Security Bulletin: Multiple vulnerabilities in IBM Cognos affect IBM Control Center (CVE-2012-0213, CVE-2014-3574, CVE-2014-3529, CVE-2014-9527)

Summary IBM Cognos is shipped as a component of IBM Control Center. Multiple vulnerabilities have been addressed. Vulnerability Details CVEID: CVE-2012-0213 DESCRIPTION: Apache POI is vulnerable to a denial of service, caused by the improper handling of memory when processing certain Channel...

FIN8 Targets Card Data at Fuel Pumps

The notorious FIN8 cybercrime group has a new target when it comes to skimming payment-card details from consumers: Point-of-sale PoS systems used at fuel pumps at gas stations. Visa warned this week in a public alert posted online that its Payment Fraud Disruption PFD department has seen at leas...

Intesync Solismed Encryption Issue Vulnerability

Intesync Solismed is a clinic management system from Intesync USA. An encryption issue vulnerability exists in Intesync Solismed version 3.3sp1. The vulnerability stems from a web-based system or product that does not properly use relevant cryptographic algorithms, resulting in content that is no...

Snatch Ransomware Reboots Windows in Safe Mode to Bypass Antivirus

Cybersecurity researchers have spotted a new variant of the Snatch ransomware that first reboots infected Windows computers into Safe Mode and only then encrypts victims' files to avoid antivirus detection. Unlike traditional malware, the new Snatch ransomware chooses to run in Safe Mode because ...

Zenly: Insecure Storage and Overly Permissive API Keys in Android App

Description: Most often Developers for their ease of use,leave API keys and some sensitive keys ,Tokens as hardcoded strings,which isn't really a good ideas as it can result in Leaks of sensitive information getting in Wrong Hands which indeed can results in Data theft and Tampering with how the...

New Relic: NR-wide cross account access through misconfigured CORS-policy of multiple endpoints

Hey guys, While working at 746786, I've discovered a NewRelic-wide huge CORS-policy misconfiguration leading to cross-account data stealing and modification at a huge amount of endpoints. The vulnerability itself is that origin nr3.nr-assets.net is trusted NR-widely at many different endpoints, b...

Supply Chain Account Takeover: How Criminals Exploit Third-Party Access

Empower Your Suppliers Against Attack The average business shares data with a complex network of third parties, depending on their operational needs. In a survey of security and risk professionals, Forrester learned that the average business has 4,700 third-party partners with some access to...

Black Friday Shoppers Targeted By Scams and Fake Domains

Black Friday and Cyber Monday-related scams are nothing new — but researchers warn that this year, they are seeing an uptick in scams using more sophisticated methods to lure users to hand over their payment data. Research released Tuesday by ZeroFOX uncovered some of the threats that attackers a...

Explained: juice jacking

When your battery is dying and you're nowhere near a power outlet, would you connect your phone to any old USB port? Joyce did, and her mobile phone got infected. How? Through a type of cyberattack called "juice jacking." Don’t be like Joyce. Although Joyce and her infected phone are hypothetical...

Online Phishing: How to Stay Out of the Hackers’ Nets

Despite the growing popularity of social media and messaging apps, email remains the preferred way to communicate online for millions of Americans. And the bad guys know it. Of the 28.6 billion cyber-threats Trend Micro blocked globally in the first half of 2019, over 24.3 billion were carried by...

IBM Operations Analytics - Log Analysis Multiple Security Vulnerabilities

Description IBM Operations Analytics - Log Analysis is prone to multiple security vulnerabilities. Successful exploits will allow an attacker to obtain sensitive information, insert a crafted host header to navigate the victim to the attacker's domain or compromise the affected application. Other...

Centreon VM Memory Corruption Vulnerability

Centreon Merethis Centreon is a set of open source system monitoring tools from the French company Centreon . The product mainly provides monitoring capabilities for network, system and application resources.Centreon VM is the virtual machine version of Centreon. A security vulnerability exists i...

CVE-2019-5101

An exploitable information leak vulnerability exists in the ustream-ssl library of OpenWrt, versions 18.06.4 and 15.05.1. When connecting to a remote server, the server's SSL certificate is checked but no action is taken when the certificate is invalid. An attacker could exploit this behavior by...

Information disclosure

An exploitable information leak vulnerability exists in the ustream-ssl library of OpenWrt, versions 18.06.4 and 15.05.1. When connecting to a remote server, the server's SSL certificate is checked but no action is taken when the certificate is invalid. An attacker could exploit this behavior by...

Information disclosure

An exploitable information leak vulnerability exists in the ustream-ssl library of OpenWrt, versions 18.06.4 and 15.05.1. When connecting to a remote server, the server's SSL certificate is checked but no action is taken when the certificate is invalid. An attacker could exploit this behavior by...

CVE-2019-5101

OpenWrt vulnerability CVE-2019-5101 affects the ustream-ssl library (used by tools like wget) in OpenWrt 18.06.4 and 15.05.1. The issue allows information disclosure via MITM because the server certificate is checked but no action is taken for invalid certificates; after SSL initialization and in...

CVE-2019-5101

An exploitable information leak vulnerability exists in the ustream-ssl library of OpenWrt, versions 18.06.4 and 15.05.1. When connecting to a remote server, the server's SSL certificate is checked but no action is taken when the certificate is invalid. An attacker could exploit this behavior by...

Qualcomm Chip Flaws Let Hackers Steal Private Data From Android Devices

Hundreds of millions of devices, especially Android smartphones and tablets, using Qualcomm chipsets, are vulnerable to a new set of potentially serious vulnerabilities. According to a report cybersecurity firm CheckPoint shared with The Hacker News, the flaws could allow attackers to steal...

CVE-2019-18800

Viber through 11.7.0.5 allows a remote attacker who can capture a victim's internet traffic to steal their Viber account, because not all Viber protocol traffic is encrypted. TCP data packet 9 on port 4244 from the victim's device contains cleartext information such as the device model and OS...

selectree.calpoly.edu Cross Site Scripting vulnerability

Open Bug Bounty ID: OBB-1008636 Security Researcher devl00p Helped patch 3023 vulnerabilities Received 10 Coordinated Disclosure badges Received 15 recommendations , a holder of 10 badges for responsible and coordinated disclosure, found a security vulnerability affecting selectree.calpoly.edu...