Another severe flaw in Signal desktop app lets hackers steal your chats in plaintext

For the second time in less than a week, users of the popular end-to-end encrypted Signal messaging app have to update their desktop applications once again to patch another severe code injection vulnerability. Discovered Monday by the same team of security researchers, the newly discovered...

OpenPGP、S/MIME information disclosure (CVE-2017-17688,CVE-2017-17689)

EFAIL describes vulnerabilities in the end-to-end encryption technologies OpenPGP and S/MIME that leak the plaintext of encrypted emails. Email is a plaintext communication medium whose communication paths are partly protected by TLS TLS. For people in hostile environments journalists, political...

S/MIME Information Disclosure Vulnerability

S/MIME is a certificate implementation for email encryption. A security vulnerability exists in S/MIME. An attacker could exploit the vulnerability to obtain a message in plaintext form from an encrypted message...

PT-2018-6546 · Openpgp +1 · Openpgp +1

Name of the Vulnerable Software and Affected Versions: OpenPGP affected versions not specified Description: The issue allows a Cipher Feedback Mode CFB malleability-gadget attack that can indirectly lead to plaintext exfiltration. This is reportedly a problem in applications that mishandle the...

Moxa EDR-810 Password Storage Vulnerability

The EDR-810 is a highly integrated industrial multi-port security router with firewall/NAT/VPN and two-layer manageable switch functionality. A password storage vulnerability exists in the operating system functionality of the Moxa EDR-810 V4.1 build 17030317. An attacker with shell access could...

OpenPGP Information Disclosure Vulnerability

OpenPGP is a set of email encryption standards that supports multiple platforms. An information disclosure vulnerability exists in OpenPGP. An attacker could exploit this vulnerability to conduct a man-in-the-middle attack and obtain messages in plaintext form from encrypted emails...

Details on a New PGP Vulnerability

A new PGP vulnerability was announced today. Basically, the vulnerability makes use of the fact that modern e-mail programs allow for embedded HTML objects. Essentially, if an attacker can intercept and modify a message in transit, he can insert code that sends the plaintext in a URL to a remote...

Critical PGP Vulnerability

EFF is reporting that a critical vulnerability has been discovered in PGP and S/MIME. No details have been published yet, but one of the researchers wrote: We'll publish critical vulnerabilities in PGP/GPG and S/MIME email encryption on 2018-05-15 07:00 UTC. They might reveal the plaintext of...

CVE-2017-17689

The S/MIME specification allows a Cipher Block Chaining CBC malleability-gadget attack that can indirectly lead to plaintext exfiltration, aka EFAIL. Mitigation The easiest way to mitigate this vulnerability is not to use HTML emails. If you really need to use them ensure that MUA clients disable...

Critical Flaws in PGP and S/MIME Tools Can Reveal Encrypted Emails in Plaintext

Note—the technical details of the vulnerabilities introduced in this article has now been released, so you should also read our latest article to learn how the eFail attack works and what users can do to prevent themselves. An important warning for people using widely used email encryption...

Critical Flaws in PGP and S/MIME Tools Can Reveal Encrypted Emails in Plaintext

Note— the technical details of the vulnerabilities introduced in this article has now been released, so you should also read our latest article to learn how the eFail attack works and what users can do to prevent themselves. An important warning for people using widely used email encryption...

OpenPGP, S/MIME Mail Client Vulnerabilities

The CERT Coordination Center CERT/CC has released information on email client vulnerabilities that can reveal plaintext versions of OpenPGP- and S/MIME-encrypted emails. A remote attacker could exploit these vulnerabilities to obtain sensitive information. NCCIC encourages users and administrator...

Easy Hosting Control Panel Information Disclosure Vulnerability

Easy Hosting Control Panel EHCP is an open source hosting control panel that is used to manage domains, emails, ftp users and more. A security vulnerability exists in EHCP version 0.37.12.b, which originates from the program storing passwords in plaintext form. An attacker could exploit this...

OpenPGP and S/MIME mail client vulnerabilities

Overview Mail clients may leak plaintext messages while decrypting OpenPGP and S/MIME messages. Description Email clients supporting the OpenPGP or S/MIME standards may be vulnerable to a CBC/CFB gadget attack which may allow an attacker to inject content into an encrypted email which would...

Bitpie application for Android and iOS information disclosure vulnerability

Bitpie application for Android is an Android-based application for managing and trading multiple blockchain assets.Bitpie application for iOS is its iOS-based version. A security vulnerability exists in versions 3.2.4 and earlier of the Bitpie application for Android and iOS based platforms, whic...

McAfee VirusScan Enterprise Elevation of Privilege Vulnerability

McAfee VirusScan Enterprise VSE is a suite of antivirus software from the American company McAfee. The software provides a full range of security protection, scanning memory for malicious code and optimizing updates for remote systems, etc. Microsoft Windows client is one of its clients based on...

Change Your Twitter Password Immediately, Bug Exposes Passwords in Plaintext

Twitter is urging all of its 330 million users to change their passwords after a software glitch unintentionally exposed its users' passwords by storing them in readable text on its internal computer system. The social media network disclosed the issue in an official blog post and a series of...

Change Your Twitter Password Immediately, Bug Exposes Passwords in Plaintext

Twitter is urging all of its 330 million users to change their passwords after a software glitch unintentionally exposed its users' passwords by storing them in readable text on its internal computer system. The social media network disclosed the issue in an official blog post and a series of...

IBM Cognos Business Intelligence Information Disclosure Vulnerability

IBM Cognos Business Intelligence BI is a suite of business intelligence software from IBM in the United States. The software includes reports, dashboards and scorecards, and can assist companies in adjusting their decisions by analyzing key factors and key stakeholders. A security vulnerability...

FreeBSD : chromium -- vulnerability (36ff7a74-47b1-11e8-a7d6-54e1ad544088)

Google Chrome Releases reports : 62 security fixes in this release : - 826626 Critical CVE-2018-6085: Use after free in Disk Cache. Reported by Ned Williamson on 2018-03-28 - 827492 Critical CVE-2018-6086: Use after free in Disk Cache. Reported by Ned Williamson on 2018-03-30 - 813876 High...