1531 allows attackers to eavesdrop and tamper with updates by leveraging unencrypted communications with update servers...
CVE-2017-9035: Cleartext Transmission of Sensitive Information
Trend Micro ServerProtect for Linux 3.0 before CP 1531 allows attackers to eavesdrop and tamper with updates by leveraging unencrypted communications with update servers...
CVE-2017-9035
Trend Micro ServerProtect for Linux 3.0 (pre-CP 1531) is affected by multiple vulnerabilities in its update mechanism, including: unencrypted update communications allowing eavesdropping and tampering (CVE-2017-9035); unsigned/unvalidated update packages enabling overwrites of libraries and poten...
PT-2017-18658
Name of the Vulnerable Software and Affected Versions Trend Micro ServerProtect for Linux versions 3.0 before CP 1531 Description The issue allows attackers to eavesdrop and tamper with updates by leveraging unencrypted communications with update servers. Recommendations For Trend Micro...
Design/Logic Flaw
The Mxit protocol uses weak encryption when encrypting user passwords, which might allow attackers to 1 decrypt hashed passwords by leveraging knowledge of client registration codes or 2 gain login access by eavesdropping on login messages and re-using the hashed passwords...
UBUNTU-CVE-2016-2379
The Mxit protocol uses weak encryption when encrypting user passwords, which might allow attackers to 1 decrypt hashed passwords by leveraging knowledge of client registration codes or 2 gain login access by eavesdropping on login messages and re-using the hashed passwords...
CVE-2016-2379
The Mxit protocol uses weak encryption when encrypting user passwords, which might allow attackers to 1 decrypt hashed passwords by leveraging knowledge of client registration codes or 2 gain login access by eavesdropping on login messages and re-using the hashed passwords...
CVE-2016-2379: Inadequate Encryption Strength
The Mxit protocol uses weak encryption when encrypting user passwords, which might allow attackers to 1 decrypt hashed passwords by leveraging knowledge of client registration codes or 2 gain login access by eavesdropping on login messages and re-using the hashed passwords...
PT-2017-8046
Name of the Vulnerable Software and Affected Versions Mxit affected versions not specified Description The issue concerns the Mxit protocol, which uses weak encryption for user passwords. This weakness might allow attackers to decrypt hashed passwords by leveraging knowledge of client registratio...
Malware Hijacks Microphones to Spy On Ukrainian Businesses, Scientists and Media
Ukraine has once again been a target of a potential hacking attack that infected computer systems from dozens of Ukrainian businesses with highly sophisticated malware, allowing hackers to exfiltrate sensitive data and eavesdrop on their network. Late last year, the country also suffered a power...
Business LaLa Call App for Android fails to verify SSL server certificates
Overview Business LaLa Call App for Android provided by K-Opticom Corporation fails to verify SSL server certificates. Yuto Iso of NTT Security Japan KK reported this vulnerability to IPA. JPCERT/CC coordinated with the developer under Information Security Early Warning Partnership. Impact A...
Why WhatsApp's 'Backdoor' Isn't a Backdoor
Accusations that WhatsApp has a backdoor intended for eavesdropping on user messages is being loudly rebuked by Facebook-owned WhatsApp and Open Whisper Systems, the company that developed the underlying encryption technology for the platform. Dismissal of the published claims by The Guardian are...
Nextcloud: HTTP-Basic Authentication on logs.nextcloud.com
Greetings, While visiting https://logs.nextcloud.com/ , I noticed that this server use HTTP-Basic Authentication. F152730 POC : ------ GET https://logs.nextcloud.com/ HTTP/1.1 User-Agent: Mozilla/5.0 Macintosh; Intel Mac OS X 10.11; rv:50.0 Gecko/20100101 Firefox/50.0 Accept:...
CVE-2016-9885
An issue was discovered in Pivotal GemFire for PCF 1.6.x versions prior to 1.6.5 and 1.7.x versions prior to 1.7.1. The gfsh Geode Shell endpoint, used by operators and application developers to connect to their cluster, is unauthenticated and publicly accessible. Because HTTPS communications are...
CVE-2016-9885
The CVE-2016-9885 issue affects Pivotal GemFire for PCF (1.6.x < 1.6.5 and 1.7.x
Apple Delays App Transport Security Deadline
Apple backtracked on its plan to enforce a year-end deadline that would of required developers to move apps to an HTTPS-only model in an effort to thwart eavesdropping on insecure, plaintext HTTP connections. On Wednesday Apple said a requirement for developers to adopt App Transport Security wou...
Flash Player Bug An Eavesdropper's Delight
Adobe yesterday patched a not-so-sweet 16 Flash Player vulnerabilities, including a zero day under attack. While not much is known about the targeted attacks using the Flash Player bug, or its victims, details have surfaced on another patched flaw that is a potential privacy nightmare...
Slack: Eavesdropping on private Slack calls
A vulnerability exists in Slack's call functionality that allows a team member to eavesdrop on private ongoing Slack calls by inviting themselves into the conversation without the permission from either participant. By doing so they can eavesdrop on co-workers' private conversations as well as...
Design/Logic Flaw
The mDNIe system service on Samsung Mobile S7 devices with M6.0 software does not properly restrict setmDNIeScreenCurtain API calls, enabling attackers to control a device's screen. This can be exploited via a crafted application to eavesdrop after phone shutdown or record a conversation. The...
CVE-2016-9567: Exposure of Sensitive Information to an Unauthorized Actor
The mDNIe system service on Samsung Mobile S7 devices with M6.0 software does not properly restrict setmDNIeScreenCurtain API calls, enabling attackers to control a device's screen. This can be exploited via a crafted application to eavesdrop after phone shutdown or record a conversation. The...