Technical Deep Dive Into SolarWinds Breach

Many organizations have been compromised by the recent SolarWinds breach, which seems to be a targeted attack against both government and private agencies. The complete scale of this attack is still unknown, but what is known is that the hackers gained access to victims’ systems via malicious...

SolarWinds advanced cyberattack: What happened and what to do now

We learned more about the sophisticated attack first disclosed on December 8 when security firm FireEye reported it had been the victim of a state-sponsored adversary that stole Red Team assessment tools. On December 13 there was a new development when IT company SolarWinds announced it had been...

CVE-2020-15604

An incomplete SSL server certification validation vulnerability in the Trend Micro Security 2019 v15 consumer family of products could allow an attacker to combine this vulnerability with another attack to trick an affected client into downloading a malicious update instead of the expected one...

CVE-2020-15604

An incomplete SSL server certification validation vulnerability in the Trend Micro Security 2019 v15 consumer family of products could allow an attacker to combine this vulnerability with another attack to trick an affected client into downloading a malicious update instead of the expected one...

Design/Logic Flaw

An incomplete SSL server certification validation vulnerability in the Trend Micro Security 2019 v15 consumer family of products could allow an attacker to combine this vulnerability with another attack to trick an affected client into downloading a malicious update instead of the expected one...

Design/Logic Flaw

An incomplete SSL server certification validation vulnerability in the Trend Micro Security 2019 v15 consumer family of products could allow an attacker to combine this vulnerability with another attack to trick an affected client into downloading a malicious update instead of the expected one...

CVE-2020-24560

An incomplete SSL server certification validation vulnerability in the Trend Micro Security 2019 v15 consumer family of products could allow an attacker to combine this vulnerability with another attack to trick an affected client into downloading a malicious update instead of the expected one...

CVE-2020-15604

An incomplete SSL server certification validation vulnerability in the Trend Micro Security 2019 v15 consumer family of products could allow an attacker to combine this vulnerability with another attack to trick an affected client into downloading a malicious update instead of the expected one...

Trend Micro Security 2019 Incomplete SSL Server Authentication Validation Vulnerability (CNVD-2021-08558)

Trend Micro Security 2019 is a suite of computer security protection software from Trend Micro. A security vulnerability exists in the version of Trend Micro Security 2019 v15.0 that can be exploited by an attacker in conjunction with another attack to trick affected clients into downloading a...

Trend Micro Security 2019 Incomplete SSL Server Authentication Validation Vulnerability

Trend Micro Security 2019 is a suite of computer security protection software from Trend Micro. A security vulnerability exists in the version of Trend Micro Security 2019 v15.0 that can be exploited by an attacker in conjunction with another attack to trick affected clients into downloading a...

CVE-2019-12804

In Hunesion i-oneNet version 3.0.7 3.0.53 and 4.0.4 4.0.16, due to the lack of update file integrity checking in the upgrade process, an attacker can craft malicious file and use it as an update...

Code injection

All versions of Hangzhou Xiongmai Technology Co., Ltd XMeye P2P Cloud Server do not encrypt all device communication. This includes the XMeye service and firmware update communication. This could allow an attacker to eavesdrop on video feeds, steal XMeye login credentials, or impersonate the upda...

Authentication flaw

Due to the lack of firmware authentication in the upgrade process of T&W WIFI Repeater BE126 devices, an attacker can craft a malicious firmware and use it as an update...

CVE-2018-9232

Due to the lack of firmware authentication in the upgrade process of T&W WIFI Repeater BE126 devices, an attacker can craft a malicious firmware and use it as an update...

eQ-3 AG HomeMatic CCU2 Malicious Firmware Update Vulnerability

The eQ-3 AG Homematic CCU2 is a central control unit for controlling smart home devices from eQ-3 Germany. A security vulnerability in the /usr/local/etc/config/addons/mh/loopupd.sh file in the eQ-3 AG Homematic CCU2 version 2.29.22 stems from the program's failure to provide cryptographic...

McAfee VirusScan Enterprise for Linux authentication token brute force

Added: 12/23/2016 CVE: CVE-2016-8023 BID: 94823 Background McAfee VirusScan Enterprise for Linux is real-time, anti-malware software for Linux. Problem McAfee VirusScan Enterprise for Linux allows remote attackers to execute arbitrary commands by exploiting multiple vulnerabilities, including the...

Mozilla Patching Firefox Certificate Pinning Vulnerability

Mozilla is expected tomorrow to patch a critical vulnerability in Firefox’s automated update process for extensions that should put the wraps on a confusing set of twists surrounding this bug. The flaw also affected the Tor Browser and was patched Friday by the Tor Project. The vulnerability firs...

Grandstream Wave Update Redirection Vulnerability

Grandstream Wave is a suite of free VoIP applications. Grandstream Wave uses an insecure connection to download update information, which can be exploited by an attacker to perform a redirection attack and trick users into downloading a malicious update package...

Grandstream Wave Redirection Vulnerability

Grandstream Wave is a free VoIP application from Grandstream. The application supports multiple accounts, simultaneous use of multiple lines, and more. A redirection vulnerability exists in Grandstream Wave version 1.0.1.26, which originates when the program uses an unsecured connection to downlo...

Important: Red Hat Security Advisory: yum-updatesd security update

An updated yum-updatesd package that fixes one security issue is now available for Red Hat Enterprise Linux 5. The Red Hat Security Response Team has rated this update as having Important security impact. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity ratin...