Session fixation

Philips ISCV application prior to version 2.3.0 has an insufficient session expiration vulnerability where an attacker could reuse the session of a previously logged in user. This vulnerability exists when using ISCV together with an Electronic Medical Record EMR system, where ISCV is in KIOSK mo...

CVE-2018-5438

Philips ISCV application prior to version 2.3.0 has an insufficient session expiration vulnerability where an attacker could reuse the session of a previously logged in user. This vulnerability exists when using ISCV together with an Electronic Medical Record EMR system, where ISCV is in KIOSK mo...

CVE-2018-5438

Philips ISCV application prior to version 2.3.0 has an insufficient session expiration vulnerability where an attacker could reuse the session of a previously logged in user. This vulnerability exists when using ISCV together with an Electronic Medical Record EMR system, where ISCV is in KIOSK mo...

Friday Squid Blogging: Searching for Humboldt Squid with Electronic Bait

Video and short commentary. As usual, you can also use this squid post to talk about the security stories in the news that I haven't covered. Read my blog posting guidelines here...

Threat Outbreak Alert RuleID32012: Email Messages Distributing Malicious Software on February 20, 2018

Medium Alert ID: 56874 First Published: 2018 February 20 16:46 GMT Version: 1 Summary Cisco Security has detected significant activity related to spam email messages distributing malicious software. Email messages that are related to this threat RuleID32012 may contain the following files: Name |...

Securing Our Connected Car Future with Panasonic

There are few more exciting frontiers of the Internet of Things IoT than connected cars. Gartner predicts that there will be 61 million vehicles with built-in connectivity on our roads by 2020. But as we drive ever closer to a future where autonomous vehicles are a commonplace sight, we must be...

Geldkarte - transaktionsid Cross Site Scripting Vulnerability

Document Title: =============== Geldkarte - transaktionsid Cross Site Scripting Vulnerability References Source: ==================== https://www.vulnerability-lab.com/getcontent.php?id=2118 Release Date: ============= 2018-02-20 Vulnerability Laboratory ID VL-ID:...

Physician, protect thyself: healthcare cybersecurity circling the drain

No one knows you better than you do. But thanks to technology advances and the continued digitization of healthcare data accumulation and sharing processes, we can also honestly say the same about your healthcare provider. Indeed, every time we get in touch with a health professional, data is...

Pyeongchang 2018: Staying Cyber Safe during the Olympics

As the 2018 Olympic Games in Pyeongchang approach, NCCIC/US-CERT reminds travelers to be aware of cybersecurity risks. At high-profile events, cyber activists may take advantage of the large audience to spread their message. Cyber criminals may attempt to steal personally identifiable information...

Philips IntelliSpace Cardiovascular System Unauthorized Access Vulnerability

Philips IntelliSpace Cardiovascular ISCV is a comprehensive cardiac image and information management system. An unauthorized access vulnerability exists in the Philips IntelliSpace Cardiovascular System, where ISCV is in kiosk mode for multiple users and uses Windows authentication when used with...

New Rules Announced for Border Inspection of Electronic Devices

The U.S. Customs and Border Patrol announced new restrictions on when agents can copy data from digital devices at border crossing points. Agents now need “reasonable suspicion” in advance of searches of phones, computers, tablets, cameras or any other digital device belonging to people entering ...

lhhrelectronictechnologydevelopment.tradenote.net XSS vulnerability

Open Bug Bounty ID: OBB-454085 Description| Value ---|--- Affected Website:| lhhrelectronictechnologydevelopment.tradenote.net Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N Remediation...

Elemental Path's CogniToys Dino Information Disclosure Vulnerability (CNVD-2018-00677)

Elemental Path's CogniToys Dino is a smart toy from Elemental Path's, USA that is capable of voice communication with children. An information disclosure vulnerability exists in Elemental Path's CogniToys Dino using firmware version 0.0.794 and earlier, which stems from the program's use of AES-1...

Anti-Skimmer Detector for Skimmer Scammers

Crooks who make and deploy ATM skimmers are constantly engaged in a cat-and-mouse game with financial institutions, which deploy a variety of technological measures designed to defeat skimming devices. The latest innovation aimed at tipping the scales in favor of skimmer thieves is a small, batte...

heilandelectronic.de XSS vulnerability

Open Bug Bounty ID: OBB-411332 Description| Value ---|--- Affected Website:| heilandelectronic.de Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

IEEE P1735 Cryptographic Issues Vulnerability

IEEE P1735 is a standard dedicated to encrypting the intellectual property of electronic designs. The implementation of IEEE P1735 is vulnerable to a cryptographic issue. An attacker could exploit this vulnerability to obtain the intellectual property of an electronic design...

IEEE P1735 Cryptographic Issue Vulnerability (CNVD-2017-33395)

IEEE P1735 is a standard dedicated to encrypting the intellectual property of electronic designs. The implementation of IEEE P1735 is vulnerable to a cryptographic issue. An attacker could exploit this vulnerability to obtain the intellectual property of an electronic design...

IEEE P1735 Cryptographic Problem Vulnerability (CNVD-2017-33399)

IEEE P1735 is a standard dedicated to encrypting the intellectual property of electronic designs. The implementation of IEEE P1735 is vulnerable to a cryptographic issue. An attacker could exploit this vulnerability to obtain the intellectual property of an electronic design...

US-CERT Warns of Crypto Bugs in IEEE Standard

Recent academic work focused on weak cryptographic protections in the implementation of the IEEE P1735 standard has been escalated to an alert published Friday by the Department of Homeland Security. DHS’ US-CERT warned the IEEE P1735 standard for encrypting electronic-design intellectual propert...

IEEE P1735 implementations may have weak cryptographic protections

Overview The P1735 IEEE standard describes methods for encrypting electronic-design intellectual property IP, as well as the management of access rights for such IP. The methods are flawed and, in the most egregious cases, enable attack vectors that allow recovery of the entire underlying plainte...