JVN#20355129: niconico App for iOS fails to verify SSL server certificates

niconico App for iOS provided by DWANGO Co., Ltd. fails to verify SSL server certificates. Impact A man-in-the-middle attack may allow an attacker to eavesdrop on an encrypted communication. Solution Update the Software Update to the latest version according to the information provided by the...

狼邦内容管理系统SQL注入漏洞 /ztcx

LBCMS是贵州狼邦科技有限公司自主开发的一套CMS，中文软件名称为： 狼邦内容管理系统，版本目前是V8.0，开发语言: ASP.NET 4.0，数据库: SQL2005， 运行环境: Windows2003/NT系统+IIS6.0 ，主要应用于贵州或其它地区的政府、学校、企事业单位、个人网站建设。 LBCMS存在一处SQL报错注入漏洞： /Webwsfw/ztcx/?bh=1 测试案例： http://www.gzfwz.com/Webwsfw/ztcx/?bh=1 报错形式注入 sqlmap证明 !/usr/bin/env python coding: utf-8 from...

JVN#81207766: Rakuten card App for iOS fails to verify SSL server certificates

Rakuten card App for iOS provided by Rakuten Card Co., Ltd. fails to verify SSL server certificates. Impact A man-in-the-middle attack may allow an attacker to eavesdrop on an encrypted communication. Solution Update the Software Update to the latest version according to the information provided ...

Threat Outbreak Alert RuleID17564: Email Messages Distributing Malicious Software on August 25, 2015

Medium Alert ID: 40661 First Published: 2015 August 25 19:45 GMT Version: 1 Summary Cisco Security has detected significant activity related to spam email messages distributing malicious software. Email messages that are related to this threat RuleID17564 may contain the following files: Name |...

JVN#64051989: acmailer vulnerable to directory traversal

acmailer provided by Seeds Co.,Ltd. contains a directory traversal CWE-22 vulnerability. Impact An authenticated attacker may delete files on the server. Solution Update the software Update to the latest version according to the information provided by the developer. Products Affected acmailer...

JVN#19011483: Thetis vulnerable to SQL injection

Thetis provided by Sysphonic Co., Ltd. is an open source groupware and SNS. Thetis contains a SQL injection CWE-89 vulnerability. Impact An attacker may obtain or alter information stored in the database. Solution Apply an Update Apply the update according to the information provided by the...

SQL Injection Vulnerability in Websiteid Parameter of Government Information System of Beijing Xiangyu Leading Software Co.

One-stop government information disclosure system is a management system that realizes the construction of open government columns based on website groups. There is a SQL injection vulnerability in the websiteid parameter of the one-stop government information disclosure system of Beijing Xiangyu...

JVN#20133698: MailDealer vulnerable to cross-site scripting

MailDealer provided by RAKUS Co.,Ltd. contains a persistent cross-site scripting CWE-79 vulnerability due to a flaw in processing file names of attachments. Impact An arbitrary script may be executed on the user's web browser. Solution Update the Software Update to the latest version according to...

JVN#39175666: MP Form Mail CGI eCommerce edition vulnerable to code injection

MP Form Mail CGI eCommerce edition provided by futomi Co., Ltd. is a CGI used to send mail from a web form. MP Form Mail CGI eCommerce edition contains a code injection vulnerability. Impact Arbitrary Perl code may be executed on the server where it resides. Solution Update the software Update to...

[CVE-2014-7303] SGI Tempo System Database Exposure

SGI Tempo System Database Exposure Software: SGI Tempo SGI ICE-X Supercomputers Affected Versions: Unknown CVE Reference: CVE-2014-7303 Author: John Fitzpatrick, MWR Labs Severity: Low Risk Vendor: Silicon Graphics International Corp SGI Vendor Response: Uncooperative Description It is possible f...

Code injection

SQUARE ENIX Co., Ltd. Kaku-San-Sei Million Arthur before 2.25 for Android stores "product credentials" on the SD card, which allows attackers to gain privileges via a crafted application...

JVN#24909891: Kaku-San-Sei Million Arthur for Android information management vulnerability

Kaku-San-Sei Million Arthur provided by SQUARE ENIX CO., LTD. is a gaming application. Kaku-San-Sei Million Arthur for Android contains an information management vulnerability. Impact Android applications with permissions to read information stored on SD cards may obtain product credentials...

Stuxnet's First Five Victims Provided Path to Natanz

Stuxnet’s first five victims were a carefully crafted list of targets that ultimately provided the attackers with the road map they needed to get inside a uranium enrichment plant in Natanz, Iran and disrupt the country’s nuclear program. Cobbled together from clues left behind by the infamous...

A General campus of the system to the presence of multiple high-risk vulnerabilities(registration logic&getshell)-vulnerability warning-the black bar safety net

About Beijing Chong star weiye software Technology Co., Ltd. development of the education system vulnerability report 1. A large cattle submitted to such a vulnerability : the versatility of the SQL injection vulnerability of 1influence of Beijing, all kindergarten schools, etc., a SQL injection...

CVE-2014-7686

The So. Co. Business Partnership aka com.ChamberMe.SCBPSOUTHERNCO application 3.2 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

Code injection

The So. Co. Business Partnership aka com.ChamberMe.SCBPSOUTHERNCO application 3.2 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

CVE-2014-7686

The CVE-2014-7686 entry affects the So. Co. Business Partnership Android app (version 3.2). The root cause is that the application does not verify X.509 certificates from SSL servers, enabling man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate....

CVE-2014-7686

The So. Co. Business Partnership aka com.ChamberMe.SCBPSOUTHERNCO application 3.2 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

A New Cold War – with Many Sides

A New Cold War - with Many Sides Theres a lot we still dont know about the FBIs investigation of the data theft at JP Morgan Chase & Co. Criminal hackers based in Russia were targeting U.S. financial institutions long before Russia annexed Crimea or the West responded with sanctions. Is this trul...

JVN#20812625: Advance-Flow vulnerable to SQL injection

Advance-Flow provided by OSK Co., LTD contains an issue in processing input data, which may result in SQL injection. Impact A user may obtain or alter information on the database. Solution Do not use Advance-Flow The developer has stated that the support of Advance-Flow has been discontinued thus...