openssl: Possible integer overflow vulnerabilities in codebase

Multiple integer overflow flaws were found in the way OpenSSL performed pointer arithmetic. A remote attacker could possibly use these flaws to cause a TLS/SSL server or client using OpenSSL to crash...

Akamai Launches New Solution to Help Enterprise Security Teams Address the Impact of Malware, Ransomware, and DNS-based Data Exfiltration

Today, we are proud to introduce Akamai Enterprise Threat Protector ETP. ETP is designed to provide customers quick-to-deploy and easy-to-manage cloud-based protection against the impact of complex, targeted threats such malware, ransomware, phishing, and DNS‑based data exfiltration. One...

A vulnerability in the web console of the Antivirus Kasperksy 8.0 anti-virus software for Linux File Servers, which allows for the execution of arbitrary code with privileges of a privileged user.

The vulnerability of the Antivirus Kaspersky 8.0 anti-virus software for Linux File Servers relates to the insecure management of privileges. Exploiting this vulnerability allows a malicious user with non-privileged privileges to execute code with privileged root privileges, through the use of th...

The vulnerability of the Antivirus Kasperksy 8.0 web console for Linux File Servers allows an attacker to send commands to the antivirus software on behalf of its user.

The vulnerability of the Antivirus Kaspersky 8.0 web console for Linux File Servers arises from the lack of authenticity verification for the creators of the web consoles. Exploiting this vulnerability allows a malicious actor to send an antivirus command on behalf of the user who visits the...

GNU glibc CVE-2015-5180 Remote Denial of Service Vulnerability

Description GNU glibc is prone to a remote denial-of-service vulnerability. Successfully exploiting this issue allows remote attackers to crash the affected process, denying service to legitimate users. Versions prior to GNU glibc 2.25 are vulnerable. Technologies Affected GNU glibc 1.2.3 GNU gli...

iBall Baton iB-WRA150N - Unauthenticated DNS Change Exploit

shell !/bin/bash iBall Baton iB-WRA150N Unauthenticated Remote DNS Change Exploit Copyright 2016 c Todor Donev https://www.ethical-hacker.org/ https://www.facebook.com/ethicalhackerorg Description: The vulnerability exist in the web interface, which is accessible without authentication. Once...

CVE-2017-3744

CVE-2017-3744 affects Lenovo System x IMM2 firmware. Remote commands issued by LXCA/other utilities may be logged in the FFDC service log, potentially exposing clear-text login information to authorized users who can capture/export FFDC data. Impact is confined to Lenovo System x IMM2, with the v...

PT-2017-16078

Name of the Vulnerable Software and Affected Versions Lenovo System x servers affected versions not specified Description The issue concerns the IMM2 firmware of Lenovo System x servers, where remote commands issued by LXCA or other utilities may be captured in the First Failure Data Capture FFDC...

CVE-2017-3744

In the IMM2 firmware of Lenovo System x servers, remote commands issued by LXCA or other utilities may be captured in the First Failure Data Capture FFDC service log if the service log is generated when that remote command is running. Captured command data may contain clear text login information...

Ransomware & Advanced Attacks: Servers are Different

Ransomware and other advanced attacks are the scourge of the modern IT security team. If allowed to gain access to your IT environment, these attacks could shut down the organization, denying access to mission critical applications & data for potentially days, or even indefinitely. The result? Th...

Web Hosting Company Pays $1 Million to Ransomware Hackers to Get Files Back

South Korean web hosting provider has agreed to pay $1 million in bitcoins to hackers after a Linux ransomware infected its 153 servers, encrypting 3,400 business websites and their data, hosted on them. According to a blog post published by NAYANA, the web hosting company, this unfortunate event...

Beetel BCM96338 Router - DNS Change

Beetel BCM96338 Router - DNS Change !/bin/bash Beetel BCM96338 ADSL Router Unauthenticated Remote DNS Change Exploit Copyright 2017 c Todor Donev https://www.ethical-hacker.org/ https://www.facebook.com/ethicalhackerorg Description: The vulnerability exist in the web interface, which is accessibl...

D-Link DSL-2640U - DNS Change

D-Link DSL-2640U - DNS Change !/bin/bash D-Link ADSL DSL-2640U IM1.00 Unauthenticated Remote DNS Change Exploit Copyright 2017 c Todor Donev https://www.ethical-hacker.org/ https://www.facebook.com/ethicalhackerorg Description: The vulnerability exist in the web interface, which is accessible...

CVE-2017-7375

A flaw in libxml2 allows remote XML entity inclusion with default parser flags i.e., when the caller did not request entity substitution, DTD validation, external DTD subset loading, or default DTD attributes. Depending on the context, this may expose a higher-risk attack surface in libxml2 not...

Design/Logic Flaw

The MEA Financial vision-bank/id420406345 app 3.0.1 for iOS does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

Security feature bypass

The first-security-bank-sleepy-eye-mobile/id870531890 app 3.0.0 for iOS does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

Design/Logic Flaw

The "Middleton Community Bank Mobile Banking" by Middleton Community Bank app 3.0.0 -- aka middleton-community-bank-mobile-banking/id721843238 for iOS does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information vi...

Buffer overflow

The "Oritani Mobile Banking" by Oritani Bank app 3.0.0 -- aka oritani-mobile-banking/id778851066 for iOS does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

Design/Logic Flaw

The financial-plus-mobile-banking/id731070564 app 3.0.3 for iOS does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

Information disclosure

The wawa-employees-credit-union-mobile/id1158082793 app 4.0.1 for iOS does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...