OpenSSL Information Disclosure Vulnerability (CNVD-2019-38486)

OpenSSL is an open source capable general-purpose cryptographic library from the OpenSSL team that implements the Secure Sockets Layer SSLv2/v3 and Secure Transport Layer TLSv1 protocols. The product supports a variety of cryptographic algorithms , including symmetric ciphers , hash algorithms ,...

CVE-2019-15749

SITOS six Build v6.2.1 allows a user to change their password and recovery email address without requiring them to confirm the change with their old password. This would allow an attacker with access to the victim's account e.g., via XSS or an unattended workstation to change that password and...

Default credentials

SITOS six Build v6.2.1 allows a user to change their password and recovery email address without requiring them to confirm the change with their old password. This would allow an attacker with access to the victim's account e.g., via XSS or an unattended workstation to change that password and...

CVE-2019-15749

SITOS six Build v6.2.1 allows a user to change their password and recovery email address without requiring them to confirm the change with their old password. This would allow an attacker with access to the victim's account e.g., via XSS or an unattended workstation to change that password and...

All You Need To Know For External Hard Drive Recovery

By Uzair Amir Prevention is better than cure, so before getting started with discussing the methods for external hard drive recovery, it is better first to address the causes and things you need to avoid before starting the recovery process. This is a post from HackRead.com Read the original post...

Microsoft Reports Cyberattacks on Targeted Email Accounts

The Microsoft Threat Intelligence Center MSTIC has released a blog post describing an increase in malicious cyber activity from the Iranian group known as Phosphorus. These threat actors are exploiting password reset or account recovery features to take control of targeted email accounts. The...

CVE-2019-13629

MatrixSSL 4.2.1 and earlier contains a timing side channel in ECDSA signature generation. This allows a local or a remote attacker, able to measure the duration of hundreds to thousands of signing operations, to compute the private key used. The issue occurs because crypto/pubkey/eccmath.c scalar...

CVE-2019-15809

Smart cards from the Athena SCS manufacturer, based on the Atmel Toolbox 00.03.11.05 and the AT90SC chip, contain a timing side channel in ECDSA signature generation. This allows a local attacker, able to measure the duration of hundreds to thousands of signing operations, to compute the private...

DEBIAN-CVE-2019-13628

wolfSSL and wolfCrypt 4.0.0 and earlier when configured without --enable-fpecc, --enable-sp, or --enable-sp-math contain a timing side channel in ECDSA signature generation. This allows a local attacker, able to precisely measure the duration of signature operations, to infer information about th...

UBUNTU-CVE-2019-13628

wolfSSL and wolfCrypt 4.0.0 and earlier when configured without --enable-fpecc, --enable-sp, or --enable-sp-math contain a timing side channel in ECDSA signature generation. This allows a local attacker, able to precisely measure the duration of signature operations, to infer information about th...

Yokogawa Products

1. EXECUTIVE SUMMARY CVSS v3 8.4 ATTENTION: Low skill level to exploit Vendor: Yokogawa Equipment: Exaopc, Exaplog, Exaquantum, Exasmoc, Exarqe, GA10, and InsightSuiteAE Vulnerability: Unquoted Search Path or Element 2. RISK EVALUATION Successful exploitation of this vulnerability could allow a...

SpotIE Internet Explorer Password Recovery Denial of Service Vulnerability

SpotIE is a tool to view ie saved passwords. SpotIE Internet Explorer Password Recovery suffers from a denial of service vulnerability that originates from a network system or product that does not properly validate incoming data, which can be exploited by an attacker to cause a denial of service...

CVE-2019-16910

Arm Mbed TLS before 2.19.0 and Arm Mbed Crypto before 2.0.0, when deterministic ECDSA is enabled, use an RNG with insufficient entropy for blinding, which might allow an attacker to recover a private key via side-channel attacks if a victim signs the same message many times. For Mbed TLS, the fix...

Chrome Bug, Not Avid Software, Causes Damage to MacOS File Systems

Researchers have tracked a problem that caused corruption to the file systems of macOS users to a bug in a Google Chrome update after users originally feared it was a problem with Avid Media Composer. People using the Avid software for video editing on macOS platforms posted warnings Tuesday on...

SpotIE Internet Explorer Password Recovery 2.9.5 - (Key) Denial of Service Exploit

Exploit Title: SpotIE Internet Explorer Password Recovery 2.9.5 - 'Key' Denial of Service Exploit Author: Emilio Revelo Vendor Homepage: http://www.nsauditor.com/ Software Link : http://www.nsauditor.com/downloads/spotiesetup.exe Tested on: Windows 10 Pro x64 es Version: 2.9.5 Steps to produce th...

CVE-2019-14666

GLPI through 9.4.3 is prone to account takeover by abusing the ajax/autocompletion.php autocompletion feature. The lack of correct validation leads to recovery of the token generated via the password reset functionality, and thus an authenticated attacker can set an arbitrary password for any use...

Design/Logic Flaw

GLPI through 9.4.3 is prone to account takeover by abusing the ajax/autocompletion.php autocompletion feature. The lack of correct validation leads to recovery of the token generated via the password reset functionality, and thus an authenticated attacker can set an arbitrary password for any use...

SpotIE Internet Explorer Password Recovery 2.9.5 Denial Of Service

Exploit Title: SpotIE Internet Explorer Password Recovery 2.9.5 - 'Key' Denial of Service Date: 2019-20-09 Exploit Author: Emilio Revelo Vendor Homepage: http://www.nsauditor.com/ Software Link : http://www.nsauditor.com/downloads/spotiesetup.exe Tested on: Windows 10 Pro x64 es Version: 2.9.5...

SpotIE Internet Explorer Password Recovery 2.9.5 - Key Denial of Service

SpotIE Internet Explorer Password Recovery 2.9.5 - Key Denial of Service Exploit Title: SpotIE Internet Explorer Password Recovery 2.9.5 - 'Key' Denial of Service Date: 2019-20-09 Exploit Author: Emilio Revelo Vendor Homepage: http://www.nsauditor.com/ Software Link :...

SpotIE Internet Explorer Password Recovery 2.9.5 - 'Key' Denial of Service

Exploit Title: SpotIE Internet Explorer Password Recovery 2.9.5 - 'Key' Denial of Service Date: 2019-20-09 Exploit Author: Emilio Revelo Vendor Homepage: http://www.nsauditor.com/ Software Link : http://www.nsauditor.com/downloads/spotiesetup.exe Tested on: Windows 10 Pro x64 es Version: 2.9.5...