Security Advisory - Improper Validation Vulnerability in Several Smartphones

There is an improper validation vulnerability on several smartphones. The system does not perform a properly validation of certain input models, an attacker could trick the user to install a malicious application then craft a malformed model , successful exploit could allow the attacker to get an...

Logic Flaw Vulnerability in Original Shopping Network App

The original shopping network app is the original shopping network for mobile users free customized shopping software, there are product search, browse, collection, shopping cart, place an order, mobile payment and other functions, you can through the mobile platform, always view the latest...

CVE-2019-5502

SMB in Data ONTAP operating in 7-Mode versions prior to 8.2.5P3 has weak cryptography which when exploited could lead to information disclosure or addition or modification of data...

CVE-2019-5215

There is a man-in-the-middle MITM vulnerability on Huawei P30 smartphones versions before ELE-AL00 9.1.0.162C01E160R1P12/C01E160R2P1, and P30 Pro versions before VOG-AL00 9.1.0.162 C01E160R1P12/C01E160R2P1. When users establish connection and transfer data through Huawei Share, an attacker could...

CVE-2018-18978

An issue was discovered in the Ascensia Contour NEXT ONE application for Android before 2019-01-15. It has a statically coded encryption key. Extraction of the encryption key is necessary for deciphering communications between this application and the backend server. This, in combination with...

DEBIAN-CVE-2017-11428

OneLogin Ruby-SAML 1.6.0 and earlier may incorrectly utilize the results of XML DOM traversal and canonicalization APIs in such a way that an attacker may be able to manipulate the SAML data without invalidating the cryptographic signature, allowing the attack to potentially bypass authentication...

The vulnerability of the Array.prototype.slice method in JIT-compiler IonMonkey of the Firefox ESR browser allows an attacker to compromise the confidentiality, integrity, and accessibility of protected information.

The vulnerability of the Array.prototype.slice method in JIT-compiled Firefox ESR browser software arises due to buffer overflow. Exploiting this vulnerability can allow an attacker to compromise the confidentiality, integrity, and accessibility of protected information...

Medtronic's Implantable Defibrillators Vulnerable to Life-Threatening Hacks

The U.S. Department of Homeland Security Thursday issued an advisory warning people of severe vulnerabilities in over a dozen heart defibrillators that could allow attackers to fully hijack them remotely, potentially putting lives of millions of patients at risk. Cardioverter Defibrillator is a...

Apache 2.4.x < 2.4.33 Multiple Vulnerabilities

According to its banner, the version of Apache running on the remote host is 2.4.x prior to 2.4.33. It is, therefore, affected by the following vulnerabilities: - An out-of-bounds write flaw exists within the derivecodepagefromlang function of the modules/aaa/modauthnzldap.c script due to imprope...

CVE-2018-7958

There is an anonymous TLS cipher suites supported vulnerability in Huawei eSpace product. An unauthenticated, remote attacker launches man-in-the-middle attack to hijack the connection from a client when the user signs up to log in by TLS. Due to insufficient authentication, which may be exploite...

Huawei eSace Product Uses Anonymous TLS Algorithmic Sleeve Vulnerability

Huawei eSpace 7950 is a 7950 series IP phone product from Huawei, China. A security vulnerability exists in the Huawei eSace product that uses an anonymous TLS algorithm set. Due to insufficient authentication, an attacker could launch a man-in-the-middle attack to intercept a client's connection...

OpenJDK: Incorrect handling of unsigned attributes in signed Jar manifests (Security, 8194534)

Vulnerability in the Java SE, Java SE Embedded component of Oracle Java SE subcomponent: Security. Supported versions that are affected are Java SE: 6u201, 7u191, 8u182 and 11; Java SE Embedded: 8u181. Difficult to exploit vulnerability allows unauthenticated attacker with network access via...

PT-2018-2401 · Oracle +1 · Mysql Server

Name of the Vulnerable Software and Affected Versions: Oracle MySQL versions 8.0.12 and prior Description: The issue is related to insufficient access control in the Server: DDL component of Oracle MySQL, allowing a remote attacker to modify file permissions or cause a denial of service. Successf...

CVE-2018-0334

A vulnerability in the certificate management subsystem of Cisco AnyConnect Network Access Manager and of Cisco AnyConnect Secure Mobility Client for iOS, Mac OS X, Android, Windows, and Linux could allow an unauthenticated, remote attacker to bypass the TLS certificate check when downloading...

Absolute Computrace Agent Code Execution Vulnerability

Absolute Computrace Agent is an agent program for monitoring computer systems. A security vulnerability exists in Absolute Computrace Agent versions 80.845 and 80.866 that stems from the program's failure to use digital signatures for configuration blocks. An attacker could exploit the...

Design/Logic Flaw

An attacker with physical access to a BrilliantTS FUZE card MCU firmware 0.1.73, BLE firmware 0.7.4 can unlock the card, extract credit card numbers, and tamper with data on the card via Bluetooth because no authentication is needed, as demonstrated by gatttool...

CVE-2018-6219

CVE-2018-6219 affects Trend Micro Email Encryption Gateway 5.5 (Build 1111.00). The vulnerability is an Insecure Update via HTTP where update communications are unencrypted, enabling a MITM attacker to eavesdrop on and tamper with update data. The connected documents corroborate that the issue is...

Damon Database Vulnerability for Overstepping Authority and Tampering with Data

DM7 is a new-generation database product designed by Damon on the basis of summarizing the R&D and application experience of DM series products, absorbing the advantages of mainstream database products, and adopting JAVA-like virtual machine technology. DM7 database has the vulnerability of...

Threat Outbreak Alert RuleID31840: Email Messages Distributing Malicious Software on January 30, 2018

Medium Alert ID: 56607 First Published: 2018 January 30 20:29 GMT Version: 1 Summary Cisco Security has detected significant activity related to spam email messages distributing malicious software. Email messages that are related to this threat RuleID31840 may contain the following files: Name |...

CVE-2017-14487

The OhMiBod Remote app for Android and iOS allows remote attackers to impersonate users by sniffing network traffic for search responses from the OhMiBod API server and then editing the username, userid, and token fields in data/data/com.ohmibod.remote2/sharedprefs/OMB.xml...