Jappix XMPP Client User Impersonation Vulnerability

XMPP video timely communication system, support single chat group chat.Jappix is a full-featured XMPP WEb client. A user impersonation vulnerability exists in the Jappix XMPP Client. An attacker can exploit this vulnerability to spoof any user and launch further attacks...

Google Chrome Security Updates (stable-channel-update-for-desktop-2017-01) - Mac OS X

Google Chrome is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:google:chrome"; ifdescription...

Bzrtp Man-in-the-middle Spoofing Vulnerability

bzrtp is an open source ZRTP key exchange protocol. Bzrtp suffers from a man-in-the-middle spoofing vulnerability. An attacker can exploit the vulnerability to conduct spoofing attacks and perform unauthorized manipulation...

CVE-2016-0241

IBM Security Guardium Database Activity Monitor 8.2 before p310, 9.x through 9.5 before p700, and 10.x through 10.1 before p100 allows remote authenticated users to spoof administrator accounts by sending a modified login request over HTTP...

Animas OneTouch Ping Authentication Bypass Vulnerability (CNVD-2016-08537)

The Animas OneTouch Ping is a medical self-service device for diabetics taking insulin from Animas USA. The Animas OneTouch Ping device uses a customized communication protocol that allows an unauthenticated remote attacker to bypass authentication by relaying the attack and spoofing the affected...

TLS protocol man-in-the-middle attack vulnerability (CNVD-2016-08101)

The TLS Transport Layer Security protocol is a set of protocols used to provide confidentiality and data integrity between two communicating applications. A security vulnerability exists in the TLS protocol that allows a remote attacker to spoof a TLS server via a man-in-the-middle attack with th...

The vulnerability of the Firefox browser, which allows attackers to carry out spoofing attacks

The vulnerability of Firefox browsers is related to the incorrect installation of the "LINKABLE" and "URISAFEFORUNTRUSTEDCONTENT" flags, which are used for error pages. Exploiting this vulnerability allows a remote attacker to perform spear-phishing attacks using specially crafted URLs...

openSUSE Security Update : MozillaFirefox / mozilla-nss (openSUSE-2016-960)

Mozilla Firefox was updated to 48.0 to fix security issues, bugs, and deliver various improvements. The following major changes are included : - Process separation e10s is enabled for some users - Add-ons that have not been verified and signed by Mozilla will not load - WebRTC enhancements - The...

Mozilla Firefox Forgery Attack Vulnerability

Mozilla Firefox is an open source web browser; Mozilla Firefox fails to properly set the LINKABLE and URISAFEFORUNTRUSTEDCONTENT flags for about: URLs used by error pages, allowing remote attackers to exploit the vulnerability to build malicious WEB pages that can be tricked into parsing by users...

CVE-2016-5268

Mozilla Firefox before 48.0 does not properly set the LINKABLE and URISAFEFORUNTRUSTEDCONTENT flags of about: URLs that are used for error pages, which makes it easier for remote attackers to conduct spoofing attacks via a crafted URL, as demonstrated by misleading text after an about:neterror?d=...

Security update for MozillaFirefox, mozilla-nss (important)

Mozilla Firefox was updated to 48.0 to fix security issues, bugs, and deliver various improvements. The following major changes are included: - Process separation e10s is enabled for some users - Add-ons that have not been verified and signed by Mozilla will not load - WebRTC enhancements - The...

firefox: multiple issues

CVE-2016-0718 arbitrary code execution Out-of-bounds read during XML parsing in Expat library. - CVE-2016-2830 information disclosure Favicon network connection can persist when page is closed. - CVE-2016-2835 CVE-2016-2836 arbitrary code execution Mozilla developers and community members...

Spoofing attack due to unvalidated KDC

Overview Affected versions of node-krb5 do not validate the KDC prior to authenticating, which might allow an attacker with network access and enough time to spoof the KDC and impersonate a valid user without knowing their credentials. Recommendation It appears that this will remain unfixed...

Juniper Junos Security Bypass Vulnerability (CNVD-2016-05056)

Juniper Junos is a Juniper Networks network operating system designed for the company's hardware systems. The operating system provides a secure programming interface and the Junos SDK. A security bypass vulnerability exists in Juniper Junos. An attacker could exploit this vulnerability to conduc...

UBUNTU-CVE-2016-2119

libcli/smb/smbXclibase.c in Samba 4.x before 4.2.14, 4.3.x before 4.3.11, and 4.4.x before 4.4.5 allows man-in-the-middle attackers to bypass a client-signing protection mechanism, and consequently spoof SMB2 and SMB3 servers, via the 1 SMB2SESSIONFLAGISGUEST or 2 SMB2SESSIONFLAGISNULL flag...

The vulnerability of the microprogrammed software of the D–Link DSR–250 router allows a malicious individual to intercept network traffic.

The microprogrammed software of the D-Link DSR-250 router does not perform ARP packet authentication for packets transmitted over the IPv4 protocol. This allows for intercepting the traffic processed by this router through ARP spoofing attacks...

The vulnerability of the microprogrammed routing software of the D–Link DSR–1000 allows a malicious actor to intercept network traffic.

The microprogrammed software of the D-Link DSR-1000 router does not perform ARP packet authentication for packets transmitted over the IPv4 protocol. This allows for intercepting the traffic processed by this router through ARP spoofing attacks...

UBUNTU-CVE-2016-1548

An attacker can spoof a packet from a legitimate ntpd server with an origin timestamp that matches the peer-dst timestamp recorded for that server. After making this switch, the client in NTP 4.2.8p4 and earlier and NTPSec aa48d001683e5b791a743ec9c575aaf7d867a2b0c will reject all future legitimat...

CVE-2016-1548

An attacker can spoof a packet from a legitimate ntpd server with an origin timestamp that matches the peer-dst timestamp recorded for that server. After making this switch, the client in NTP 4.2.8p4 and earlier and NTPSec aa48d001683e5b791a743ec9c575aaf7d867a2b0c will reject all future legitimat...

Emergency Java Patch Re-Issued for 2013 Vulnerability

Oracle yesterday released an emergency patch for a Java vulnerability that was improperly patched in 2013. Researchers at Security Explorations in Poland two weeks ago disclosed that a Java patch for an issue the company reported in 2013, CVE-2013-5838, was still trivially exploitable, and it...