qpid-proton/fuzz-message-decode: Heap-buffer-overflow in pni_decoder_decode_value

Project: https://github.com/apache/qpid-proton.git Detailed report: https://oss-fuzz.com/testcase?key=5311329584807936 Project: qpid-proton Fuzzer: aflqpid-protonfuzz-message-decode Fuzz target binary: fuzz-message-decode Job Type: aflasanqpid-proton Platform Id: linux Crash Type:...

proton-egypt.com Improper Access Control vulnerability

Open Bug Bounty ID: OBB-578920 Description| Value ---|--- Affected Website:| proton-egypt.com Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| IAC Improper Access Control / CWE-284 CVSSv3 Score:| 6.5...

qpid-proton: reactor sends messages in clear if ssl is requested but not available

The 1 proton.reactor.Connector, 2 proton.reactor.Container, and 3 proton.utils.BlockingConnection classes in Apache Qpid Proton before 0.12.1 improperly use an unencrypted connection for an amqps URI scheme when SSL support is unavailable, which might allow man-in-the-middle attackers to obtain...

Fake Symantec Blog Caught Spreading Proton macOS Malware

By Waqas In February this year, HackRead published a detailed report on Proton malware This is a post from HackRead.com Read the original post: Fake Symantec Blog Caught Spreading Proton macOS Malware...

Hackers infect Mac users with Proton malware using Elmedia Player

By Waqas The general concept regarding Apple devices is that they are This is a post from HackRead.com Read the original post: Hackers infect Mac users with Proton malware using Elmedia Player...

Mac malware OSX.Proton strikes again

The hackers responsible for the Mac malware OSX.Proton have struck again, this time infecting a copy of the Elmedia Player app that was being distributed from the official Eltima website. At this time, it is still unknown how long their website was providing the hijacked app. Proton was silently...

A new kind of Apple phishing scam

In a recent blog post, Felix Krause revealed a method for phishing Apple ID passwords on iOS that would be quite indistinguishable from a real iOS password request. This got us thinking about the ramifications—how else could this tactic be used in the Apple ecosystem, and what kind of damage coul...

Keychain vulnerability in macOS

On Monday, Patrick Wardle, a respected security researcher at Synack and owner of Objective-See, sent a tweet about a keychain vulnerability he had found in macOS High Sierra. As his tweet showed, it is possible for a malicious app to extract, and then exfiltrate, keychain data from High Sierra,...

ProtonMail Launches Free VPN Service

Encrypted email service ProtonMail announced today it was launching a free VPN service called ProtonVPN. Developers said the move comes following one year of development and four months of beta testing by 10,000 ProtonMail community members. According to Proton Technologies AG, the company behind...

HandBrake for Mac Compromised with Proton Spyware

The handlers of the open source HandBrake video transcoder are warning anyone who recently downloaded the Mac version of the software that they’re likely infected with malware. HandBrake warned users on Saturday of a compromise of one of its mirror download servers, and said anyone who grabbed th...

Website of Popular Mac Software Hacked to Spread Malware

If you have recently downloaded the popular open source video transcoder app HandBrake on your Mac, there are chances that your computer is infected with a notorious Remote Access Trojan RAT. The HandBrake team issued a security alert on Saturday, warning Mac users that one of its mirror servers ...

Design/Logic Flaw

The C client and C-based client bindings in the Apache Qpid Proton library before 0.13.1 on Windows do not properly verify that the server hostname matches a domain name in the subject's Common Name CN or subjectAltName field of the X.509 certificate when using the SChannel-based security layer,...

CVE-2016-4467

The C client and C-based client bindings in the Apache Qpid Proton library before 0.13.1 on Windows do not properly verify that the server hostname matches a domain name in the subject's Common Name CN or subjectAltName field of the X.509 certificate when using the SChannel-based security layer,...

CVE-2016-4467

The C client and C-based client bindings in the Apache Qpid Proton library before 0.13.1 on Windows do not properly verify that the server hostname matches a domain name in the subject's Common Name CN or subjectAltName field of the X.509 certificate when using the SChannel-based security layer,...

CVE-2016-4467

The C client and C-based client bindings in the Apache Qpid Proton library before 0.13.1 on Windows do not properly verify that the server hostname matches a domain name in the subject's Common Name CN or subjectAltName field of the X.509 certificate when using the SChannel-based security layer,...

CVE-2016-4467

The C client and C-based client bindings in the Apache Qpid Proton library before 0.13.1 on Windows do not properly verify that the server hostname matches a domain name in the subject's Common Name CN or subjectAltName field of the X.509 certificate when using the SChannel-based security layer,...

CVE-2016-4467

The CVE-2016-4467 issue affects the C client and C-based client bindings in the Apache Qpid Proton library prior to 0.13.1 on Windows. The root cause is improper verification of the server hostname against the domain name in the certificate’s CN or subjectAltName when using the SChannel security ...

CVE-2016-4467

The C client and C-based client bindings in the Apache Qpid Proton library before 0.13.1 on Windows do not properly verify that the server hostname matches a domain name in the subject's Common Name CN or subjectAltName field of the X.509 certificate when using the SChannel-based security layer,...

PT-2017-8498 · Apache +1 · Apache Qpid Proton +1

Name of the Vulnerable Software and Affected Versions: Apache Qpid Proton library versions prior to 0.13.1 Description: The issue concerns the C client and C-based client bindings in the Apache Qpid Proton library, which do not properly verify the server hostname against the domain name in the...

Apache Qpid Proton Security Bypass Vulnerability

Apache Qpid Proton is the United States Apache Apache Software Foundation developed a high-performance, lightweight messaging library. A security bypass vulnerability exists in Apache Qpid Proton versions 0.8 through 0.13.0, which can be exploited by an attacker to conduct a man-in-the-middle...