ALPINE-CVE-2017-14032

ARM mbed TLS before 1.3.21 and 2.x before 2.1.9, if optional authentication is configured, allows remote attackers to bypass peer authentication via an X.509 certificate chain with many intermediates. NOTE: although mbed TLS was formerly known as PolarSSL, the releases shipped with the PolarSSL...

UBUNTU-CVE-2017-14032

ARM mbed TLS before 1.3.21 and 2.x before 2.1.9, if optional authentication is configured, allows remote attackers to bypass peer authentication via an X.509 certificate chain with many intermediates. NOTE: although mbed TLS was formerly known as PolarSSL, the releases shipped with the PolarSSL...

CVE-2017-14032

ARM mbed TLS before 1.3.21 and 2.x before 2.1.9, if optional authentication is configured, allows remote attackers to bypass peer authentication via an X.509 certificate chain with many intermediates. NOTE: although mbed TLS was formerly known as PolarSSL, the releases shipped with the PolarSSL...

CVE-2017-14032

ARM mbed TLS before 1.3.21 and 2.x before 2.1.9, if optional authentication is configured, allows remote attackers to bypass peer authentication via an X.509 certificate chain with many intermediates. NOTE: although mbed TLS was formerly known as PolarSSL, the releases shipped with the PolarSSL...

PT-2017-13212

Name of the Vulnerable Software and Affected Versions mbed TLS versions prior to 1.3.21 mbed TLS versions 2.x prior to 2.1.9 Description The issue allows remote attackers to bypass peer authentication via an X.509 certificate chain with many intermediates, but only if optional authentication is...

iWant - CLI Based Decentralized Peer To Peer File Sharing

A commandline tool for searching and downloading files in LAN network, without any central server. Features Decentralized : There is no central server hosting files. Therefore, no central point of failure Easydiscovery of files: As easy as searching for something in Google. File download from...

De-Journal 1.0 - SQL Injection

De-Journal 1.0 - SQL Injection Exploit Title: De-Journal - Academic Journal and Peer Review System 1.0 - SQL Injection Dork: N/A Date: 11.08.2017 Vendor Homepage : https://sarutech.com/ Software Link: https://codecanyon.net/item/dejournal-academic-journal-and-peer-review-system/19533981 Demo:...

De-Journal Academic Journal And Peer Review System 1.0 SQL Injection

Exploit Title: De-Journal - Academic Journal and Peer Review System 1.0 - SQL Injection Dork: N/A Date: 11.08.2017 Vendor Homepage : https://sarutech.com/ Software Link: https://codecanyon.net/item/dejournal-academic-journal-and-peer-review-system/19533981 Demo: https://demo.sarutech.com/dejourna...

EulerOS 2.0 SP2 : chrony (EulerOS-SA-2017-1158)

According to the version of the chrony package installed, the EulerOS installation on the remote host is affected by the following vulnerability : - chrony before 1.31.2 and 2.x before 2.2.1 do not verify peer associations of symmetric keys when authenticating packets, which might allow remote...

Design/Logic Flaw

NixOS 17.03 and earlier has an unintended default absence of SSL Certificate Validation for LDAP. The users.ldap NixOS module implements user authentication against LDAP servers via a PAM module. It was found that if TLS is enabled to connect to the LDAP server with users.ldap.useTLS, peer...

CVE-2017-11501

CVE-2017-11501 affects NixOS 17.03 and earlier via the users.ldap PAM module used for LDAP authentication. When TLS is used to connect to the LDAP server (users.ldap.useTLS), the peer certificate verification is unconditionally disabled in /etc/ldap.conf. This creates a risk of man-in-the-middle ...

Google Changes How it Analyzes Misbehaving Mobile Apps

Mobile apps in the Google Play store are categorized by their purpose, i.e., productivity or games. But there is a science to how apps are arranged, in particular around security and privacy features, and especially in holding back those apps whose behaviors pose a risk to mobile users. Google on...

EulerOS 2.0 SP2 : ntp (EulerOS-SA-2017-1125)

According to the versions of the ntp packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - ntpq in NTP before 4.2.8p7 allows remote attackers to obtain origin timestamps and then impersonate peers via unspecified vectors.CVE-2015-8139 - N...

Today’s File Security is So ’80s, Part 3: Dynamic Peer Groups – 3 Examples from Customer Data

In the first two parts of this series, we discussed why permissions management, the traditional approach to file security, no longer works and introduced a new approach to file security that leverages machine learning to build dynamic peer groups based on how users actually access files. In this...

Today’s File Security is So ‘80s, Part 2: Detect Suspicious File Access with Dynamic Peer Groups

In a previous post, we shared three primary reasons why the traditional, static approach to file security no longer works for today’s modern enterprises. Working groups are formed organically and are cross-functional by nature, making a black and white approach to file access control outdated—it...

Wireless IP Camera (P2P) WIFICAM Information Disclosure Vulnerability (CNVD-2017-06908)

Wireless IP Camera P2P WIFICAM is a remote IP camera. A security vulnerability exists in the Wireless IP Camera P2P WIFICAM device. The vulnerability can be exploited by an attacker to access the root account via remote access...

Wireless IP Camera (P2P) WIFICAM Sensitive Information Disclosure Vulnerability

Wireless IP Camera P2P WIFICAM is a remote IP camera. A security vulnerability exists in the Wireless IP Camera P2P WIFICAM device. A remote attacker could exploit this vulnerability by sniffing the network to obtain sensitive information...

To Protect Your Devices, A Hacker Wants to Hack You Before Someone Else Does

It should be noted that hacking a system for unauthorised access that does not belong to you is an illegal practice, no matter what's the actual intention behind it. Now I am pointing out this because reportedly someone, who has been labeled as a 'vigilante hacker' by media, is hacking into...

SUSE SLED12 / SLES12 Security Update : ntp (SUSE-SU-2017:1048-1)

This ntp update to version 4.2.8p10 fixes serveral issues. This updated enables leap smearing. See /usr/share/doc/packages/ntp/README.leapsmear for details. Security issues fixed bsc1030050 : - CVE-2017-6464: Denial of Service via Malformed Config - CVE-2017-6462: Buffer Overflow in DPTS Clock -...

BSA-2017-227

Security Advisory ID : BSA-2017-227 Component : ntp Revision : 1.0: Interim Bug 2085 described a condition where the root delay was included twice, causing the jitter value to be higher than expected. Due to a misinterpretation of a small-print variable in The Book, the fix for this problem was...