Cross site request forgery (csrf)

Multiple cross-site request forgery CSRF vulnerabilities in Mutare EVM allow remote attackers to hijack the authentication of arbitrary users for requests that 1 change a PIN, 2 delete messages, 3 add a delivery address, or 4 change a delivery address...

CVE-2011-1104

Multiple cross-site request forgery CSRF vulnerabilities in Mutare EVM allow remote attackers to hijack the authentication of arbitrary users for requests that 1 change a PIN, 2 delete messages, 3 add a delivery address, or 4 change a delivery address...

CVE-2011-1105

Multiple cross-site scripting XSS vulnerabilities in Mutare EVM allow remote attackers to inject arbitrary web script or HTML via 1 a delivery address and possibly 2 a PIN...

CVE-2011-1105

Multiple cross-site scripting XSS vulnerabilities in Mutare EVM allow remote attackers to inject arbitrary web script or HTML via 1 a delivery address and possibly 2 a PIN...

CVE-2011-1104

Multiple cross-site request forgery CSRF vulnerabilities in Mutare EVM allow remote attackers to hijack the authentication of arbitrary users for requests that 1 change a PIN, 2 delete messages, 3 add a delivery address, or 4 change a delivery address...

Symantec Alert Management System PIN number buffer overflow

Added: 02/03/2011 CVE: CVE-2010-0110 BID: 45936 Background The Symantec Alert Management System 2 AMS2 is used by multiple Symantec products. It includes an Intel Alert Handler service hndlrsvc.exe. This service handles messages forwarded to it by the Alert Originator Manager, which listens on po...

Symantec AMS Intel Alert Handler Pin Number Parsing Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Symantec Alert Management System. Authentication is not required to exploit this vulnerability. The specific flaw exists within the pagehndl.dll module while processing data sent from the msgsys.ex...

Undetectable fake ATM keyboard steals PINs in real time !

Thieves and scammers are an inventive bunch, especially when it comes to stealing you money indirectly. And the latest discovery of a fake keyboard that is placed over an ATM's legitimate one and records the typed-in PIN - in conjunction with a fake magnetic strip reader that can be manufactured...

CVE-2010-3868

Red Hat Certificate System RHCS 7.3 and 8 and Dogtag Certificate System do not require authentication for requests to decrypt SCEP one-time PINs, which allows remote attackers to obtain PINs by sniffing the network for SCEP requests and then sending decryption requests to the Certificate Authorit...

CVE-2010-3869

Red Hat Certificate System RHCS 7.3 and 8 and Dogtag Certificate System allow remote authenticated users to generate an arbitrary number of certificates by replaying a single SCEP one-time PIN...

Code injection

Red Hat Certificate System RHCS 7.3 and 8 and Dogtag Certificate System allow remote authenticated users to generate an arbitrary number of certificates by replaying a single SCEP one-time PIN...

System: unauthenticated user can request SCEP one-time PIN decryption

Red Hat Certificate System RHCS 7.3 and 8 and Dogtag Certificate System do not require authentication for requests to decrypt SCEP one-time PINs, which allows remote attackers to obtain PINs by sniffing the network for SCEP requests and then sending decryption requests to the Certificate Authorit...

System: SCEP one-time PIN reuse

Red Hat Certificate System RHCS 7.3 and 8 and Dogtag Certificate System allow remote authenticated users to generate an arbitrary number of certificates by replaying a single SCEP one-time PIN...

System: unauthenticated user can request SCEP one-time PIN decryption

Red Hat Certificate System RHCS 7.3 and 8 and Dogtag Certificate System do not require authentication for requests to decrypt SCEP one-time PINs, which allows remote attackers to obtain PINs by sniffing the network for SCEP requests and then sending decryption requests to the Certificate Authorit...

System: SCEP one-time PIN reuse

Red Hat Certificate System RHCS 7.3 and 8 and Dogtag Certificate System allow remote authenticated users to generate an arbitrary number of certificates by replaying a single SCEP one-time PIN...

Apple iPhone 锁屏安全绕过漏洞

Bugtraq ID: 44419 Apple iOS是一款运行在苹果iPhone和iPod touch设备上的最新的操作系统。 Apple iOS新版中的一个严重漏洞，iPhone在处理紧急呼叫时再次出现可绕过锁屏PIN Apple iOS 4.0.1 Apple iOS 4.2 beta Apple iOS 4.1 厂商补丁： Apple ------- 目前没有详细解决方案提供： http://www.apple.com/iphone/ 实现方法如下： 1.在PIN输入屏幕点击紧急呼叫按钮。 2.随意输入一些号码，例如1337并拨打。...

Chip and PIN Security Completely Broken by New Attack

A group of researchers has found a significant flaw in the chip-and-PIN security system used by credit card companies in the UK. The weakness allows an attacker to use a card without the PIN associated with it. In a normal transaction using the chip-and-PIN system, the cardholder needs to enter a...

GLSA-200908-01 : OpenSC: Multiple vulnerabilities

The remote host is affected by the vulnerability described in GLSA-200908-01 OpenSC: Multiple vulnerabilities Multiple vulnerabilities were found in OpenSC: b.badrignans discovered that OpenSC incorrectly initialises private data objects CVE-2009-0368. Miquel Comas Marti discovered that...

openSUSE Security Update : libopensc2 (libopensc2-598)

Private data objects on smartcards initialized with OpenSC could be accessed without authentication CVE-2009-0368. Only blank cards initialized with OpenSC are affected by this problem. Affected cards need to be manually fixed, updating the opensc package alone is not sufficient! Please carefully...

openSUSE Security Update : libopensc2 (libopensc2-598)

Private data objects on smartcards initialized with OpenSC could be accessed without authentication CVE-2009-0368. Only blank cards initialized with OpenSC are affected by this problem. Affected cards need to be manually fixed, updating the opensc package alone is not sufficient! Please carefully...