CVE-2017-9574

The CVE-2017-9574 entry concerns the iOS app “KC Area Credit Union Mobile Banking” (K C Area Credit Union) version 3.0.1. The root cause is the app’s failure to verify X.509 certificates from SSL servers, enabling potential man-in-the-middle attacks to spoof servers and access sensitive informati...

CVE-2017-9576

CVE-2017-9576 affects the iOS version of the Middleton Community Bank Mobile Banking app (3.0.0), where the app does not verify X.509 certificates when establishing SSL/TLS connections. This weakness can allow a man-in-the-middle attacker to spoof legitimate servers and exfiltrate sensitive infor...

CVE-2017-9572

CVE-2017-9572: The athens-state-bank-mobile-banking/id719748589 iOS app (version 3.0.0) does not verify X.509 certificates from SSL servers, enabling MITM attackers to spoof servers and extract sensitive information via a crafted certificate. The linked sources confirm the vulnerability but do no...

CVE-2017-9584

The "HBO Mobile Banking" by Heritage Bank of Ozarks app 3.0.0 -- aka hbo-mobile-banking/id860224933 for iOS does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

CVE-2017-9578

The "RVCB Mobile" by RVCB Mobile Banking app 3.0.0 -- aka rvcb-mobile/id757928895 for iOS does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

CVE-2017-9574

The "KC Area Credit Union Mobile Banking" by K C Area Credit Union app 3.0.1 -- aka kc-area-credit-union-mobile-banking/id1097607736 for iOS does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafte...

CVE-2017-9576

The "Middleton Community Bank Mobile Banking" by Middleton Community Bank app 3.0.0 -- aka middleton-community-bank-mobile-banking/id721843238 for iOS does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information vi...

CVE-2017-9573

The North Adams State Bank Ursa nasb-mobile-banking/id980573797 app 3.0.1 for iOS does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

CVE-2017-9595

The CVE-2017-9595 entry concerns the iOS app “First State Bank of Bigfork Mobile Banking” (version 4.0.3, iOS) and reports that the app does not verify X.509 SSL server certificates. This root cause enables man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafte...

CVE-2017-9598

CVE-2017-9598 concerns the Morton Credit Union Mobile Banking iOS app (version 3.0.1) failing to verify X.509 certificates when connecting to SSL servers. This allows a man-in-the-middle attacker to spoof the server and exfiltrate sensitive data via a crafted certificate. The description from the...

CVE-2017-9588

CVE-2017-9588 affects the Oritani Mobile Banking iOS app (version 3.0.0, oritani-mobile-banking/id778851066). The vulnerability is that the app does not verify X.509 certificates from SSL servers, allowing a man-in-the-middle to spoof servers and obtain sensitive information via a crafted certifi...

CVE-2017-9589

The "SCSB Shelbyville IL Mobile Banking" by Shelby County State Bank app 3.0.0 -- aka scsb-shelbyville-il-mobile-banking/id938960224 for iOS does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafte...

Threat Round-up for June 2 - June 9

Today, Talos is publishing a glimpse into the most prevalent threats we've observed between June 02 and June 09. As with previous round-ups, this post isn't meant to be an in-depth analysis. Instead, this post will summarize the threats we've observed by highlighting key behavior characteristics,...

kviconline.gov.in XSS vulnerability

Vulnerable URL: https://www.kviconline.gov.in/pmegpeportal/jsp/APPRBIBANKLOV.jsp?BANKNAME=STATE%20BANK%20OF%20INDIA%22%3E%3Ch1%3EM0ns7er%3C/h1%3E%3Cscript%3Ealert%28document.cookie%29%3C/script%3E%3C/br%3E=MH Details: Description| Value ---|--- Patched:| No Latest check for patch:| 17.08.2017...

Personal Banking - Customized SSL, External URLs, KeyStore usage vulnerabilities

HackApp vulnerability scanner discovered that application Personal Banking published at the 'play' market has multiple vulnerabilities...

CVE-2015-6540

Cross-site scripting XSS vulnerability in Intellect Design Arena Intellect Core banking software...

Cross site scripting

Cross-site scripting XSS vulnerability in Intellect Design Arena Intellect Core banking software...

CVE-2015-6540

Cross-site scripting XSS vulnerability in Intellect Design Arena Intellect Core banking software...

CVE-2015-6540

CVE-2015-6540 describes a Cross-Site Scripting (XSS) vulnerability in Intellect Design Arena Intellect Core banking software (Armar module). The connected 0day/The vulnerability details indicate an arbitrary client-side JavaScript execution capability after login via a crafted link, potentially e...

Beware! This Microsoft PowerPoint Hack Installs Malware Without Requiring Macros

"Disable macros and always be extra careful when you manually enable it while opening Microsoft Office Word documents." You might have heard of above-mentioned security warning multiple times on the Internet as hackers usually leverage this decade old macros-based hacking technique to hack...