Australia Anti-Encryption Law Triggers Sweeping Backlash

A controversial Australian bill, which could give the government access to data protected by end-to-end encryption, was passed Thursday. The bill, called the Assistance and Access Act, empowers Australian police to essentially force companies that are operating in the country to help the governme...

spring-framework: ReDoS Attack with spring-messaging

Spring Framework, versions 5.0.x prior to 5.0.6, versions 4.3.x prior to 4.3.17, and older unsupported versions allows applications to expose STOMP over WebSocket endpoints with a simple, in-memory STOMP broker through the spring-messaging module. A malicious user or attacker can craft a message ...

Micro Focus Secure Messaging Gateway SQL Injection (CVE-2018-12464)

A SQL injection vulnerability exists in Micro Focus Secure Messaging Gateway. The vulnerability is due to insufficient validation of user input. Successful exploitation of this vulnerability would allow a remote attacker to execute arbitrary SQL commands on the affected system...

The Rotexy mobile Trojan – banker and ransomware

On the back of a surge in Trojan activity, we decided to carry out an in-depth analysis and track the evolution of some other popular malware families besides Asacub. One of the most interesting and active specimens to date was a mobile Trojan from the Rotexy family. In a three-month period from...

TIBCO MessagiTIBCO Messaging - Apache Kafka Distribution - Schema Repository Cross-Site Request Forgery Vulnerability

TIBCO Messaging - Apache Kafka Distribution - Schema Repository is a suite of application development and deployment solutions from TIBCO Software. A cross-site request forgery vulnerability exists in the Schema repository server component in TIBCO Messaging - Apache Kafka Distribution - Schema...

CVE-2018-12413: Cross-Site Request Forgery (CSRF)

The Schema repository server tibschemad component of TIBCO Software Inc.'s TIBCO Messaging - Apache Kafka Distribution - Schema Repository - Community Edition, and TIBCO Messaging - Apache Kafka Distribution - Schema Repository - Enterprise Edition contains a vulnerability which may allow an...

CVE-2018-12413

The Schema repository server tibschemad component of TIBCO Software Inc.'s TIBCO Messaging - Apache Kafka Distribution - Schema Repository - Community Edition, and TIBCO Messaging - Apache Kafka Distribution - Schema Repository - Enterprise Edition contains a vulnerability which may allow an...

PT-2018-11154

Name of the Vulnerable Software and Affected Versions TIBCO Messaging - Apache Kafka Distribution - Schema Repository - Community Edition version 1.0.0 TIBCO Messaging - Apache Kafka Distribution - Schema Repository - Enterprise Edition version 1.0.0 Description The issue allows an attacker to...

[SECURITY] Fedora 29 Update: mosquitto-1.5.3-1.fc29

Mosquitto is an open source message broker that implements the MQ Telemetry Transport protocol version 3.1 and 3.1.1 MQTT provides a lightweight method of carrying out messaging using a publish/subscribe model. This makes it suitable for "machine to machine" messaging such as with low power senso...

Signal App’s New Privacy Feature Conceals Sender ID from Metadata

By Waqas Messaging apps are now becoming more and more secure to make it difficult or rather impossible for anyone to access your conversations. Switching to end-to-end encryption although offered a stronger layer of protection but still the unencrypted metadata like sender/receiver information,...

Signal's "Sealed Sender" Is a Clever New Way to Shield Your Identity

"Sealed sender" gives the leading encrypted messaging app an important boost, hiding metadata around who sent a given message...

[SECURITY] Fedora 28 Update: mosquitto-1.5.3-1.fc28

Mosquitto is an open source message broker that implements the MQ Telemetry Transport protocol version 3.1 and 3.1.1 MQTT provides a lightweight method of carrying out messaging using a publish/subscribe model. This makes it suitable for "machine to machine" messaging such as with low power senso...

com.coiney:akka-rabbit-core_2.10 (0.3.0), com.coiney:akka-rabbit-core_2.11 (0.3.0) +7 more potentially affected by CVE-2018-11087 via com.rabbitmq:amqp-client (3.3.3)

com.rabbitmq:amqp-client MAVEN version 3.3.3 is affected by a known vulnerability. The following packages have a transitive dependency on com.rabbitmq:amqp-client and may be impacted: - com.coiney:akka-rabbit-core2.10 0.3.0 - com.coiney:akka-rabbit-core2.11 0.3.0 - net.roboconf:roboconf-agent =0....

at.chrl:chrl-jms (1.1.0), at.researchstudio.sat:won-core (>=0.2, <=0.3) +1867 more potentially affected by CVE-2018-1270 +1 more via org.springframework:spring-messaging (>=4.0.1.release, <=4.3.15.release)

org.springframework:spring-messaging MAVEN version =4.0.1.release, =0.2, =0.2, =0.2, =0.2, =0.3 - at.researchstudio.sat:won-node 0.3 - at.researchstudio.sat:won-node-webapp 0.3 - at.researchstudio.sat:won-owner 0.3 - at.researchstudio.sat:won-owner-webapp 0.3 and more Source cves: CVE-2018-1270,...

at.chrl:chrl-jms (1.1.0), at.researchstudio.sat:won-core (>=0.2, <=0.3) +1867 more potentially affected by CVE-2018-1275 via org.springframework:spring-messaging (>=4.0.1.release, <=4.3.15.release)

org.springframework:spring-messaging MAVEN version =4.0.1.release, =0.2, =0.2, =0.2, =0.2, =0.3 - at.researchstudio.sat:won-node 0.3 - at.researchstudio.sat:won-node-webapp 0.3 - at.researchstudio.sat:won-owner 0.3 - at.researchstudio.sat:won-owner-webapp 0.3 and more Source cves: CVE-2018-1275...

ca.uhn.hapi.fhir:hapi-fhir-cli-api (3.4.0), ca.uhn.hapi.fhir:hapi-fhir-jpaserver-base (>=3.1.0, <=3.4.0) +121 more potentially affected by CVE-2018-1275 via org.springframework:spring-messaging (>=5.0.0.release, <=5.0.4.release)

org.springframework:spring-messaging MAVEN version =5.0.0.release, =3.1.0, =0.2.0, =0.1.0-rc1, =3.0.0-alpha.1, =3.0.1 and more Source cves: CVE-2018-1275 Source advisory: OSV:GHSA-3RMV-2PG5-XVQJ...

ca.uhn.hapi.fhir:hapi-fhir-cli-api (3.4.0), ca.uhn.hapi.fhir:hapi-fhir-jpaserver-base (>=3.1.0, <=3.4.0) +121 more potentially affected by CVE-2018-1270 +1 more via org.springframework:spring-messaging (>=5.0.0.release, <=5.0.4.release)

org.springframework:spring-messaging MAVEN version =5.0.0.release, =3.1.0, =0.2.0, =0.1.0-rc1, =3.0.0-alpha.1, =3.0.1 and more Source cves: CVE-2018-1270, CVE-2018-1275 Source advisory: GHSA-3RMV-2PG5-XVQJ...

at.chrl:chrl-jms (1.1.0), at.researchstudio.sat:won-core (>=0.2, <=0.3) +1867 more potentially affected by CVE-2018-1270 via org.springframework:spring-messaging (>=4.0.1.release, <=4.3.15.release)

org.springframework:spring-messaging MAVEN version =4.0.1.release, =0.2, =0.2, =0.2, =0.2, =0.3 - at.researchstudio.sat:won-node 0.3 - at.researchstudio.sat:won-node-webapp 0.3 - at.researchstudio.sat:won-owner 0.3 - at.researchstudio.sat:won-owner-webapp 0.3 and more Source cves: CVE-2018-1270...

ca.uhn.hapi.fhir:hapi-fhir-cli-api (3.4.0), ca.uhn.hapi.fhir:hapi-fhir-jpaserver-base (>=3.1.0, <=3.4.0) +121 more potentially affected by CVE-2018-1270 via org.springframework:spring-messaging (>=5.0.0.release, <=5.0.4.release)

org.springframework:spring-messaging MAVEN version =5.0.0.release, =3.1.0, =0.2.0, =0.1.0-rc1, =3.0.0-alpha.1, =3.0.1 and more Source cves: CVE-2018-1270 Source advisory: OSV:GHSA-P5HG-3XM3-GCJG...

at.chrl:chrl-jms (1.1.0), at.researchstudio.sat:won-core (>=0.2, <=0.3) +1867 more potentially affected by CVE-2018-1270 via org.springframework:spring-messaging (>=4.0.1.release, <=4.3.15.release)

org.springframework:spring-messaging MAVEN version =4.0.1.release, =0.2, =0.2, =0.2, =0.2, =0.3 - at.researchstudio.sat:won-node 0.3 - at.researchstudio.sat:won-node-webapp 0.3 - at.researchstudio.sat:won-owner 0.3 - at.researchstudio.sat:won-owner-webapp 0.3 and more Source cves: CVE-2018-1270...