Kony EMM 4.2.0 Private Key Disclosure

------------------------------------------------------------------------ Product: Enterprise Mobile Management Vendor: Kony Vulnerable Versions: Kony EMM 4.2.0 and probably older versions Tested Version: Kony EMM 4.2.0 Advisory Publication: 20 March 2017 Vendor Notification: 29 Jan 2017...

Divide Between Work, Personal Data on Android Breached

SAN FRANCISCO–Researchers here at the RSA Conference demonstrated Thursday a way a hacker can bypass enterprise mobility management sandboxing tools known as Android for Work that are designed to segregate work and personal data on Android devices. In a proof-of-concept demonstration, researchers...

Security Advisory - XML Bomb Vulnerability in AnyOffice

AnyOffice Enterprise Mobile Management EMM is a module of the AnyOffice, which provides the mobile terminal management function. The XML Bomb vulnerability in the AnyOffice EMM could allow an authenticated, remote attacker to cause the software to deny services by uploading an XML bomb...

iOS sandboxing vulnerabilities increase the enterprise data risk level-vulnerability warning-the black bar safety net

Appthority researchers found a present in the iOS sandboxed application vulnerabilities in the iOS 8.4.1 the following version of the system will be affected, anyone can use this vulnerability to access the System Management Application Configuration. Sandbox vulnerability-QuickSand Due to this...

CVE-2014-8487: Kony EMM insecurity Direct Object Reference

------------------------------------------------------------------------ Product: Enterprise Mobile Management Vendor: Kony Vulnerable Versions: Kony EMM 1.2 and probably older versions Tested Version: Drupal Kony EMM 1.2 Advisory Publication: 24 December 2014 Vendor Notification: 8 December 2014...

Code injection

Kony Management aka Enterprise Mobile Management or EMM 1.2 and earlier allows remote authenticated users to read 1 arbitrary messages via the messageId parameter to selfservice/managedevice/getMessageBody or 2 requests via the requestId parameter to selfservice/devicemgmt/getDeviceInfoTab.htm...

CVE-2014-8487

Kony Management aka Enterprise Mobile Management or EMM 1.2 and earlier allows remote authenticated users to read 1 arbitrary messages via the messageId parameter to selfservice/managedevice/getMessageBody or 2 requests via the requestId parameter to selfservice/devicemgmt/getDeviceInfoTab.htm...

CVE-2014-8487

Kony EMM (Enterprise Mobile Management) 1.2 and earlier is affected by CVE-2014-8487 due to Insecure Direct Object References. A logged-in user can read arbitrary messages via /emm/selfservice/managedevice/getMessageBody?messageId= and retrieve device-related information via /emm/selfservice/devi...

Kony EMM 1.2 Insecure Direct Object Reference

------------------------------------------------------------------------ Product: Enterprise Mobile Management Vendor: Kony Vulnerable Versions: Kony EMM 1.2 and probably older versions Tested Version: Drupal Kony EMM 1.2 Advisory Publication: 24 December 2014 Vendor Notification: 8 December 2014...

CVE-2012-4588

McAfee Enterprise Mobility Manager EMM Agent before 4.8 and Server before 10.1 record all invalid usernames presented in failed login attempts, and place them on a list of accounts that an administrator may wish to unlock, which allows remote attackers to cause a denial of service excessive list...

CVE-2012-4589

Login.aspx in the Portal in McAfee Enterprise Mobility Manager EMM before 10.0 does not have an off autocomplete attribute for unspecified form fields, which makes it easier for remote attackers to obtain access by leveraging an unattended workstation...

CVE-2012-4590

Multiple cross-site scripting XSS vulnerabilities in About.aspx in the Portal in McAfee Enterprise Mobility Manager EMM before 10.0 might allow remote attackers to inject arbitrary web script or HTML via the 1 User Agent or 2 Connection variable...

CVE-2012-4587

McAfee Enterprise Mobility Manager EMM Agent before 4.8 and Server before 10.1, when one-time provisioning OTP mode is enabled, have an improper dependency on DNS SRV records, which makes it easier for remote attackers to discover user passwords by spoofing the EMM server, as demonstrated by a...

Design/Logic Flaw

Login.aspx in the Portal in McAfee Enterprise Mobility Manager EMM before 10.0 does not have an off autocomplete attribute for unspecified form fields, which makes it easier for remote attackers to obtain access by leveraging an unattended workstation...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in About.aspx in the Portal in McAfee Enterprise Mobility Manager EMM before 10.0 might allow remote attackers to inject arbitrary web script or HTML via the 1 User Agent or 2 Connection variable...

Session fixation

The Portal in McAfee Enterprise Mobility Manager EMM before 10.0 does not set the secure flag for the ASP.NET session cookie in an https session, which makes it easier for remote attackers to capture this cookie by intercepting its transmission within an http session...

Design/Logic Flaw

McAfee Enterprise Mobility Manager EMM Agent before 4.8 and Server before 10.1, when one-time provisioning OTP mode is enabled, have an improper dependency on DNS SRV records, which makes it easier for remote attackers to discover user passwords by spoofing the EMM server, as demonstrated by a...

CVE-2012-4591

The CVE-2012-4591 issue affects McAfee Enterprise Mobility Manager (EMM) before version 10.0. The About.aspx page in the Portal discloses the name of the user account used by an IIS worker process, enabling remote attackers to obtain potentially sensitive information by visiting the page. This is...

CVE-2012-4591

About.aspx in the Portal in McAfee Enterprise Mobility Manager EMM before 10.0 discloses the name of the user account for an IIS worker process, which allows remote attackers to obtain potentially sensitive information by visiting this page...

CVE-2012-4592

The Portal in McAfee Enterprise Mobility Manager EMM before 10.0 does not set the secure flag for the ASP.NET session cookie in an https session, which makes it easier for remote attackers to capture this cookie by intercepting its transmission within an http session...