CVE-2019-2961

Vulnerability in the Oracle Solaris product of Oracle Systems component: SMF services & legacy daemons. The supported version that is affected is 11. Difficult to exploit vulnerability allows low privileged attacker with logon to the infrastructure where Oracle Solaris executes to compromise Orac...

Checkrain fake iOS jailbreak leads to click fraud

By Warren Mercer and Paul Rascagneres. Introduction Attackers are capitalizing on the recent discovery of a new vulnerability that exists across legacy iOS hardware. Cisco Talos recently discovered a malicious actor using a fake website that claims to give iPhone users the ability to jailbreak...

What The Actual WAF!?

InfoSec Family, we need to talk!! Every so often, there is a technological shift in the information security industry. Sometimes it is due to new cyberattack discovery, aka a Zero-day. Many times, the catalyst is legacy technology. When a legacy technology no longer adequately responds to the...

F5 Networks BIG-IP : BIG-IP APM client for Windows vulnerability (K10015187)

Windows Logon Integration feature of F5 BIG-IP APM client prior to version 7.1.7.1 for Windows by default uses Legacy logon mode which uses a SYSTEM account to establish network access. This feature displays a certificate user interface dialog box which contains the link to the certificate policy...

TLS version enforcement capabilities now available per certificate binding on Windows Server 2019

At Microsoft, we often develop new security features to meet the specific needs of our own products and online services. This is a story about how we solved a very important problem and are sharing the solution with customers. As engineers worldwide work to eliminate their own dependencies on TLS...

Why Should CISOs Care About XDR?

We have been collectively saying in our industry for the last 15-20 years that a layered approach to your security stack is a “best practice,” but as with all best practices, these are ideals rather than reality for so many charged with protecting their organizations. The vast majority of CISOs a...

Mail.ru: CSRF in attach phone API endpoint on delivery-club.ru

Legacy delivery-club.ru API endpoint allowed to attach arbitrary phone without checking the validation code and without additional CSRF protection...

Valve: SQL injection in /errors/viewbuild/

A SQL injection vulnerability was discovered in a partner-facing tool that allowed queries against a legacy backing store...

firefox: stored passwords in 'Saved Logins' can be copied without master password entry

When a master password is set, it is required to be entered again before stored passwords can be accessed in the 'Saved Logins' dialog. It was found that locally stored passwords can be copied to the clipboard thorough the 'copy password' context menu item without re-entering the master password ...

Fedora 29 : 6:kdelibs / kde-settings (2019-39d23c7a94)

This update fixes CVE-2019-14744 kconfig arbitrary shell code execution in the compatibility library kdelibs 4 used by legacy applications not yet ported to KDE Frameworks 5. The included kde-settings update removes obsolete settings that conflict with the security fix and are no longer needed se...

CVE-2019-10059

The legacy finger service TCP port 79 is enabled by default on various older Lexmark devices...

CVE-2019-10059

The legacy finger service TCP port 79 is enabled by default on various older Lexmark devices...

Design/Logic Flaw

The legacy finger service TCP port 79 is enabled by default on various older Lexmark devices...

CVE-2019-10059

The legacy finger service TCP port 79 is enabled by default on various older Lexmark devices...

CVE-2019-10059

The CVE-2019-10059 entry concerns the legacy finger service (TCP port 79) enabled by default on various older Lexmark devices. Multiple connected sources confirm this configuration across Lexmark printers and related hardware, with no public exploit details provided in the supplied documents. The...

CVE-2019-11602

Leakage of stack traces in remote access to backup & restore in earlier versions than ProSyst mBS SDK 8.2.6 and Bosch IoT Gateway Software 9.2.0 allows remote attackers to gather information about the file system structure...

CVE-2019-5034

An exploitable information disclosure vulnerability exists in the Weave Legacy Pairing functionality of Nest Cam IQ Indoor version 4620002. A set of specially crafted weave packets can cause an out of bounds read, resulting in information disclosure. An attacker can send packets to trigger this...

CVE-2019-5034

An exploitable information disclosure vulnerability exists in the Weave Legacy Pairing functionality of Nest Cam IQ Indoor version 4620002. A set of specially crafted weave packets can cause an out of bounds read, resulting in information disclosure. An attacker can send packets to trigger this...

Information disclosure

An exploitable information disclosure vulnerability exists in the Weave Legacy Pairing functionality of Nest Cam IQ Indoor version 4620002. A set of specially crafted weave packets can cause an out of bounds read, resulting in information disclosure. An attacker can send packets to trigger this...

CVE-2019-5034

An exploitable information disclosure vulnerability exists in the Weave Legacy Pairing functionality of Nest Cam IQ Indoor version 4620002. A set of specially crafted weave packets can cause an out of bounds read, resulting in information disclosure. An attacker can send packets to trigger this...