7799 matches found
Pacemaker Ecosystem Fails its Cybersecurity Checkup
Pacemakers continue to be the front line of medical device security debates after a research paper published this week described a frightening list of cybersecurity issues plaguing devices built by leading manufacturers, including a lack of authentication and encryption, and the use of third-part...
Android Overlay and Accessibility Features Leave Millions at Risk
University researchers are warning that two features, not flaws, core to Google’s Android mobile operating system can be used together to launch clickjacking attacks to gain control of a target’s phone. The discovery was made by researchers at Georgia Institute of Technology, who call the researc...
[SECURITY] [DSA 3861-1] libtasn1-6 security update
------------------------------------------------------------------------- Debian Security Advisory DSA-3861-1 [email protected] https://www.debian.org/security/ Sebastien Delafond May 24, 2017 https://www.debian.org/security/faq -...
[SECURITY] [DSA 3861-1] libtasn1-6 security update
------------------------------------------------------------------------- Debian Security Advisory DSA-3861-1 [email protected] https://www.debian.org/security/ Sebastien Delafond May 24, 2017 https://www.debian.org/security/faq -...
libsndfile -- out-of-bounds read memory access
Laurent Delosieres, Secunia Research at Flexera Software reports: Secunia Research has discovered a vulnerability in libsndfile, which can be exploited by malicious people to disclose potentially sensitive information. The vulnerability is caused due to an error in the "aiffreadchanmap" function...
vlc -- remote code execution via crafted subtitles
Check Point research team reports: Remote code execution via crafted subtitles...
Verizon Patches XSS Issues in its Messaging Client
Verizon late last year patched a vulnerability in its Message+ messaging client that could have allowed an attacker to take over a session and possibly extend their reach into a user’s account management settings. Researcher Randy Westergren yesterday disclosed some details on the bug, which coul...
Design flaws in the Foreign Research Service's digital English platform
iTEST is a comprehensive test management platform that provides English test bank resources and online assessment services for colleges and universities. A design vulnerability exists at the password retrieval of the Digital English Platform of the Foreign Research Institute. It allows attackers ...
aefect.nl XSS vulnerability
Vulnerable URL: http://www.aefect.nl/index.phtml?tooluser=aefect-02"'--!=vveaefect=form================submit====id==∂zak=== Details: Description| Value ---|--- Patched:| No Latest check for patch:| 31.07.2017 Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa Rank| Unknown ...
Google Nexus 9 Cypress SAR Firmware Injection via I2C Vulnerability
Exploit for Android platform in category remote exploits Title: ==== Google Nexus 9 Cypress SAR Firmware Injection via I2C Identifier: ======== CVE-2017-0563 Product: ======= Google Nexus 9 Vulnerable Version: ================ Nexus 9 Android Builds before N4F27B - May 2017, i.e. before bootloade...
Researchers Disclose Intel AMT Flaw Research
On Friday, just as Intel released additional information regarding a critical flaw found earlier this week in a subset of its business-class PCs, the researchers behind the initial vulnerability discovery, Embedi, also published their research on the flaw. Intel warned Monday of a firmware...
Explained — How Intel AMT Vulnerability Allows to Hack Computers Remotely
Earlier this week Intel announced a critical escalation of privilege bug that affects its remote management features shipping with Intel Server chipsets for past 7 years, which, if exploited, would allow a remote attacker to take control of vulnerable PCs, laptops, or servers. The vulnerability,...
VulnCheck KEV: CVE-2017-20210
Photo Station 5.4.1 & 5.2.7 include the security fix for the vulnerability related to the XMR mining programs identified by internal research...
PWN2OWN 2017 the Linux kernel to mention the right vulnerability analysis-vulnerability warning-the black bar safety net
! 0. Foreword In 2017, the PWN2OWN contest, the long Pavilion security research lab Chaitin Security Research Lab successfully demonstrates Ubuntu 16.10 Desktop of the local extraction rights. This attack mainly use the linux kernel IPSEC frameworkfrom linux2. 6 Start supportin a memory bounds...
fr.flamingtext.com XSS vulnerability
Open Bug Bounty ID: OBB-230308 Description| Value ---|--- Affected Website:| fr.flamingtext.com Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...
PT-2018-17: Information Disclosure in Schneider Electric's Modicon Premium, Modicon Quantum, Modicon M340, and BMXNOR0200
The specialists of the Positive Research center have detected an Information Disclosure vulnerability in Schneider Electric's Modicon Premium, Modicon Quantum, Modicon M340, and BMXNOR0200. Hash collisions in algorithms used for password encryption allow attackers to obtain passwords. How to fix...
PT-2018-15: Arbitrary Code Execution in Schneider Electric's Modicon Quantum
The specialists of the Positive Research center have detected an Arbitrary Code Execution vulnerability in Schneider Electric's Modicon Quantum. A vulnerability allows attackers to execute arbitrary code, cause a denial of service, or load a malicious firmware via an FTP command used to upgrade t...
PT-2018-19: Authorization Bypass in Schneider Electric's Modicon Premium, Modicon Quantum, Modicon M340, and BMXNOR0200
The specialists of the Positive Research center have detected an Authorization Bypass vulnerability in Schneider Electric's Modicon Premium, Modicon Quantum, Modicon M340, and BMXNOR0200. Vulnerability allows attackers to bypass authorization using requests to CGI functions. How to fix Use the...
New COOP Attack Method Highlights Weaknesses In Microsoft's CFG Defenses
Researchers at Endgame have been evaluating an exploitation technique called Counterfeit Object-Oriented Programming COOP to bypass Control Flow Integrity CFI implementations such as that used by Microsoft to harden the defenses of Windows 10. Microsoft added its mitigation, called Control Flow...