FAST/TOOLS vulnerable to improper restriction of XML external entity references

Overview FAST/TOOLS provided by Yokogawa Electric Corporation contains a vulnerability where XML external entity XXE references are not properly restricted CWE-611. Timur Yunusov, Alexey Osipov and Ilya Karpov of Positive Technologies reported this vulnerability to JPCERT/CC. JPCERT/CC coordinate...

JVN#54775800: FAST/TOOLS vulnerable to improper restriction of XML external entity references

FAST/TOOLS provided by Yokogawa Electric Corporation contains a vulnerability where XML external entity XXE references are not properly restricted CWE-611. Impact When opening a project with a specially crafted XML file, information managed by the product may be disclosed or may become a victim o...

OracleVM 3.3 : openssl (OVMSA-2014-0032) (Heartbleed) (POODLE)

The remote OracleVM system is missing necessary patches to address critical security updates : - fix CVE-2014-3567 - memory leak when handling session tickets - fix CVE-2014-3513 - memory leak in srtp support - add support for fallback SCSV to partially mitigate CVE-2014-3566 padding attack on SS...

CVE-2014-4444

SecurityAgent in Apple OS X before 10.10 does not ensure that a Kerberos ticket is in the cache for the correct user, which allows local users to gain privileges in opportunistic circumstances by leveraging a Fast User Switching login...

CVE-2014-4444

SecurityAgent in Apple OS X before 10.10 does not ensure that a Kerberos ticket is in the cache for the correct user, which allows local users to gain privileges in opportunistic circumstances by leveraging a Fast User Switching login...

Oracle Linux 6 / 7 : openssl (ELSA-2014-1652)

The remote Oracle Linux 6 / 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2014-1652 advisory. - fix CVE-2014-3567 - memory leak when handling session tickets - fix CVE-2014-3513 - memory leak in srtp support - add support for fallback SCSV t...

[SECURITY] Fedora 19 Update: lzo-2.08-1.fc19

LZO is a portable lossless data compression library written in ANSI C. It offers pretty fast compression and very fast decompression. Decompression requires no memory. In addition there are slower compression levels achieving a quite competitive compression ratio while still decompressing at this...

Rovnix Variant Surfaces With New DGA

Researchers have unearthed a new version of the Rovnix malware that has a couple of additional features, including a new domain generation algorithm and a secure transmission channel for communicating with the command-and-control servers. Rovnix is a malware variant that often has been distribute...

[SECURITY] Fedora 20 Update: suricata-2.0.4-1.fc20

The Suricata Engine is an Open Source Next Generation Intrusion Detection and Prevention Engine. This engine is not intended to just replace or emulate the existing tools in the industry, but will bring new ideas and technologies to the field. This new Engine supports Multi-threading, Automatic...

[SECURITY] Fedora 21 Update: suricata-2.0.4-1.fc21

The Suricata Engine is an Open Source Next Generation Intrusion Detection and Prevention Engine. This engine is not intended to just replace or emulate the existing tools in the industry, but will bring new ideas and technologies to the field. This new Engine supports Multi-threading, Automatic...

MASSCAN - Mass IP port scanner (fastest Internet port scanner)

This is the fastest Internet port scanner. It can scan the entire Internet in under 6 minutes, transmitting 10 million packets per second. It produces results similar to nmap, the most famous port scanner. Internally, it operates more like scanrand, unicornscan, and ZMap, using asynchronous...

[SECURITY] Fedora 20 Update: perl-Email-Address-1.905-1.fc20

This class implements a regex-based RFC 2822 parser that locates email addresses in strings and returns a list of Email::Address objects found. Alternatively you may construct objects manually. The goal of this software is to be correct, and very very fast...

[SECURITY] Fedora 19 Update: perl-Email-Address-1.905-1.fc19

This class implements a regex-based RFC 2822 parser that locates email addresses in strings and returns a list of Email::Address objects found. Alternatively you may construct objects manually. The goal of this software is to be correct, and very very fast...

Fast Image Resizer 098 - Local Crash (PoC)

Fast Image Resizer 098 - Local Crash PoC !/usr/bin/perl Title : Fast Image Resizer 098 Local Crash Poc Author: Niko Tested: Windows XP SP3 En Apps : http://adionsoft.net/fastimageresize/FastImageResizer098.exe EAX 00000000 ECX 010422F8 EDX 00000000 EBX 00000000 ESP 0012F658 EBP 00000000 ESI...

CVE-2014-5927

The CVE covers the FastCustomer Android app (v3) which fails to verify X.509 certificates from SSL servers, allowing MITM attackers to spoof servers and access sensitive information via a crafted certificate. The provided documents do not specify affected versions beyond Android app 3 or any reme...

Yokogawa FAST/TOOLS XML External Entity

OVERVIEW Timur Yunusov, Alexey Osipov, and Ilya Karpov of Positive Technologies Inc. have identified an XML external entity processing vulnerability in the Yokogawa FAST/TOOLS application. Yokogawa has produced a service pack that mitigates this vulnerability. AFFECTED PRODUCTS The following...

CVE-2014-5710

The Cisco Class Locator Fast Lane aka com.tabletkings.mycompany.fastlane.cisco application for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

Authentication flaw

The Cisco Class Locator Fast Lane aka com.tabletkings.mycompany.fastlane.cisco application for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

Design/Logic Flaw

The Super Fast Browser aka iron.web.jalepano.browser application 2.0.5.6 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

CVE-2014-5710

The CVE-2014-5710 entry refers to the Cisco Class Locator Fast Lane Android app (package com.tabletkings.mycompany.fastlane.cisco) that does not verify X.509 certificates for SSL servers, enabling man-in-the-middle attackers to spoof servers and access sensitive information via crafted certificat...