Design/Logic Flaw

Comcast XFINITY WiFi Home Hotspot devices allow remote attackers to spoof the identities of Comcast customers via a forged MAC address...

bind: An error in TSIG authentication can permit unauthorized dynamic updates

A flaw was found in the way BIND handled TSIG authentication for dynamic updates. A remote attacker able to communicate with an authoritative BIND server could use this flaw to manipulate the contents of a zone, by forging a valid TSIG or SIG0 signature for a dynamic update request...

IPv6 Address Spoofing: sylkie

IPv6 Address Spoofing A command line tool and library for testing networks for common address spoofing security vulnerabilities in IPv6 networks using the Neighbor Discovery Protocol. Getting Started Dependencies libseccomp json-c Build Get the code and compile it! Get the code git clone...

CVE-2017-9591

The "PCB Mobile" by Phelps County Bank app 3.0.2 -- aka pcb-mobile/id436891295 for iOS does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

CVE-2016-8231: Improper Certificate Validation

In Lenovo Service Bridge before version 4, a bug found in the signature verification logic of the code signing certificate could be exploited by an attacker to insert a forged code signing certificate...

PT-2017-9546

Name of the Vulnerable Software and Affected Versions Lenovo Service Bridge versions prior to 4 Description A bug was found in the signature verification logic of the code signing certificate in Lenovo Service Bridge, which could be exploited by an attacker to insert a forged code signing...

Warner Bros. ellentube app for iOS authentication vulnerability

Warner Bros. ellentube app for iOS is an iOS-based video playback app from Warner Bros. An authentication vulnerability exists in versions 3.1.1 through 3.1.3 of the Warner Bros. ellentube app for iOS, which stems from the program's failure to validate an X.509 certificate on the server side of a...

CVE-2017-8935

The Quest Information Systems Indiana Voters app 1.1.24 for iOS does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

libevent: Stack-buffer overflow in the name_parse() function

A vulnerability was found in libevent with the parsing of DNS requests and replies. An attacker could send a forged DNS response to an application using libevent which could lead to reading data out of bounds on the heap, potentially disclosing a small amount of application memory...

Apple iOS webkit address bar forgery vulnerability

Apple iOS is an operating system for Apple smart devices. A spoofing vulnerability exists in the address bar of the Webkit user interface used by Apple iOS, which allows an attacker to construct malicious links and trick users into clicking on them, which can spoof the address bar...

Cross site request forgery (csrf)

e107 2.1.4 is vulnerable to cross-site request forgery in plugin-installing, meta-changing, and settings-changing. A malicious web page can use forged requests to make e107 download and install a plug-in provided by the attacker...

libevent: Stack-buffer overflow in the name_parse() function

A vulnerability was found in libevent with the parsing of DNS requests and replies. An attacker could send a forged DNS response to an application using libevent which could lead to reading data out of bounds on the heap, potentially disclosing a small amount of application memory...

Code injection

Huawei Tecal RH1288 V2 V100R002C00SPC107 and earlier versions, Tecal RH2265 V2 V100R002C00, Tecal RH2285 V2 V100R002C00SPC115 and earlier versions, Tecal RH2265 V2 V100R002C00, Tecal RH2285H V2 V100R002C00SPC111 and earlier versions, Tecal RH2268 V2 V100R002C00, Tecal RH2288 V2 V100R002C00SPC117...

CVE-2014-9692

Huawei Tecal RH1288 V2 V100R002C00SPC107 and earlier versions, Tecal RH2265 V2 V100R002C00, Tecal RH2285 V2 V100R002C00SPC115 and earlier versions, Tecal RH2265 V2 V100R002C00, Tecal RH2285H V2 V100R002C00SPC111 and earlier versions, Tecal RH2268 V2 V100R002C00, Tecal RH2288 V2 V100R002C00SPC117...

CVE-2014-9692

Huawei Tecal RH1288 V2 V100R002C00SPC107 and earlier versions, Tecal RH2265 V2 V100R002C00, Tecal RH2285 V2 V100R002C00SPC115 and earlier versions, Tecal RH2265 V2 V100R002C00, Tecal RH2285H V2 V100R002C00SPC111 and earlier versions, Tecal RH2268 V2 V100R002C00, Tecal RH2288 V2 V100R002C00SPC117...

CVE-2014-9692: Exposure of Sensitive Information to an Unauthorized Actor

Huawei Tecal RH1288 V2 V100R002C00SPC107 and earlier versions, Tecal RH2265 V2 V100R002C00, Tecal RH2285 V2 V100R002C00SPC115 and earlier versions, Tecal RH2265 V2 V100R002C00, Tecal RH2285H V2 V100R002C00SPC111 and earlier versions, Tecal RH2268 V2 V100R002C00, Tecal RH2288 V2 V100R002C00SPC117...

Huawei VCM5010 Forensic Bypass Vulnerability

VCM5010 is a video content management platform from China's Huawei Huawei, an all-in-one video big data analysis device. The Huawei VCM5010 suffers from an authentication bypass vulnerability, which allows an attacker to bypass authentication by spoofing HTTP requests due to improper validation o...

CVE-2016-8005

File extension filtering vulnerability in Intel Security McAfee Email Gateway MEG before 7.6.404h1128596 allows attackers to fail to identify the file name properly via scanning an email with a forged attached filename that uses a null byte within the filename extension...

Design/Logic Flaw

File extension filtering vulnerability in Intel Security McAfee Email Gateway MEG before 7.6.404h1128596 allows attackers to fail to identify the file name properly via scanning an email with a forged attached filename that uses a null byte within the filename extension...

Yahoo Tells SEC Executives Failed to Act on Breach

Yahoo’s quarterly SEC filings have been the only window into the massive data breaches that have exposed more than 1.5 billion records in the past four years. This week, Yahoo’s Q4 2016 filing was made public, and the view got uglier. The company admitted to the SEC and its investors that its...