884 matches found
JR East Japan App for Android. contains an issue where it fails to verify SSL server certificates
Overview JR East Japan App for Android. contains an issue where it fails to verify SSL server certificates. Akihisa Ishida reported this vulnerability to IPA. JPCERT/CC coordinated with the developer under Information Security Early Warning Partnership. Impact A man-in-the-minddle attack may allo...
JVN#10603428: JR East Japan App for Android. contains an issue where it fails to verify SSL server certificates
JR East Japan App for Android. contains an issue where it fails to verify SSL server certificates. Impact A man-in-the-middle attack may allow an attacker to eavesdrop on an encrypted communication. Solution Update the Software Update to the latest version according to the information provided by...
OpenSSL improper handling of Change Cipher Spec message
Overview OpenSSL improperly handles Change Cipher Spec message in the initial SSL/TLS handshake. OpenSSL contains a flaw in the implementation of the Change Cipher Spec protocol that allows a MITM man-in-the-middle attacker to force a server and a client to use easily guessable cryptgraphic key...
Cyber Intelligence Asia 2014: CERTs and Industrial Security
In March I spoke at Cyber Intelligence Asia 2014, where CERTs from most Asians countries were presented. The fact is that only a few CERTs are now dealing in some way with industrial security, ICS and SCADA matters. One of the best of those is CERT of Japan, which is doing a great job here, and...
JVN#87797318: XooNIps vulnerable to cross-site scripting
XooNIps provided by Neuroinformatics Japan Center, RIKEN Brain Science Institute is a module of XOOPS. XooNIps contains an issue in processing the output of input character string to the web page, which may result in a cross-site scripting vulnerability. Impact An arbitrary script may be executed...
CVE-2013-6035
CVE-2013-6035 affects satellite terminals from Harris (BGAN RF-7800B-VU204, RF-7800B-DU204), Hughes (9201, 9450, 9502), Thuraya IP, Inmarsat, and Japan Radio JUE-250/JUE-500. The issue: firmware allows unauthenticated sessions on TCP port 1827 through an insecure proprietary protocol, enabling an...
Hughes Network Systems Broadband Global Area Network (BGAN) satellite terminal firmware contains multiple vulnerabilities
Overview Firmware developed by Hughes Network Systems used in a number of BGAN satellite terminals contains undocumented hardcoded login credentials CWE-798. Additionally, the firmware contains an insecure proprietary communications protocol, likely a debugging service, that allows unauthenticate...
CVE-2013-5998
Unspecified vulnerability in the Web manager implementation on D-Link Japan DES-3800 devices with firmware before R4.50B58 allows remote attackers to cause a denial of service device hang via unknown vectors, a different vulnerability than CVE-2013-5997...
Design/Logic Flaw
Unspecified vulnerability in the SSH implementation on D-Link Japan DES-3800 devices with firmware before R4.50B58 allows remote authenticated users to cause a denial of service device hang via unknown vectors, a different vulnerability than CVE-2013-5998...
CVE-2013-5998
Unspecified vulnerability in the Web manager implementation on D-Link Japan DES-3800 devices with firmware before R4.50B58 allows remote attackers to cause a denial of service device hang via unknown vectors, a different vulnerability than CVE-2013-5997...
CVE-2013-5997
Unspecified vulnerability in the SSH implementation on D-Link Japan DES-3800 devices with firmware before R4.50B58 allows remote authenticated users to cause a denial of service device hang via unknown vectors, a different vulnerability than CVE-2013-5998...
Hacker 'Pinkie Pie' successfully compromised Chrome on Nexus 4 and Samsung Galaxy S4
A Mysterious Hacker who goes by the "Pinkie Pie" handle is rewarded with $50,000 USD for hacking into the Google Chrome browser for Nexus 4 and Samsung Galaxy S4. At Information Security Conference PacSec 2013 in Tokyo, during the HP's Pwn2Own contest, a zero-day exploit showcased by "Pinkie Pie"...
Authentication flaw
The PPP Access Concentrator PPPAC in Internet Initiative Japan Inc. SEIL/x86 1.00 through 2.80, SEIL/X1 1.00 through 4.30, SEIL/X2 1.00 through 4.30, SEIL/B1 1.00 through 4.30, SEIL/Turbo 1.80 through 2.15, and SEIL/neu 2FE Plus 1.80 through 2.15 generates predictable random numbers, which allows...
CVE-2013-4708
The CVE-2013-4708 issue affects SEIL Series routers from Internet Initiative Japan Inc. The vuln arises from predictable random-number generation in the PPP Access Concentrator (PPPAC) when performing RADIUS authentication, allowing remote attackers who can sniff RADIUS traffic to bypass authenti...
MS13-080 Microsoft Internet Explorer SetMouseCapture Use-After-Free
This module exploits a use-after-free vulnerability that currents targets Internet Explorer 9 on Windows 7, but the flaw should exist in versions 6/7/8/9/10/11. It was initially found in the wild in Japan, but other regions such as English, Chinese, Korean, etc, were targeted as well. The...
Chinese APT Espionage campaign, dubbed 'Icefog' targeted Military contractors and Governments
Kaspersky Lab has identified another Chinese APT campaign, dubbed ‘Icefog’, who targeted Governmental institutions, Military contractors, maritime / shipbuilding groups, telecom operators, industrial and high technology companies and mass media. The Hacking group behind the attack who carry out...
Icefog Targeted APT Attacks Hit South Korea, Japan
An espionage campaign featuring precise targeting of victims and malware that allows the attackers one-on-one interaction with compromised systems has been uncovered. Government agencies, manufacturers, high tech companies and media organizations in South Korea and Japan have been the primary...
IE Zero Day Used in Targeted Attacks Against Japanese Firms
Attackers exploiting a zero-day vulnerability in Microsoft’s Internet Explorer browser have compromised several popular local Japanese media outlets and have infected systems belonging to government, high tech and manufacturing organizations in Japan. Researchers at FireEye said the attacks appea...