CVE-2014-4428

CVE-2014-4428 concerns Bluetooth HID Low Energy on Apple OS X prior to 10.10, where unencrypted HID LE connections could allow a previously paired device to spoof a legitimate HID device. The issue is a lack of encryption during HID LE pairing/communication, enabling potential impersonation witho...

CVE-2014-4428

Bluetooth in Apple OS X before 10.10 does not require encryption for HID Low Energy devices, which allows remote attackers to spoof a device by leveraging previous pairing...

CVE-2014-4428: Undefined Security Weakness

Bluetooth in Apple OS X before 10.10 does not require encryption for HID Low Energy devices, which allows remote attackers to spoof a device by leveraging previous pairing...

PT-2014-5892

Name of the Vulnerable Software and Affected Versions Apple OS X versions prior to 10.10 Description The issue allows remote attackers to spoof a device by leveraging previous pairing, as Bluetooth in the affected system does not require encryption for HID Low Energy devices. Recommendations For...

Effects full version Windows: iSIGHT surveillance espionage found Windows latest 0day vulnerabilities-vulnerability warning-the black bar safety net

the iSIGHT in Russian cyber-espionage discovered to affect all versions of Windows System with the latest 0day vulnerabilities, vulnerability number CVE-2 0 1 4-4 1 1 4, At present, Microsoft is the emergency of the vulnerability of making the patch. ! Yesterday, Microsoft partners iSIGHT Partner...

Sandworm APT Team Found Using Windows Zero Day Vulnerability

UPDATE–A cyberespionage team, possibly based in Russia, has been using a Windows zero day vulnerability to target a variety of organizations in several countries, including the United States, Poland, Ukraine and western Europe. The vulnerability, which will be patched today by Microsoft, is...

CVE-2014-6002

The DTE Energy aka com.dteenergy.mydte application 3.0.3 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

Information disclosure

The DTE Energy aka com.dteenergy.mydte application 3.0.3 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

CVE-2014-6002

The DTE Energy aka com.dteenergy.mydte application 3.0.3 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

CVE-2014-6002

The CVE-2014-6002 entry concerns the DTE Energy (com.dteenergy.mydte) Android app, version 3.0.3, which does not verify X.509 certificates when connecting to SSL servers. This weakness allows an attacker performing a man-in-the-middle attack to spoof servers and access sensitive information via a...

CVE-2014-6002: Undefined Security Weakness

The DTE Energy aka com.dteenergy.mydte application 3.0.3 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

PT-2014-6987

Name of the Vulnerable Software and Affected Versions DTE Energy application version 3.0.3 Description The issue allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate, as the application does not verify X.509 certificates from SSL servers...

用友人力资源管理软件SQL注入漏洞（无需登录，影响所有版本）

简要描述： 详细说明： 用友软件： 涉及客户非常多。都是大型国企、银行、能源、金融重要单位。 举例如下： 大连银行 http://zpyc.bankofdl.com 顺德农商行 http://career.sdebank.com 中国海洋石油总公司 http://zhaopin.cnooc.com.cn 北京市建筑设计研究院 www.biad.com.cn:88/ 民生银行 http://ehr.creditcard.cmbc.com.cn 中国中铁 http://61.232.6.108/ ....等等单位 直接谷歌搜 inurl:hrss/login.jsp inurl:hrss/r...

Trio of Flaws Haunts OleumTech Wireless Monitoring System

Researchers have identified several remotely exploitable vulnerabilities in a wireless remote monitoring product from OleumTech that is used in energy, water and other critical infrastructure sectors. Two of the three flaws are related to the encryption implementation in the affected products,...

New Variant of Havex Malware Scans for OPC Servers at SCADA Systems

At the beginning of the month, we have reported about the new surge of a Stuxnet-like malware “Havex”, which was previously targeting organizations in the energy sector, had been used to carry out industrial espionage against a number of companies in Europe and compromised over 1,000 European and...

Havex, It’s Down With OPC

FireEye recently analyzed the capabilities of a variant of Havex referred to by FireEye as “Fertger” or “PEACEPIPE”, the first publicized malware reported to actively scan OPC servers used for controlling SCADA Supervisory Control and Data Acquisition devices in critical infrastructure e.g., wate...

Motives Behind Havex ICS Malware Campaign Remain a Mystery

Since Stuxnet there have been few confirmed reports of malware targeting particular industrial control system software. But now we have a campaign using the Havex remote access Trojan that has three European energy sector vendors in its crosshairs—or does it? The outbreak, reported by security...

Accuenergy Acuvim II Authentication Vulnerabilities

OVERVIEW This advisory was originally posted to the US-CERT secure Portal library on October 2, 2014, and is being released to the ICS-CERT web site. Independent researcher Laisvis Lingvevicius has identified two authentication vulnerabilities within the Accuenergy AXM-NET Ethernet module’s web...

Miniduke APT Campaigh Returns with New Targets, Hacking Tools

The Miniduke advanced persistent threat APT campaign uncovered by researchers at Kaspersky Lab and CrySys Lab in February 2013 is back after a year-long hiatus in which attacks abated almost entirely. While the initial Miniduke operations primarily targeted government organizations in Europe, thi...

Dragonfly Russian Hackers Target 1000 Western Energy Firms

Gone are the days when cyber criminals focuses only on PCs to spread malwares and target people, whether it’s ordinary or a high profile person. Nowadays, organizations in the energy sector have become an interesting target for cyber minds. Few days ago, security researchers uncovered a...