KeySniffer Lets Hackers Steal Keystrokes from Wireless Keyboards

Radio-based wireless keyboards and mice that use a special USB dongle to communicate with your PC can expose all your secrets – your passwords, credit card numbers and everything you type. Back in February, researchers from the Internet of things security firm Bastille Networks demonstrated how...

EMEA Organizations Must Rise to the Challenge of Stopping Advanced Threats

Since 2010, Mandiant, a FireEye company, has presented trends, statistics and case studies of cyber attacks involving advanced threat actors. As part of its many global investigations in 2015, Mandiant responded to several breaches in Europe, Middle East and Africa EMEA. Throughout the year we...

PT-2016-5646

Name of the Vulnerable Software and Affected Versions Trend Micro Mobile Security for iOS versions prior to 3.2.1188 Description The issue allows man-in-the-middle attackers to spoof the mobile application login server and obtain sensitive information via a crafted certificate, due to the lack of...

WEG SuperDrive G2 Elevation of Privilege Vulnerability

SuperDrive is a windows parameter setting graphical tool. SuperDrive has an elevation of privilege vulnerability due to lack of proper authentication. Allowing an attacker to exploit the vulnerability to elevate privileges...

iThemes Security <= 5.3.5 - Lack of Capability Check

The iThemes Security formerly Better WP Security WordPress plugin was affected by a Lack of Capability Check security vulnerability...

CVE-2016-2004

HPE Data Protector before 7.03108, 8.x before 8.15, and 9.x before 9.06 allow remote attackers to execute arbitrary code via unspecified vectors related to lack of authentication. NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-2623...

PT-2016-1808

Name of the Vulnerable Software and Affected Versions Android versions 4.x through 4.4.4 Android versions 5.0.x through 5.0.2 Android versions 5.1.x through 5.1.1 Android versions 6.x before 2016-04-01 Description The issue allows attackers to obtain sensitive information and bypass an unspecifie...

PT-2016-2221

Name of the Vulnerable Software and Affected Versions Android versions 4.x through 4.4.3 Android versions 5.0.x through 5.0.1 Android versions 5.1.x through 5.1.0 Android versions 6.x before 2016-04-01 Description The issue exists due to a lack of permission check for GET ACCOUNTS in the...

PT-2016-1675 · Microsoft · Windows

Name of the Vulnerable Software and Affected Versions: Microsoft Windows affected versions not specified Description: The issue is related to a lack of access control in the Windows operating system kernel mode driver, which can be exploited by a local attacker to elevate privileges using a...

Scores of Serial Servers Plagued by Lack of Authentication, Encryption

Thousands of serial servers connected to the internet aren’t password protected and lack encryption, leaving data that transfers between them and devices they’re connected to open to snooping, experts warn. To make matters worse, the servers, manufactured by Taiwan-based networking device company...

CVE-2015-5010

IBM Security Access Manager for Web 7.0 before 7.0.0 IF21, 8.0 before 8.0.1.3 IF4, and 9.0 before 9.0.0.1 IF1 does not have a lockout mechanism for invalid login attempts, which makes it easier for remote attackers to obtain access via a brute-force attack...

PT-2016-3653

Name of the Vulnerable Software and Affected Versions IBM Security Access Manager for Web versions 7.0 through 7.0.0 IF20 IBM Security Access Manager for Web versions 8.0 through 8.0.1.3 IF3 IBM Security Access Manager for Web versions 9.0 through 9.0.0.0 Description The issue is related to the...

Apple Mac OSX / iOS Kernel - IOHDIXControllUserClient::clientClose Use-After-Free/Double-Free

/ Source: https://code.google.com/p/google-security-research/issues/detail?id=599 OS X and iOS kernel UaF/double free due to lack of locking in IOHDIXControllUserClient::clientClose Here's the clientClose method of IOHDIXControllUserClient on OS X 10.11.1: text:0000000000005B38 ; int64 fastcall...

Emsisoft Anti Malware DLL Hijacking

Hi @ll, EmsisoftAntiMalwareSetup.exe as well as EmsisoftAntiMalwareXPSetup.exe, EmsisoftEmergencyKit.exe and EmsisoftHiJackFreeSetup.exe load and execute UXTheme.dll plus other DLLs like RichEd20.dll and RichEd32.dll eventually found in the directory they are started from the "application...

PT-2015-7677

Name of the Vulnerable Software and Affected Versions Adcon Telemetry A840 Telemetry Gateway Base Station affected versions not specified Description The issue concerns the Java client in the Adcon Telemetry A840 Telemetry Gateway Base Station, which fails to authenticate station devices. This la...

CVE-2015-7931: Improper Input Validation

The Java client in Adcon Telemetry A840 Telemetry Gateway Base Station does not authenticate the station device, which allows man-in-the-middle attackers to spoof devices and obtain sensitive information by reading cleartext packet data, related to the lack of SSL support...

WordPress Plugin Admin Management Xtended 2.4.0 - Privilege escalation

WordPress Plugin Admin Management Xtended 2.4.0 - Privilege escalation Exploit Title: Admin Management Xtended 2.4.0 Privilege escalation Date: 14-12-2015 Software Link: https://wordpress.org/plugins/admin-management-xtended/ Exploit Author: Kacper Szurek Contact: http://twitter.com/KacperSzurek...

SUSE SLED11 / SLES11 Security Update : LibVNCServer (SUSE-SU-2015:2110-1)

The libvncserver package was updated to fix the following security issues : - bsc897031: fix several security issues : - CVE-2014-6051: Integer overflow in MallocFrameBuffer on client side. - CVE-2014-6052: Lack of malloc return value checking on client side. - CVE-2014-6053: Server crash on a ve...

Mozilla Firefox ESR Multiple Vulnerabilities (Nov 2015) - Mac OS X

Mozilla Firefox ESR is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2015 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:mozilla:firefoxesr";...

PHP Server Monitor 3.1.1 - Cross-Site Request Forgery Privilege Escalation

PHP Server Monitor 3.1.1 - Cross-Site Request Forgery Privilege Escalation function doit var e=document.getElementById'HELL' e.submit input type="text" name="...