CVE-2017-6094

CPEs used by subscribers on the access network receive their individual configuration settings from a central GAPS instance. A CPE identifies itself by the MAC address of its WAN interface and a certain "chk" value 48bit derived from the MAC. The algorithm used to compute the "chk" was disclosed ...

CVE-2017-6094

Genexis GAPS (Genexis B.V.) up to version 7.2 is affected. An attacker can forge valid chk values (derived from the CPE WAN MAC) to impersonate any CPE and retrieve configuration settings from the central GAPS instance, often exposing sensitive data such as VoIP credentials. Root cause: the chk a...

CVE-2017-6094

CPEs used by subscribers on the access network receive their individual configuration settings from a central GAPS instance. A CPE identifies itself by the MAC address of its WAN interface and a certain "chk" value 48bit derived from the MAC. The algorithm used to compute the "chk" was disclosed ...

Genexis GAPS 7.2 Access Control

CVE-2017-6094 - Genexis GAPS Access Control Vulnerability Product: Genexis Automatic Provisioning System GAPS Vendor: Genexis B.V. CVE ID: CVE-2017-6094 Subject: Access control vulnerability Effect: Leaked configuration settings, including user credentials Author: Antoine Neuenschwander Date:...

3 Reasons to Use VMware NSX with Trend Micro Deep Security

Enterprises have begun adopting network virtualization for their IT infrastructure. According to a 2016 survey conducted by Accenture, 95 percent of small, medium, and large enterprises believe “network services will be virtualized.” Meanwhile, 25 percent of those who have adopted network...

Trend Micro Top Again for Breach Detection, Says NSS Labs

In spite of a rapidly evolving landscape, data breaches remain among the most common and damaging cyber-threats facing organizations today. As digital transformation efforts take hold, so the corporate attacks surface grows, offering more opportunities for the bad guys to take aim at highly prize...

Peace of Mind Companion App Has Logic Gaps

Anxiety Accompanying App is a mobile life application based on the mobile medical field, focusing on medical consultation accompaniment. There is a logic loophole in Anxin accompanying clinic APP, which can be exploited by an attacker to arbitrarily register users and arbitrarily reset their...

chromium-browser: url spoofing in omnibox

Insufficient Policy Enforcement in Omnibox in Google Chrome prior to 60.0.3112.78 for Mac, Windows, Linux, and Android allowed a remote attacker to perform domain spoofing via IDN homographs in a crafted domain name...

The vulnerability of the MantisBT error tracking system allows a hacker to execute arbitrary HTML or JavaScript code.

The vulnerability of the MantisBT error tracking system’s component exists due to the lack of measures taken to protect the website structure. Exploiting this vulnerability allows a malicious actor to execute arbitrary HTML or JavaScript code through changes to the windowtitle element...

Vulnerability of the Java Platform software platform, which allows a perpetrator to gain access to data for reading purposes

The vulnerability of the Java Platform’s networking software components is related to the lack of protection for operational data. Exploiting this vulnerability allows a malicious actor, operating remotely, to gain access to data through network packets...

The vulnerability of the Android operating system, allowing a hacker to execute arbitrary code

The vulnerability of Qualcomm’s Android operating system’s media codecs is related to lack of access control. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...

IBM Opens Attack Simulation Test Center

CAMBRIDGE, Ma. – IBM cut the ribbon on its new global security headquarters Wednesday that will also serve as command center for its just announced X-Force Incident Response and Intelligence Services. The centerpiece of the new 153,000-sqft facility is the company’s Cyber Range which IBM bills as...

Samsung pay gaps can lead to a hack trade hijacking-vulnerability warning-the black bar safety net

! Spanish security researcher Salvador Mendoza found Samsung Pay a security vulnerability, this vulnerability once exploited, hackers will be able to use another device to the victims of the trade hijacking. Based on a contactless payment system, is many of the newer Samsung phones with the...

Midea's M-Smart smart socket has design logic flaws

M-Smart Smart Socket is a smart home appliance developed by Midea Group. Midea's M-Smart Smart Socket is susceptible to man-in-the-middle attacks due to insecure protocols for transmitting data and lack of validation of what is transmitted on the client and server side. The lack of effective...

The vulnerability in the Microsoft SharePoint Server corporate application suite, a software solution for electronic document management called Microsoft SharePoint Foundation, allows attackers to carry out XSS attacks and circumvent existing access control policies.

The vulnerability of the Microsoft SharePoint Server corporate application and the Microsoft SharePoint Foundation software exists due to the lack of measures taken to protect the website structure. Exploiting this vulnerability allows a malicious actor to bypass existing access restrictions and...

The vulnerability of the IBM Spectrum Scale data management software and the General Parallel File System, which allows a hacker to gain access to protected information in the system memory.

The vulnerability of the IBM Spectrum Scale storage management program and the General Parallel File System file system is related to the lack of protection for operational data. Exploiting this vulnerability can allow an attacker, operating locally, to gain access to protected information in the...

The vulnerability of Firefox and Firefox ESR browsers allows attackers to circumvent access control policies.

The vulnerability of Firefox and Firefox ESR browsers is related to the lack of protection for service data. Exploiting this vulnerability allows a malicious actor to bypass access control policies using the JSON.parse method...

The vulnerability in the Internet Explorer browser allows a hacker to bypass the ASLR protection mechanism.

The vulnerability of the Internet Explorer browser is related to the lack of protection for service data. Exploiting this vulnerability allows a malicious actor to bypass the ASLR protection mechanism by using a specially crafted website...

The vulnerability of the Internet Explorer browser, which allows a hacker to read arbitrary local files

The vulnerability of the Internet Explorer browser is related to the lack of protection for service data. Exploiting this vulnerability allows a malicious actor to read arbitrary local files using a specially created path name...

Management: Limited RBAC authorization bypass

It was discovered that the Role Based Access Control RBAC implementation did not sufficiently verify all authorization conditions that are required by the Maintainer role to perform certain administrative actions. An authenticated user with the Maintainer role could use this flaw to add, modify, ...