CVE-2017-9561

The CVE-2017-9561 entry concerns the Lee Bank & Trust lbtc-mobile/id1068984753 iOS app (version 3.0.1) that does not verify X.509 certificates when connecting to SSL servers, enabling a man-in-the-middle attacker to spoof servers and obtain sensitive information via a crafted certificate. This vu...

Google Android Unauthorized Operation Vulnerability (CNVD-2017-11472)

Android is a Linux-based open source operating system jointly developed by Google and the Open Handheld Alliance OHA. A security vulnerability exists in Android that stems from a QTEE system call that fails to validate a pointer. An attacker can exploit the vulnerability to perform unauthorized...

Join Wallarm at ISSA’s Cornerstones of Trust event on June 20th

Next week, local chapter of Information Systems Security Association check them out at http://www.sv-issa.org is organizing a focused security conference looking into the issues of securing end users, enterprise technologies and security processes. Come meet Wallarm to learn about trends and best...

Windows Elevation of Privilege Vulnerability

An elevation of privilege vulnerability exists when Windows Secure Kernel Mode fails to properly handle objects in memory. To exploit the vulnerability, a locally-authenticated attacker could attempt to run a specially crafted application on a targeted system. An attacker who successfully exploit...

How to Add StoreFront Site to Client Trust Site Zone

This article explains how to add StoreFront site to client trust site zone, via group policy...

DocuSign Data Breach Led to Targeted Email Malware Campaign

While we all were busy in the WannaCry ransomware menace, two separate data breaches have been reported, one in DocuSign, a major provider of electronic signature technology, and another in BELL, Canada’s largest telecommunications company. In a notice on its website on Tuesday, DocuSign confirme...

Apple iOS < 10.3.2 Multiple Vulnerabilities

Binary data 700116.prm...

iTunes < 12.6 Multiple Vulnerabilities

Binary data 700114.prm...

Supply Chain Update Software Unknowingly Used in Attacks

Microsoft said a recent attack it calls Operation WilySupply utilized the update mechanism of an unnamed software editing tool to infect targets in the finance and payment industries with in-memory malware. The unnamed editing tool was used to send unsigned malicious updates to users in targeted...

Citrix Director: Could Not Establish Trust Relationship for the SSL/TLS Secure Channel

Director display in License Server section Cannot retrieve the data. Data source unresponsive due to configuration error. View Director server event logs for further information Checking the Application event log on the server running Director- logs event error: Event ID: 8 Level: Error Source:...

trusttechnologies.it XSS vulnerability

Vulnerable URL: https://www.trusttechnologies.it/?s=ok"/ Details: Description| Value ---|--- Patched:| Yes, at 28.07.2017 Latest check for patch:| 28.07.2017 19:26 GMT Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa Rank| 1394734 VIP website status:| No Check...

Oracle FLEXCUBE Investor Servicing Unauthorized Modification Vulnerability (CNVD-2017-06278)

Oracle Financial Services Applications is Oracle's suite of financial services software for core banking, online banking and asset management. Oracle FLEXCUBE Investor Servicing is one of the components that provides life-cycle processing of cross-business hedge funds, mutual funds and unit-linke...

Oracle FLEXCUBE Investor Servicing Unauthorized Modification Vulnerability

Oracle Financial Services Applications is Oracle's suite of financial services software for core banking, online banking and asset management. Oracle FLEXCUBE Investor Servicing is one of the components that provides life-cycle processing of cross-business hedge funds, mutual funds and unit-linke...

GitLab: Missing/Breach of Internal Security Boundary - Access to Job Queue Results in Remote Code Execution

Test Conditions ============= This issue was tested in GitLab Community Edition using a combination of code review against git commit 6c65b63ca5, April 20 2017 and testing likely issues against a local deployment of Bitnami GitLab Community Edition 9.0.5-0, running on Ubuntu 14.04.5. These are...

CVE-2017-3487

Vulnerability in the Oracle FLEXCUBE Investor Servicing component of Oracle Financial Services Applications subcomponent: Unit Trust. Supported versions that are affected are 12.0.1, 12.0.2, 12.0.3, 12.0.4, 12.1.0, 12.2.0 and 12.3.0. Difficult to exploit vulnerability allows low privileged attack...

CVE-2017-3488

Vulnerability in the Oracle FLEXCUBE Investor Servicing component of Oracle Financial Services Applications subcomponent: Unit Trust. Supported versions that are affected are 12.0.1, 12.0.2, 12.0.3, 12.0.4, 12.1.0, 12.2.0 and 12.3.0. Easily "exploitable" vulnerability allows low privileged attack...

CVE-2017-3288

Vulnerability in the Oracle FLEXCUBE Investor Servicing component of Oracle Financial Services Applications subcomponent: Unit Trust. Supported versions that are affected are 12.0.1, 12.0.2, 12.0.3, 12.0.4, 12.1.0, 12.2.0 and 12.3.0. Easily "exploitable" vulnerability allows low privileged attack...

CVE-2017-3288

CVE-2017-3288 affects Oracle FLEXCUBE Investor Servicing (Unit Trust) in Oracle Financial Services Applications. Publicly affected versions are 12.0.1–12.3.0. The vulnerability allows a low-privileged attacker with network access over HTTP to compromise data: unauthorized update/insert/delete on ...

CVE-2017-3487

CVE-2017-3487 affects Oracle FLEXCUBE Investor Servicing (Unit Trust subcomponent) in Oracle Financial Services Applications. Affected versions are 12.0.1–12.3.0. The vulnerability is exploitable by a low-privilege, remote attacker over HTTP to modify data, with the potential for unauthorized upd...

Oracle FLEXCUBE Investor Servicing Remote Vulnerability

Oracle Financial Services Applications is Oracle's suite of financial services software for core banking, online banking and asset management. Oracle FLEXCUBE Investor Servicing is one of the components that provides life-cycle processing of cross-business hedge funds, mutual funds and unit-linke...