Deserialization of untrusted data

usersfile.c in liboath in OATH Toolkit before 2.4.1 does not properly handle lines containing an invalid one-time-password OTP type and a user name in /etc/users.oath, which causes the wrong line to be updated when invalidating an OTP and allows context-dependent attackers to conduct replay...

CVE-2013-7322

usersfile.c in liboath in OATH Toolkit before 2.4.1 does not properly handle lines containing an invalid one-time-password OTP type and a user name in /etc/users.oath, which causes the wrong line to be updated when invalidating an OTP and allows context-dependent attackers to conduct replay...

CVE-2013-5429

The Risk Based Access functionality in IBM Tivoli Federated Identity Manager TFIM 6.2.2 before FP9 and Tivoli Federated Identity Manager Business Gateway TFIMBG 6.2.2 before FP9 does not prevent reuse of One Time Password OTP tokens, which makes it easier for remote authenticated users to complet...

CVE-2013-5429

The Risk Based Access functionality in IBM Tivoli Federated Identity Manager TFIM 6.2.2 before FP9 and Tivoli Federated Identity Manager Business Gateway TFIMBG 6.2.2 before FP9 does not prevent reuse of One Time Password OTP tokens, which makes it easier for remote authenticated users to complet...

CVE-2013-5429

The CVE-2013-5429 issue affects IBM Tivoli Federated Identity Manager (TFIM) 6.2.2 before FP9 and TFIMBG 6.2.2 before FP9. Vulnerability: Risk Based Access allows reuse of One Time Password (OTP) tokens under certain conditions, enabling a remote authenticated user to complete transactions by lev...

Ukrainian Banking App Vulnerable to Attack

Privat24, the mobile banking application for Ukraine’s largest commercial bank, contains an insufficient validation vulnerability in its iOS, Android, and Windows phone apps that could give an attacker the ability to steal money from user accounts after bypassing its two-factor authentication...

Fear of NSA PRISM : Indian Government may ban US email services for official communication

The Indian Government is planning to ban the use of US based email services like Gmail for official communications to increase the security of confidential government information. The recent disconcerting reports that that India was being spied upon by American intelligence agencies has opened an...

UK banks hit by Ramnit banking malware and social engineering attacks

A dangerous variant of the Ramnit malware has been discovered targeting the UK's financial sector. Trusteer claims to have discovered an interesting trojan based attack technique that injects highly convincing and interactive real-time messages into the user Web stream that they encounter when...

UK banks hit by Ramnit banking malware and social engineering attacks

A dangerous variant of the Ramnit malware has been discovered targeting the UK's financial sector. Trusteer claims to have discovered an interesting trojan based attack technique that injects highly convincing and interactive real-time messages into the user Web stream that they encounter when...

RHEL 6 : ipa (RHSA-2013:0188)

Updated ipa packages that fix one security issue are now available for Red Hat Enterprise Linux 6. The Red Hat Security Response Team has rated this update as having important security impact. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is...

CentOS 5 : ipa-client (CESA-2013:0189)

An updated ipa-client package that fixes one security issue is now available for Red Hat Enterprise Linux 5. The Red Hat Security Response Team has rated this update as having important security impact. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating,...

RedHat Update for ipa-client RHSA-2013:0189-01

Check for the Version of ipa-client OpenVAS Vulnerability Test RedHat Update for ipa-client RHSA-2013:0189-01 Authors: System Generated Check Copyright: Copyright c 2013 Greenbone Networks GmbH, http://www.greenbone.net This program is free software; you can redistribute it and/or modify it under...

OpenVAS OTP Login Utility

This module attempts to authenticate to an OpenVAS OTP service. This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'OpenVAS OTP Login Utility', 'Description' = 'This module attempts to authenticate...

Design/Logic Flaw

McAfee Enterprise Mobility Manager EMM Agent before 4.8 and Server before 10.1, when one-time provisioning OTP mode is enabled, have an improper dependency on DNS SRV records, which makes it easier for remote attackers to discover user passwords by spoofing the EMM server, as demonstrated by a...

CVE-2012-4587

McAfee Enterprise Mobility Manager (EMM) Agent before 4.8 and EMM Server before 10.1, when one‑time provisioning (OTP) mode is enabled, have an improper dependency on DNS SRV records that can let remote attackers spoof the EMM server and discover user passwords (demonstrated on iOS). No patch/ver...

CVE-2012-4587

McAfee Enterprise Mobility Manager EMM Agent before 4.8 and Server before 10.1, when one-time provisioning OTP mode is enabled, have an improper dependency on DNS SRV records, which makes it easier for remote attackers to discover user passwords by spoofing the EMM server, as demonstrated by a...

Open Source Vulnerability Scanner: OpenVAS

OpenVAS is a framework of several services and tools offering a comprehensive and powerful vulnerability scanning and vulnerability management solution.The powerful and comprehensive OpenVAS solution is available as Free Software and maintained on a daily basis. Open Source Vulnerability Scanner:...

Fedora Update for pam_yubico FEDORA-2011-15580

Check for the Version of pamyubico OpenVAS Vulnerability Test Fedora Update for pamyubico FEDORA-2011-15580 Authors: System Generated Check Copyright: Copyright c 2012 Greenbone Networks GmbH, http://www.greenbone.net This program is free software; you can redistribute it and/or modify it under t...

[SECURITY] Fedora 16 Update: pam_yubico-2.8-1.fc16

This is pamyubico, a pluggable authentication module that can be used with Linux-PAM and yubikeys. This module supports yubikey OTP checking...

Authenex A-KeyASAS Web Management Control 3.1.0.2 - Blind SQL Injection

Authenex A-KeyASAS Web Management Control 3.1.0.2 - Blind SQL Injection ============================================================ FOREGROUND SECURITY, SECURITY ADVISORY 2011-002 - Original release date: September 21, 2011 - Discovered by: Jose Carlos de Arriba - Senior Security Analyst at...