Rovnix Variant Surfaces With New DGA

Researchers have unearthed a new version of the Rovnix malware that has a couple of additional features, including a new domain generation algorithm and a secure transmission channel for communicating with the command-and-control servers. Rovnix is a malware variant that often has been distribute...

[SECURITY] Fedora 20 Update: suricata-2.0.4-1.fc20

The Suricata Engine is an Open Source Next Generation Intrusion Detection and Prevention Engine. This engine is not intended to just replace or emulate the existing tools in the industry, but will bring new ideas and technologies to the field. This new Engine supports Multi-threading, Automatic...

[SECURITY] Fedora 21 Update: suricata-2.0.4-1.fc21

The Suricata Engine is an Open Source Next Generation Intrusion Detection and Prevention Engine. This engine is not intended to just replace or emulate the existing tools in the industry, but will bring new ideas and technologies to the field. This new Engine supports Multi-threading, Automatic...

[SECURITY] Fedora 20 Update: perl-Email-Address-1.905-1.fc20

This class implements a regex-based RFC 2822 parser that locates email addresses in strings and returns a list of Email::Address objects found. Alternatively you may construct objects manually. The goal of this software is to be correct, and very very fast...

[SECURITY] Fedora 19 Update: perl-Email-Address-1.905-1.fc19

This class implements a regex-based RFC 2822 parser that locates email addresses in strings and returns a list of Email::Address objects found. Alternatively you may construct objects manually. The goal of this software is to be correct, and very very fast...

Fast Image Resizer 098 - Local Crash (PoC)

Fast Image Resizer 098 - Local Crash PoC !/usr/bin/perl Title : Fast Image Resizer 098 Local Crash Poc Author: Niko Tested: Windows XP SP3 En Apps : http://adionsoft.net/fastimageresize/FastImageResizer098.exe EAX 00000000 ECX 010422F8 EDX 00000000 EBX 00000000 ESP 0012F658 EBP 00000000 ESI...

CVE-2014-5927

The CVE covers the FastCustomer Android app (v3) which fails to verify X.509 certificates from SSL servers, allowing MITM attackers to spoof servers and access sensitive information via a crafted certificate. The provided documents do not specify affected versions beyond Android app 3 or any reme...

Yokogawa FAST/TOOLS XML External Entity

OVERVIEW Timur Yunusov, Alexey Osipov, and Ilya Karpov of Positive Technologies Inc. have identified an XML external entity processing vulnerability in the Yokogawa FAST/TOOLS application. Yokogawa has produced a service pack that mitigates this vulnerability. AFFECTED PRODUCTS The following...

CVE-2014-5710

The Cisco Class Locator Fast Lane aka com.tabletkings.mycompany.fastlane.cisco application for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

Authentication flaw

The Cisco Class Locator Fast Lane aka com.tabletkings.mycompany.fastlane.cisco application for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

Design/Logic Flaw

The Super Fast Browser aka iron.web.jalepano.browser application 2.0.5.6 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

CVE-2014-5710

The Cisco Class Locator Fast Lane aka com.tabletkings.mycompany.fastlane.cisco application for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

CVE-2014-5775

The Super Fast Browser aka iron.web.jalepano.browser application 2.0.5.6 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

CVE-2014-5710

The CVE-2014-5710 entry refers to the Cisco Class Locator Fast Lane Android app (package com.tabletkings.mycompany.fastlane.cisco) that does not verify X.509 certificates for SSL servers, enabling man-in-the-middle attackers to spoof servers and access sensitive information via crafted certificat...

CVE-2014-5775

CVE-2014-5775 concerns the Android app The Super Fast Browser (iron.web.jalepano.browser) , version 2.0.5.6 , which does not verify X.509 certificates from SSL servers. This allows an attacker to perform a man-in-the-middle attack and obtain sensitive information via a crafted certificate. The av...

Input validation

The CM Browser - Fast & Secure aka com.ksmobile.cb application 5.0.50 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

CVE-2014-5655

CM Browser - Fast & Secure (com.ksmobile.cb) for Android 5.0.50 does not verify X.509 certificates from SSL servers, enabling MITM via crafted certificates. Root cause: lack of server certificate verification in SSL/TLS validation. Impact: potential exposure of sensitive information. Exploitation...

Fast payment and some credit card functions whether there is a defect? Know Bank card number and Expiration Date can consumer-vulnerability warning-the black bar safety net

Someone once broke a credit card just know the card number and expiration date on the CAN in some of the website on any purchase, while various payment products such as tenpay, Alipay launched fast pay only need to provide Bank card number, ID number, name, and phone number can be opened fast...

WAF-FLE v0.6.4 - OpenSource ModSecurity Console

WAF-FLE is a OpenSource ModSecurity Console, allows modsecurity admin to store, view and search events sent by sensors using a graphical dashboard to drill-down and find quickly the most relevant events. It is designed to be fast and flexible, while keeping a powerful and easy to use filter, with...

NewGOZ Gameover Zeus Botnet Rebuilds

It didn’t take long for an updated version of GameOver Zeus to make some headway in rebuilding itself. Research published today from Arbor Networks demonstrates that cybercriminals behind GameOver Zeus, which was taken down by law enforcement in early June, have renewed the botnet with at least...