3552 matches found
Spoofing
We have investigated reports of a spoofing vulnerability in AppX installer that affects Microsoft Windows. Microsoft is aware of attacks that attempt to exploit this vulnerability by using specially crafted packages that include the malware family known as Emotet/Trickbot/Bazaloader. An attacker...
Windows AppX Installer Spoofing Vulnerability
We have investigated reports of a spoofing vulnerability in AppX installer that affects Microsoft Windows. Microsoft is aware of attacks that attempt to exploit this vulnerability by using specially crafted packages that include the malware family known as Emotet/Trickbot/Bazaloader. An attacker...
CLSA-2021-1638804170 Fixed CVE-2021-43527 in nss
CVE-2021-43527: Fix memory corruption in decodeECorDsaSignature with DSA signatures and RSA-PSS - Update to CKBI 2.50 from NSS 3.67 - Removing: - Certificate "Verisign Class 3 Public Primary Certification Authority - G3" - Certificate "AddTrust Low-Value Services Root" - Certificate "AddTrust...
nss: Memory corruption in decodeECorDsaSignature with DSA signatures (and RSA-PSS)
A remote code execution flaw was found in the way NSS verifies certificates. This flaw allows an attacker posing as an SSL/TLS server to trigger this issue in a client application compiled with NSS when it tries to initiate an SSL/TLS connection. Similarly, a server application compiled with NSS,...
USN-5168-1 nss vulnerability
Tavis Ormandy discovered that NSS incorrectly handled verifying DSA/RSA-PSS signatures. A remote attacker could use this issue to cause NSS to crash, resulting in a denial of service, or possibly execute arbitrary code...
UBUNTU-CVE-2021-43527
NSS Network Security Services versions prior to 3.73 or 3.68.1 ESR are vulnerable to a heap overflow when handling DER-encoded DSA or RSA-PSS signatures. Applications using NSS for handling signatures encoded within CMS, S/MIME, PKCS \7, or PKCS \12 are likely to be impacted. Applications using N...
ScarCruft APT Mounts Desktop/Mobile Double-Pronged Spy Attacks
The North Korea-linked ScarCruft advanced persistent threat APT group has developed a fresh, multiplatform malware family for attacking North Korean defectors, journalists and government organizations involved in Korean Peninsula affairs. Since 2019, ScarCruft aka APT37 or Temp.Reaper has been...
CVE-2021-20835
Improper authorization in handler for custom URL scheme vulnerability in Android App 'Mercari Merpay - Marketplace and Mobile Payments App' Japan version versions prior to 4.49.1 allows a remote attacker to lead a user to access an arbitrary website and the website launches an arbitrary Activity ...
CVE-2021-20835
Improper authorization in handler for custom URL scheme vulnerability in Android App 'Mercari Merpay - Marketplace and Mobile Payments App' Japan version versions prior to 4.49.1 allows a remote attacker to lead a user to access an arbitrary website and the website launches an arbitrary Activity ...
CVE-2021-20835
The CVE-2021-20835 issue affects the Android app Mercari (Merpay) – Marketplace and Mobile Payments App (Japan version) prior to 4.49.1. It is described as improper handling of Intent (CWE-939) for a custom URL scheme, enabling a remote attacker to coerce a user to visit a malicious site which ca...
CVE-2021-20835: Missing Authorization
Improper authorization in handler for custom URL scheme vulnerability in Android App 'Mercari Merpay - Marketplace and Mobile Payments App' Japan version versions prior to 4.49.1 allows a remote attacker to lead a user to access an arbitrary website and the website launches an arbitrary Activity ...
PT-2021-14279
Name of the Vulnerable Software and Affected Versions: Mercari Merpay - Marketplace and Mobile Payments App versions prior to 4.49.1 Description: The issue is related to improper authorization in the handler for a custom URL scheme, allowing a remote attacker to lead a user to access an arbitrary...
Tech CEO Pleads to Wire Fraud in IP Address Scheme
The CEO of a South Carolina technology firm has pleaded guilty to 20 counts of wire fraud in connection with an elaborate network of phony companies set up to obtain more than 735,000 Internet Protocol IP addresses from the nonprofit organization that leases the digital real estate to entities in...
PT-2021-6408
Name of the Vulnerable Software and Affected Versions Microsoft App Installer versions prior to 1.21.3421.0 Description The issue is related to a spoofing vulnerability in the AppX installer that affects Microsoft Windows. This vulnerability can be exploited by attackers using specially crafted...
haproxy: does not ensure that the scheme and path portions of a URI have the expected characters
A flaw was found in haproxy. An input validation flaw when processing HTTP/2 requests causes haproxy to not ensure that the scheme and path portions of a URI have the expected characters. This may cause specially crafted input to bypass implemented security restrictions. The highest threat from...
GHSA-R28H-X6HV-2FQ3 Improper Verification of Cryptographic Signature in starkbank-ecdsa
The verify function in the Stark Bank Java ECDSA library ecdsa-java 1.0.0 fails to check that the signature is non-zero, which allows attackers to forge signatures on arbitrary messages...
CVE-2021-43192
In JetBrains YouTrack Mobile before 2021.2, iOS URL scheme hijacking is possible...
CVE-2021-43192
In JetBrains YouTrack Mobile before 2021.2, iOS URL scheme hijacking is possible...