Multiple ThinkServer System Manager (TSM) *50-series Security Weaknesses - Lenovo Support US

No description provided...

Multiple ThinkServer System Manager (TSM) *50-series Security Weaknesses

Lenovo Security Advisory: LEN-2015-024 Potential Impact: Unauthorized Access; Escalation of Privilege; Denial of Service; Man-in-the-Middle MitM Attack Severity: High Summary: Multiple security weaknesses were discovered in the ThinkServer System Manager TSM Baseboard Management Controller for th...

MS16-072: Description of the security update for Group Policy: June 14, 2016

None None...

Group Policy Elevation of Privilege Vulnerability

An elevation of privilege vulnerability exists when Microsoft Windows processes group policy updates. An attacker who successfully exploited this vulnerability could potentially escalate permissions or perform additional privileged actions on the target machine. To exploit this vulnerability, an...

MS16-072: Security update for Group Policy: June 14, 2016

Resolves a vulnerability in Windows that could allow elevation of privilege if an attacker launches a man-in-the-middle MiTM attack against the traffic passing between a domain controller and the target machine.SummaryThis security update resolves a vulnerability in Microsoft Windows. The...

CVE-2013-7440

The ssl.matchhostname function in CPython aka Python before 2.7.9 and 3.x before 3.3.3 does not properly handle wildcards in hostnames, which might allow man-in-the-middle attackers to spoof servers via a crafted certificate...

CVE-2013-7440

CVE-2013-7440 affects CPython’s ssl.match_hostname: Python before 2.7.9 and 3.x before 3.3.3 incorrectly handles wildcards in hostnames, allowing MITM via a crafted certificate. Affected: CPython’s standard library SSL hostname verification. Root cause: wildcard handling flaw in hostname matching...

PSF-2016-1 ssl.match_hostname() IDNA issue

The ssl.matchhostname function in CPython aka Python before 2.7.9 and 3.x before 3.3.3 does not properly handle wildcards in hostnames, which might allow man-in-the-middle attackers to spoof servers via a crafted certificate...

CVE-2016-1693

browser/safebrowsing/srtfieldtrialwin.cc in Google Chrome before 51.0.2704.63 does not use the HTTPS service on dl.google.com to obtain the Software Removal Tool, which allows remote attackers to spoof the chromecleanuptool.exe aka CCT file via a man-in-the-middle attack on an HTTP session...

Session fixation

browser/safebrowsing/srtfieldtrialwin.cc in Google Chrome before 51.0.2704.63 does not use the HTTPS service on dl.google.com to obtain the Software Removal Tool, which allows remote attackers to spoof the chromecleanuptool.exe aka CCT file via a man-in-the-middle attack on an HTTP session...

CVE-2016-1693: Improper Access Control

browser/safebrowsing/srtfieldtrialwin.cc in Google Chrome before 51.0.2704.63 does not use the HTTPS service on dl.google.com to obtain the Software Removal Tool, which allows remote attackers to spoof the chromecleanuptool.exe aka CCT file via a man-in-the-middle attack on an HTTP session...

KLA10821 Arbitrary code execution vulnerability in Lenovo Accelerator Application

Improper implementation of update mechanism was found in Lenovo Accelerator Application. By exploiting this vulnerability malicious users can execute arbitrary code. This vulnerability can be exploited remotely via spoofing an update response by man-in-the-middle attack. Technical details To...

New Irongate ICS Malware Steals From Stuxnet Playbook

New malware that targets industrial control systems called Irongate was found by researchers who say the discovery should serve as another wakeup call to the security industry to shore up its detection capabilities around ICS and SCADA threats. Irongate, which shares some of the same attributes a...

IRONGATE ICS Malware: Nothing to See Here...Masking Malicious Activity on SCADA Systems

In the latter half of 2015, the FireEye Labs Advanced Reverse Engineering FLARE team identified several versions of an ICS-focused malware crafted to manipulate a specific industrial process running within a simulated Siemens control system environment. We named this family of malware IRONGATE...

Google Chrome < 51.0.2704.63 Multiple Vulnerabilities

The version of Google Chrome installed on the remote macOS host is prior to 51.0.2704.63. It is, therefore, affected by multiple vulnerabilities as referenced in the 201605stable-channel-update25 advisory. - Multiple unspecified vulnerabilities in Google Chrome before 51.0.2704.63 allow attackers...

KLA10816 Multiple vulnerabilities in Google Chrome

Multiple serious vulnerabilities have been found in Google Chrome. Malicious users can exploit these vulnerabilities to cause denial of service, bypass security restrictions, obtain sensitive information or conduct another unknown impact. Below is a complete list of vulnerabilities: 1. Multiple...

JVN#43529183: Jetstar App for iOS fails to verify SSL server certificates

Jetstar App for iOS provided by Jetstar Airways Pty Ltd. fails to verify SSL server certificates. Impact A man-in-the-middle attack may allow an attacker to eavesdrop on an encrypted communication. Solution Update the application Update to the latest version according to the information provided ...

F5 Networks BIG-IP : Multiple Mozilla NSS vulnerabilities (K16716)

CVE-2013-1740 The sslDo1stHandshake function in sslsecur.c in libssl in Mozilla Network Security Services NSS before 3.15.4, when the TLS False Start feature is enabled, allows man-in-the-middle attackers to spoof SSL servers by using an arbitrary X.509 certificate during certain handshake traffi...

CVE-2016-0306

IBM WebSphere Application Server WAS 7.0 before 7.0.0.41, 8.0 before 8.0.0.13, and 8.5 before 8.5.5.10, when FIPS 140-2 is enabled, misconfigures TLS, which allows man-in-the-middle attackers to obtain sensitive information via unspecified vectors...

Buffer overflow

Oracle MySQL before 5.7.3, Oracle MySQL Connector/C aka libmysqlclient before 6.1.3, and MariaDB before 5.5.44 use the --ssl option to mean that SSL is optional, which allows man-in-the-middle attackers to spoof servers via a cleartext-downgrade attack, aka a "BACKRONYM" attack...