CVE-2017-13774

Hikvision iVMS-4200 devices before v2.6.2.7 allow local users to generate password-recovery codes via unspecified vectors...

CVE-2017-13774

The CVE affects Hikvision iVMS-4200 client software. Affected: versions before 2.6.2.7. Vulnerability allows local users to generate password-recovery codes via unspecified vectors, implying potential compromise of password recovery/authentication data. CVSS metrics indicate high impact (C/H/I/H/...

4 Principles For Hybrid Cloud Success

The future is cloud. At this point in it’s evolution it’s undeniable. The questions facing organizations now are “how much?” and “how fast?” How do you map out a reasonable path to a cloud deployment? Few organizations will be 100 percent cloud and most will take years to migrate existing assets...

Explained: digital forensics

What is it? Digital forensics is a modern day field of forensic science, which deals with the recovery and investigation of material found in digital devices. When needed, this is often because of a cyber crime, whether suspected or established. The most common reasons for performing digital...

Defray Ransomware Seen Targeting Education, Healthcare Industry

Researchers observed a new, albeit small and selective ransomware campaign earlier this month targeting both education and healthcare verticals. The ransomware, dubbed Defray, comes hidden in rigged Microsoft Word document attachments, sent via email. Researchers with Proofpoint, who spotted two...

Cloud4Wi Splash Portal Cross-Site Scripting Vulnerability

Cloud4Wi is a suite of customer Wi-Fi service platforms from Cloud4Wi, Inc. in the U.S. Splash Portal is one of the Wi-Fi portals. A cross-site scripting vulnerability exists in Splash Portal in Cloud4Wi versions prior to 5.9.7. A remote attacker can exploit this vulnerability to inject arbitrary...

Logic Design Vulnerability in Tlink IoT Cloud Service Platform Android App

TLINK Internet of Things is an open platform for Internet of Things products of Shenzhen Analog Technology Co. A logical design vulnerability exists in the Android App password recovery function of Tlink IoT cloud service platform. It allows the attacker to send unlimited SMS to the modified cell...

Encrypted, Anti-Replay, Multiplexed Udp Tunnel: Udp2raw-tunnel

A UDP Tunnel which tunnels UDP via FakeTCP/UDP/ICMP Traffic by using Raw Socket, helps you Bypass UDP FireWalls or Unstable UDP Environment. Its Encrpyted, Anti-Replay and Multiplexed. It also acts as a Connection Stabilizer. Features Send / Receive UDP Packet with fake-tcp/icmp headers...

OpenJDK: PKCS#8 implementation timing attack (JCE, 8176760)

A covert timing channel flaw was found in the PKCS8 implementation in the JCE component of OpenJDK. A remote attacker able to make a Java application repeatedly compare PKCS8 key against an attacker controlled value could possibly use this flaw to determine the key via a timing side channel...

Trend Micro Deep Discovery Director Command Injection Vulnerability

Trend Micro Deep Discovery is a protection product from Trend Micro that detects and identifies hard-to-find threats in real time and proposes solutions. director is one of the built-in solutions with the ability to update and upgrade various programs in Deep Discovery. A command injection...

Pharmaceutical Giant Still Feeling NotPetya's Sting

NotPetya was massive shift in malware tactics as what was initially believed to be another global ransomware attack on par with WannaCry was instead a wiper in disguise. It claimed thousands of victims worldwide, including some of the highest profile manufacturers, critical infrastructure provide...

ShieldFS Can Detect Ransomware, Recover Files

LAS VEGAS—Researchers from Italy’s Politecnico di Milano unveiled at Black Hat last week an add-on Windows driver and filesystem that detects ransomware and recovers files. ShieldFS was officially unveiled during the hacker conference by researchers Andrea Continella and Federico Maggi, who said...

Predictable Password Recovery

Moodle is vulnerable to predictable password recovery. The vulnerability exists because of not enough randomization of PHP mtrand function used in randomstring and complexrandomstring functions...

Password Reset And Recovery

pagekit/pagekit is vulnerable to password reset and recovery. Attackers are able to reset a registered user's password when the debug toolbar is enabled. By doing this, attackers are able to recover the password...

Bye, bye Petya! Decryptor for old versions released.

Following the outbreak of the Petya-based malware in Ukraine, the author of the original version, Janus, decided to release his master key, probably closing the project. You can read the full story here. Based on the released key, we prepared a decryptor that is capable of unlocking all the...

OpenJDK: PKCS#8 implementation timing attack (JCE, 8176760)

A covert timing channel flaw was found in the PKCS8 implementation in the JCE component of OpenJDK. A remote attacker able to make a Java application repeatedly compare PKCS8 key against an attacker controlled value could possibly use this flaw to determine the key via a timing side channel...

OpenJDK: PKCS#8 implementation timing attack (JCE, 8176760)

A covert timing channel flaw was found in the PKCS8 implementation in the JCE component of OpenJDK. A remote attacker able to make a Java application repeatedly compare PKCS8 key against an attacker controlled value could possibly use this flaw to determine the key via a timing side channel...

Legal Robot: No notification on change password feature

A security researcher discovered that Legal Robot did not send notifications on important account changes, like password changes. While there was no specific security vulnerability, we decided to add notifications for Password Change, TOTP Enable/Disable, U2F Enable/Disable, Recovery Code Use, an...

Modified Versions of Nukebot in Wild Since Source Code Leak

Some opportunistic criminals have put the leaked source code for the Nukebot banking Trojan to use, targeting banks in the United States and France with variants of the malware, while another group has adapted it to steal mail client and browser passwords. The leak was disclosed in early March wh...

Windows 10 Will Now Let You Reset Forgotten Password Directly From the Lock Screen

Microsoft is making every effort to make its Windows 10 Fall Creators Update bigger than ever before by beefing up its security practices and hardening it against hackers and cyber attacks in its next release. Microsoft is finally adding one of the much-requested features to Windows 10: Pin and...