CVE-2016-10213

A10 AX1030 and possibly other devices with software before 2.7.2-P8 uses random GCM nonce generations, which makes it easier for remote attackers to obtain the authentication key and spoof data by leveraging a reused nonce in a session and a "forbidden attack," a similar issue to CVE-2016-0270...

CVE-2016-10212

Radware devices use the same value for the first two GCM nonces, which allows remote attackers to obtain the authentication key and spoof data via a "forbidden attack," a similar issue to CVE-2016-0270. NOTE: this issue may be due to the use of a third-party Cavium product...

Open redirect

IBM Sterling B2B Integrator Standard Edition could allow a remote attacker to conduct phishing attacks, using an open redirect attack. By persuading a victim to visit a specially-crafted Web site, a remote attacker could exploit this vulnerability to spoof the URL displayed to redirect a user to ...

Phishers unleash simple but effective social engineering techniques using PDF attachments

The Gmail phishing attack is reportedly so effective that it tricks even technical users, but it may be just the tip of the iceberg. We’re seeing similarly simple but clever social engineering tactics using PDF attachments. These deceitful PDF attachments are being used in email phishing attacks...

KLA10956 Multiple vulnerabilities in Mozilla Thunderbird

Multiple serious vulnerabilities have been found in Mozilla Thunderbird. Malicious users can exploit these vulnerabilities to obtain sensitive information, run arbitrary code, cause a denial of service, spoof user interface and gain privilege escalation. Below is a complete list of vulnerabilitie...

Weapon of Mass Destruction: WMD

Weapon of Mass Destruction This is a python tool with a collection of IT security software. The software is incapsulated in “modules”. The modules does consist of pure python code and/or external third programs. Main functions 1 To use a module, run the command “use modulecall”, e.g. “use apsniff...

CVE-2016-7037

The verify function in Encryption/Symmetric.php in Malcolm Fell jwt before 1.0.3 does not use a timing-safe function for hash comparison, which allows attackers to spoof signatures via a timing attack...

CVE-2016-4793

The clientIp function in CakePHP 3.2.4 and earlier allows remote attackers to spoof their IP via the CLIENT-IP HTTP header...

KLA10951 ACE vulnerability in Google Chrome

Incorrect optimisation assumptions in V8 engine were found in Google Chrome. By exploiting this vulnerability malicious users can perform arbitrary read/write operations and execute arbitrary code. This vulnerability can be exploited remotely via a specially designed HTML page. Original advisorie...

CVE-2016-7144

The CVE-2016-7144 entry relates to UnrealIRCd where the m_authenticate function in modules/m_sasl.c enables remote attackers to spoof certificate fingerprints and log in as another user via a crafted AUTHENTICATE parameter. Affected versions are UnrealIRCd before 3.2.10.7 and 4.x before 4.0.6. Th...

Brave Browser Address Bar Address Spoofing Vulnerability

Brave is an open source web browser based on Chromium. Brave Browser suffers from an address spoofing vulnerability in the address bar, which can be exploited by attackers to spoof addresses and perform unauthorized operations...

CVE-2016-10099

Borg aka BorgBackup before 1.0.9 has a flaw in the cryptographic protocol used to authenticate the manifest list of archives, potentially allowing an attacker to spoof the list of archives...

CVE-2016-10099

CVE-2016-10099 affects BorgBackup before 1.0.9, where a flaw in the cryptographic protocol used to authenticate the manifest could allow an attacker to spoof the archive list, compromising integrity of the manifest. Exploitation details are not provided in the documents; several entries indicate ...

CVE-2016-10099

Borg aka BorgBackup before 1.0.9 has a flaw in the cryptographic protocol used to authenticate the manifest list of archives, potentially allowing an attacker to spoof the list of archives...

CVE-2016-5188

CVE-2016-5188 affects Chromium/Blink: UI spoofing via crafted HTML pages allowing a remote attacker to spoof parts of the browser UI. The public description notes Chrome/Blink-era UI spoofing in the Blink component for Windows, Mac, and Linux prior to version 54.0.2840.59. Debian security advisor...

Google Fixes 12 High-Severity Vulnerabilities In Chrome Browser

Google is urging Windows, Mac and Linux users to update their Chrome browsers to fix multiple vulnerabilities that could allow malicious third parties to take control of targeted systems. Released Thursday, Chrome version 55.0.2883.75 for Windows, Mac, and Linux fixes those security issues. It al...

CVE-2016-2937

IBM BigFix Remote Control before 9.1.3 allows remote attackers to obtain sensitive information or spoof e-mail transmission via a crafted POST request, related to an "untrusted information vulnerability."...

UBUNTU-CVE-2016-9076

An issue where a "" dropdown menu can be used to cover location bar content, resulting in potential spoofing attacks. This attack requires e10s to be enabled in order to function. This vulnerability affects Firefox 50...

KLA11272 Multiple vulnerabilities in Mozilla Firefox

Multiple serious vulnerabilities have been found in Mozilla Firefox. Malicious users can exploit these vulnerabilities to cause denial of service, gain privileges, obtain sensitive information and spoof user interface. Below is a complete list of vulnerabilities: 1. A heap buffer overflow...

InVision: CORS Man-in-the-Middle account compromise

Description ==================== The invisionapp application implements HTTPS correctly by redirecting any HTTP traffic to HTTPS; this prevents, for example, the person sitting in the same office or home as you, or someone on the same open-wireless network as you e.g. McDonalds or airport, from...