We’re Excited to Announce the Launch of Comms Hub!

We are excited to announce the launch of Comms Hub to the Researcher Portal submission experience! With this launch, security researchers will be able to streamline communication with MSRC case SPMs case managers, attach additional files, track case and bug bounty status all in the Researcher...

We’re Excited to Announce the Launch of Comms Hub!

We are excited to announce the launch of Comms Hub to the Researcher Portal submission experience! With this launch, security researchers will be able to streamline communication with MSRC case SPMs case managers, attach additional files, track case and bug bounty status all in the Researcher...

Serious Vulnerabilities in Dualog Connection Suite

TL;DR The flaws found in this maritime comms and connection suite were many, and not insignificant: Directory traversal 2FA challenge/response is performed in a client-side application Default install password SQL injection User data leakage Easily brute forcible password hashes Introduction Duri...

Rockwell Automation 193-DNENCAT Comms Aux Communications Adapter

Binary data 753001.prm...

Rockwell Automation 193-DNENCATR Comms Aux Communications Adapter

Binary data 753002.prm...

Schneider Electric TSX Premium Communications Adapter Detection

Binary data 750691.prm...

Omron CS1W-SRM21 Communications Adapter Detection

Binary data 756094.prm...

Omron CJ1W-SRM21 Communications Adapter Detection

Binary data 756007.prm...

FreeBSD : comms/hylafax -- Malformed fax sender remote code execution in JPEG support (3df5a920-6edc-11e9-a44b-0050562a4d7b)

A malicious sender that sets both JPEG and MH,MR,MMR or JBIG in the same DCS signal or sends a large JPEG page could lead to remote code execution. C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from the FreeBSD VuXML database : Copyright...

Beers with Talos Ep. #41: Sex, money and malware

Beers with Talos BWT Podcast Ep. 41 is now available. Download this episode and subscribe to Beers with Talos: If iTunes and Google Play aren't your thing, click here. Ep. 41 show notes: Recorded Nov. 9, 2018 — We tried to make this episode last week, but thanks to some technical difficulties, we...

Native DNS Server (Example)

This module provides a Rex based DNS service which can store static entries, resolve names over pivots, and serve DNS requests across routed session comms. DNS tunnels can operate across the Rex switchboard, and DNS other modules can use this as a template. Setting static records via hostfile...

comms-dealer.com Open Redirect vulnerability

Open Bug Bounty ID: OBB-194007 Description| Value ---|--- Affected Website:| comms-dealer.com Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| Open Redirect / CWE-601 CVSSv3 Score:| 3.4...

Sql injection

SQL injection vulnerability in the Image Management component in Cisco Unified Communications Domain Manager 8.14 allows remote authenticated users to execute arbitrary SQL commands via unspecified vectors, aka Bug ID CSCuq52515...

CVE-2014-7685

The Razer Comms - Gaming Messenger aka com.razerzone.comms application 1.3.07 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

CVE-2014-7628

The Acorn Comms aka com.acorncomms.app application 3.0 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

Information disclosure

The Razer Comms - Gaming Messenger aka com.razerzone.comms application 1.3.07 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

Information disclosure

The Acorn Comms aka com.acorncomms.app application 3.0 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

CVE-2014-7685

The Razer Comms - Gaming Messenger aka com.razerzone.comms application 1.3.07 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

CVE-2014-7685

The CVE-2014-7685 entry concerns the Razer Comms (com.razerzone.comms) Android app version 1.3.07, which fails to verify X.509 certificates from SSL servers. This weakens TLS, enabling man-in-the-middle attackers to spoof servers and read sensitive information via a crafted certificate. The conne...

CVE-2014-7628

The CVE-2014-7628 entry concerns the Acorn Comms Android application (version 3.0) that does not verify X.509 certificates from SSL servers. Root cause: missing certificate verification enabling man-in-the-middle attacks to spoof servers and exfiltrate sensitive information via a crafted certific...