2714 matches found
CVE-2020-15023
CVE-2020-15023 affects Askey AP5100W devices up to AP5100W_Dual_SIG_1.01.097. The root cause is poor randomness in the Diffie-Hellman exchange, enabling offline WPS PIN brute-forcing: an attacker can observe WPS attempts and brute-force the authentication exchange, recovering the WPS PIN and ulti...
CVE-2020-15023: Use of Insufficiently Random Values
Askey AP5100W devices through AP5100WDualSIG1.01.097 are affected by WPS PIN offline brute-force cracking. This arises because of issues with the random number selection for the Diffie-Hellman exchange. By capturing an attempted and even failed WPS authentication attempt, it is possible to brute...
Description of the security update for Outlook 2016: December 8, 2020
None None...
Brute forcing device passwords
When working with IoT and embedded systems, brute-force password guessing attacks are an effective tool to gain access. Over the years, I’ve learned some tips and tricks to make these attacks more effective. What is brute forcing? Very simply, it’s guessing passwords so that you can find a valid...
XAPI Database Parsing Tool - Windows
Description This script applies an XML stylesheet to the XAPI database and creates a file that can be viewed in a web browser. The style sheet is an example of how data can be extracted from the database for quick offline troubleshooting and configuration analysis. Once the script has been ran...
Ransomware attack on top Brazilian court encrypts files, backups
By Waqas The ransomware attack was carried out by unknown operators who are now demanding a ransom for the decryption key. The cyberinfrastructure of the Brazilian Superior Court of Justice STJ has suffered a massive ransomware attack, as a result, its services including the official website have...
Nessus Essentials with offline registration and plugin updates
In this episode, I would like to talk about Nessus Essentials and, in particular, how to register and update it without direct internet access. Nothing complicated, but there are a couple of pitfalls that I would like to share. Lets say you need to scan a host in a critical autonomous segment whe...
PwnedPasswordsChecker - Search (Offline) If Your Password (NTLM Or SHA1 Format) Has Been Leaked (HIBP Passwords List V5)
PwnedPasswordsChecker is a tool that checks if the hash of a known password in SHA1 or NTLM format is present in the list of I Have Been Pwned leaks and the number of occurrences. You can download the hash-coded version for SHA1 here or the hash-coded version for NTLM here Once the list is...
CVE-2020-25598
An issue was discovered in Xen 4.14.x. There is a missing unlock in the XENMEMacquireresource error path. The RCU Read, Copy, Update mechanism is a synchronisation primitive. A buggy error path in the XENMEMacquireresource exits without releasing an RCU reference, which is conceptually similar to...
DEBIAN-CVE-2020-6553
Use after free in offline mode in Google Chrome on iOS prior to 84.0.4147.125 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page...
CVE-2020-6553
Use after free in offline mode in Google Chrome on iOS prior to 84.0.4147.125 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page...
CVE-2020-6553
Use after free in offline mode in Google Chrome on iOS prior to 84.0.4147.125 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page...
UBUNTU-CVE-2020-6553
Use after free in offline mode in Google Chrome on iOS prior to 84.0.4147.125 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page...
CVE-2020-6553
Use after free in offline mode in Google Chrome on iOS prior to 84.0.4147.125 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page...
CVE-2020-6553
Use after free in offline mode in Google Chrome on iOS prior to 84.0.4147.125 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page...
CVE-2020-6553
Use after free in offline mode in Google Chrome on iOS prior to 84.0.4147.125 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page...
Interesting Attack on the EMV Smartcard Payment Standard
Its complicated, but its basically a man-in-the-middle attack that involves two smartphones. The first phone reads the actual smartcard, and then forwards the required information to a second phone. That second phone actually conducts the transaction on the POS terminal. That second phone is able...
New PIN Verification Bypass Flaw Affects Visa Contactless Payments
Even as Visa issued a warning about a new JavaScript web skimmer known as Baka, cybersecurity researchers have uncovered an authentication flaw in the company's EMV enabled payment cards that permits cybercriminals to obtain funds and defraud cardholders as well as merchants illicitly. The...
New PIN Verification Bypass Flaw Affects Visa Contactless Payments
Even as Visa issued a warning about a new JavaScript web skimmer known as Baka, cybersecurity researchers have uncovered an authentication flaw in the company's EMV enabled payment cards that permits cybercriminals to obtain funds and defraud cardholders as well as merchants illicitly. The...
Fedora: Security Advisory for eclipse-mylyn (FEDORA-2020-cf8ef2f333)
The remote host is missing an update for the Copyright C 2020 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...