Gone in Less Than a Second

LAS VEGAS–Do not let Samy Kamkar near your car. Kamkar has built a new device that is about the size of a wallet and can intercept the codes used to unlock most cars and many garage doors. The device can be hidden underneath a vehicle and when the owner approaches and hits the unlock button on he...

Gratipay: Authentication errors in server side validaton of E-MAIL

To be honest, I'm not sure if there is any real security implications of this bug, but it's something which should be fixed at some point since it'll be pretty easy. I'm going to describe the issue with reproducible steps: 1. Navigate to Gratipay Settings Page...

LOGJAM: TLS connections which support export grade DHE key-exchange are vulnerable to MITM attacks

A flaw was found in the way the TLS protocol composes the Diffie-Hellman exchange for both export and non-export grade cipher suites. An attacker could use this flaw to downgrade a DHE connection to use export-grade key sizes, which could then be broken by sufficient pre-computation. This can lea...

金蝶销管家逻辑缺陷重置任意用户密码(工作人员账户测试/秒改)

简要描述： 可绕过验证码直接修改用户密码。 详细说明： 0x1:先信息收集一些工作人员的账户用来测试，来证明漏洞的危害性。 13580111111 13752248075 13456231475 13456879564 15578945623 13456231245 13456231245 13648776985 13400002111 13625668852 15018517663 15915533696 13888888888 13456789123 18090700000 13165454756 13654213923 13654213923 13760368754...

LOGJAM: TLS connections which support export grade DHE key-exchange are vulnerable to MITM attacks

A flaw was found in the way the TLS protocol composes the Diffie-Hellman exchange for both export and non-export grade cipher suites. An attacker could use this flaw to downgrade a DHE connection to use export-grade key sizes, which could then be broken by sufficient pre-computation. This can lea...

Cisco ASA Message Authentication Code Vulnerability (Cisco-SA-20150714-CVE-2015-4458)

Cisco ASA is prone to a Message Authentication Code checking vulnerability. Copyright C 2015 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is...

OpenSSL Man-in-the-Middle Attack Vulnerability (CNVD-2015-04454)

OpenSSL is an open source capable of implementing Secure Sockets Layer and Secure Transport Layer protocols for general-purpose cryptographic libraries , which supports a variety of cryptographic algorithms , including symmetric ciphers , hash algorithms , secure hash algorithms and so on. The...

Three Politicians Hacked Using Unsecured Wi-Fi Network

If you are one of our readers who follow The Hacker News every update, you probably know that Public WiFi network is a security risk. But many people aren’t aware, including our great politicians. Internet security provider F-Secure carried out an experimental hack against three prominent UK...

The vulnerability of Cisco ASA network firewalls allows attackers to gain access to traffic transmitted via IPSec and IKEv2 protocols.

The vulnerability of the Cisco ASA firewall’s cryptographic module is related to errors in cryptographic transformations. Exploiting this vulnerability can allow a malicious actor, operating remotely, to gain access to traffic transmitted via IPSec and IKEv2 protocols through a “man-in-the-middle...

Hackers Exploit Zero-Day Magento Vulnerability to Steal Your Credit Cards

Hackers are increasingly exploiting an unknown flaw to siphon payment card information from e-commerce websites that use Magento, the most popular e-commerce platform owned by eBay. Security researchers at Sucuri are still investigating the attack vector, but they believe that cyber criminals are...

IBM WebSphere MQIPT Information Disclosure Vulnerability

IBM WebSphere MQ is a solution for providing messaging services in the enterprise. IBM WebSphere MQIPT fails to properly handle HTTP session IDs, allowing remote attackers to exploit the vulnerability to guess the session ID to intercept MQ message data...

Technical analysis: Femtocell home base station to a communication to intercept, fake arbitrary SMS vulnerability-vulnerability warning-the black bar safety net

Ali mobile security team with the Chinese Thiel Laboratory of wireless technology Ministry of communication experts together, the combination of domestic operator a type of Femtocell base station for the security analysis, found that the more pieces of the major vulnerabilities that can lead to...

Trio of Vulnerabilities Patched in Magneto Web App

A trio of vulnerabilities were recently patched in eBay’s Magento e-commerce web application that could have let attackers carry out a handful of exploits, including phishing, session hijacking, and data interception. Hadji Samir, a researcher at the firm Vulnerability Lab dug up the problems...

Cisco Adaptive Security Appliance Encrypted IPSec or IKEv2 Packet Modification Vulnerability

A vulnerability in the AES-GCM code of Cisco Adaptive Security Appliance ASA could allow an unauthenticated, remote attacker to modify the contents of an encrypted IPSec or IKEv2 packet, and for those modifications not to be detected. The vulnerability is due to an error on the firmware of the...

E-Detective Lawful Interception System - Multiple Vulnerabilities

E-Detective Lawful Interception System - Multiple Vulnerabilities Advisory: E-Detective Lawful Interception System multiple security vulnerabilities Date: 14/06/2015 CVE: unassigned Authors: Mustafa Al-Bassam https://musalbas.com slipstream/RoL https://twitter.com/TheWack0lian Software: Decision...

E-Detective Lawful Interception System - Multiple Vulnerabilities

Exploit for php platform in category web applications Advisory: E-Detective Lawful Interception System multiple security vulnerabilities Date: 14/06/2015 CVE: unassigned Authors: Mustafa Al-Bassam https://musalbas.com slipstream/RoL https://twitter.com/TheWack0lian Software: Decision Group...

E-Detective Lawful Interception System - Multiple Vulnerabilities

Advisory: E-Detective Lawful Interception System multiple security vulnerabilities Date: 14/06/2015 CVE: unassigned Authors: Mustafa Al-Bassam https://musalbas.com slipstream/RoL https://twitter.com/TheWack0lian Software: Decision Group E-Detective Lawful Interception System Vendor URL:...

E-Detective Lawful Interception System LFD / Code Execution

Advisory: E-Detective Lawful Interception System multiple security vulnerabilities Date: 14/06/2015 CVE: unassigned Authors: Mustafa Al-Bassam https://musalbas.com slipstream/RoL https://twitter.com/TheWack0lian Software: Decision Group E-Detective Lawful Interception System Vendor URL:...

REMnux v6 - A Linux Toolkit for Reverse-Engineering and Analyzing Malware

REMnux is a free Linux toolkit for assisting malware analysts with reverse-engineering malicious software. It strives to make it easier for forensic investigators and incident responders to start using the variety of freely-available tools that can examine malware, yet might be difficult to locat...

Proxenet - Hacker Friendly Proxy for Web Application Penetration Tests

Proxenet is a hacker friendly proxy for web application penetration tests. proxenet is a multi-threaded proxy which allows you manipulate your HTTP requests and responses using your favorite scripting language. No need to learn Java like for Burp or Python like for mitmproxy. proxenet supports...