SSL/TLS: Birthday attack against 64-bit block ciphers (SWEET32)

A flaw was found in the way the DES/3DES cipher was used as part of the TLS/SSL protocol. A man-in-the-middle attacker could use this flaw to recover some plaintext data by capturing large amounts of encrypted traffic between TLS/SSL server and client if the communication used a DES/3DES based...

Cisco IOS XR Software Event Management Service gRPC Handling DoS (cisco-sa-20170503-ios-xr)

According to its self-reported version and configuration, the Cisco IOS XR software running on the remote device is affected by a denial of service vulnerability in the Event Management Service daemon emsd due to improper handling of gRPC requests. An unauthenticated, remote attacker can exploit...

connect.fasep.it XSS vulnerability

Vulnerable URL: http://connect.fasep.it/gateway/pwdrecovery.php?lang=it%22%27--!%3E%3CScript%20/K/%3EconfirmOPENBUGBOUNTY%3C/Script%20/K/%3E Details: Description| Value ---|--- Patched:| No Latest check for patch:| 31.07.2017 Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alex...

Veritas System Recovery DLL Load Local Code Execution Vulnerability

Veritas System Recovery is a suite of disaster recovery software for virtual machines, servers and laptops from Veritas Technologies, USA. A local code execution vulnerability exists in the patch installer in versions prior to Veritas System Recovery 16 SP1. An attacker could exploit this...

PVS Servers randomly became offline

PVS servers were randomly offline and then recover automatically. The issue could happen several times a day on different PVS server. When PVS server was offline, sometimes we saw Streamprocess event 11 logged in event log, but sometime not...

CVE-2015-7568

SQL injection vulnerability in the password recovery feature in Yeager CMS 1.2.1 allows remote attackers to change the account credentials of known users via the "userEmail" parameter...

Sql injection

SQL injection vulnerability in the password recovery feature in Yeager CMS 1.2.1 allows remote attackers to change the account credentials of known users via the "userEmail" parameter...

CVE-2015-7568

SQL injection vulnerability in the password recovery feature in Yeager CMS 1.2.1 allows remote attackers to change the account credentials of known users via the "userEmail" parameter...

CVE-2015-7568

CVE-2015-7568 corresponds to a SQL injection vulnerability in the password recovery feature of Yeager CMS 1.2.1. The flaw, exploitable via the userEmail parameter, can allow remote attackers to change the credentials of known accounts. The affected product is Yeager CMS (version 1.2.1); the under...

Oracle SuperCluster Specific Software Local Vulnerability

Supercluster is a hardware and software integrated product that incorporates networking and relies on virtualization technology to provide different application platforms. A local vulnerability exists in Oracle SuperCluster Specific Software. An attacker could exploit the vulnerability to...

BAIC's Android app has a CAPTCHA design flaw

BAIC Android app is an online mobile service software. A CAPTCHA design vulnerability exists in the BAIC Android app. The vulnerability is caused due to the captcha being transmitted in clear text and without conditional restrictions. With the password recovery feature, an attacker can continuous...

Unitrends Enterprise Backup File Upload Vulnerability

Unitrends Enterprise Backup is backup software that incorporates cloud continuity services to ensure the recovery of your virtual, physical and cloud data, systems and applications. A file upload vulnerability exists in the createReportName and saveReport functions in Unitrends Enterprise Backup'...

Meh : CSRF in Facebook Delegated Account Recovery

Note this is going to be a quick post. This year, at Enigma 2017 Conference, Facebook introduced a way to move Account Recovery beyond Email and the "Secret" Question. After the presentation the moved operationally and presented the first integration partner : Github. These days I have seen a lot...

Game Multi Android app has design flaws in password recovery feature

Game Multi app is a software that focuses on serving game users. Game Multi Android app has a vulnerability in the design of the password recovery function, which can be exploited by an attacker to change his password through another person's cell phone number, log in to the system and obtain...

Facebook Offers a Better Way to Get Back Into Your Locked-Out Apps

At Facebook's F8 conference, the company outlined a refreshing alternative to the bad security questions that plague account recovery across the web. The post Facebook Offers a Better Way to Get Back Into Your Locked-Out Apps appeared first on WIRED...

Facebook Delegated Account Recovery SDKs Published for Java, Ruby Apps

Facebook’s Delegated Account Recovery, a protocol that allows applications to delegate account recovery permission to third-party applications, entered its beta phase today with the release of SDKs and additional support for new platforms. The feature has been running on a trial basis since late...

CVE-2017-7444

In Veritas System Recovery before 16 SP1, there is a DLL hijacking vulnerability in the patch installer if an attacker has write access to the directory from which the product is executed...

CVE-2017-7444

In Veritas System Recovery before 16 SP1, there is a DLL hijacking vulnerability in the patch installer if an attacker has write access to the directory from which the product is executed...

Design/Logic Flaw

In Veritas System Recovery before 16 SP1, there is a DLL hijacking vulnerability in the patch installer if an attacker has write access to the directory from which the product is executed...

CVE-2017-7444

Veritas System Recovery prior to 16 SP1 is affected by a DLL hijacking vulnerability in the patch installer. An attacker with write access to the execution directory could trigger local code execution during installation. The issue is confirmed as a local code execution vulnerability; remediation...