12443 matches found
PT-2017-19020
Name of the Vulnerable Software and Affected Versions cayuga-lake-national-bank/id1151601539 app version 4.0.1 Description The issue allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate, as the app does not verify X.509 certificates from S...
CVE-2017-9567: Improper Certificate Validation
The avb-bank-mobile-banking/id592565443 app 3.0.0 for iOS does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...
CVE-2017-9580: Improper Certificate Validation
The "Pioneer Bank & Trust Mobile Banking" by PIONEER BANK AND TRUST app 3.0.0 -- aka pioneer-bank-trust-mobile-banking/id603182861 for iOS does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted...
CVE-2017-9573: Improper Certificate Validation
The North Adams State Bank Ursa nasb-mobile-banking/id980573797 app 3.0.1 for iOS does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...
PT-2017-19044
Name of the Vulnerable Software and Affected Versions HBO Mobile Banking version 3.0.0 Description The issue allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate because the app does not verify X.509 certificates from SSL servers...
PT-2017-19047
Name of the Vulnerable Software and Affected Versions PCSB BANK Mobile app version 3.0.4 Description The issue allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate, as the app does not verify X.509 certificates from SSL servers...
CVE-2017-9558: Improper Certificate Validation
The wawa-employees-credit-union-mobile/id1158082793 app 4.0.1 for iOS does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...
PT-2017-19034
Name of the Vulnerable Software and Affected Versions KC Area Credit Union Mobile Banking version 3.0.1 Description The issue allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate because the app does not verify X.509 certificates from SSL...
PT-2017-19059
Name of the Vulnerable Software and Affected Versions Fountain Trust Mobile Banking versions prior to 3.2.0 Description The issue allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate because the app does not verify X.509 certificates from...
PT-2017-19058
Name of the Vulnerable Software and Affected Versions Morton Credit Union Mobile Banking version 3.0.1 Description The issue allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate because the app does not verify X.509 certificates from SSL...
CVE-2017-9590: Improper Certificate Validation
The "State Bank of Waterloo Mobile Banking" by State Bank of Waterloo app 3.0.2 -- aka state-bank-of-waterloo-mobile-banking/id555321714 for iOS does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a...
Linux is secure…right?
“There are no threats for Linux servers. Aren’t they built to be secure?” “Linux servers are secure and hardened, why do we need additional security controls on those?” “I do understand there are threats out there but I am not aware of any major attacks on Linux servers” If you find yourself...
National Exposure Index 2017
Today, Rapid7 is releasing the second National Exposure Index, our effort to quantify the exposure that nations are taking on by offering public services on the internet--not just the webservers like the one hosting this blog, but also unencrypted POP3, IMAPv4, telnet, database servers, SMB, and...
Scan of Internet Reveals Millions of Exposed Services
If you thought WannaCry inspired a global wakeup call and a massive crackdown on exposed and dangerous ports, you would be wrong. In its annual National Exposure Index report, Rapid7 found 160 million computers, IoT devices and servers with open ports that should not be exposed to the public...
Microsoft Outlook Memory Corruption Vulnerability
A remote code execution vulnerability exists in the way that Microsoft Outlook parses specially crafted email messages. An attacker who successfully exploited this vulnerability could take control of an affected system. An attacker could then install programs; view, change, or delete data; or...
Attackers Mining Cryptocurrency Using Exploits for Samba Vulnerability
Unknown attackers are using a recently patched vulnerability in Samba to spread a resource-intensive cryptocurrency mining utility. To date, the operation has netted the attackers just under $6,000 USD, but the number of compromised computers is growing, meaning that a significant number of Samba...
MGASA-2017-0166 Updated gajim packages fix security vulnerability
Gajim unconditionally implements the "XEP-0146: Remote Controlling Clients" extension, which may be abused by malicious XMPP servers to, for example, extract plaintext from OTR encrypted sessions CVE-2016-10376...
[SECURITY] Fedora 26 Update: freeradius-3.0.14-1.fc26
The FreeRADIUS Server Project is a high performance and highly configurable GPL'd free RADIUS server. The server is similar in some respects to Livingston's 2.0 server. While FreeRADIUS started as a variant of the Cistron RADIUS server, they don't share a lot in common any more. It now has many...
[SECURITY] Fedora 25 Update: freeradius-3.0.14-1.fc25
The FreeRADIUS Server Project is a high performance and highly configurable GPL'd free RADIUS server. The server is similar in some respects to Livingston's 2.0 server. While FreeRADIUS started as a variant of the Cistron RADIUS server, they don't share a lot in common any more. It now has many...