519 matches found
GHSA-94JQ-Q5V2-76WJ Improper certificate management in AWS IoT Device SDK v2
Connections initialized by the AWS IoT Device SDK v2 for Java versions prior to 1.3.3, Python versions prior to 1.5.18, C++ versions prior to 1.12.7 and Node.js versions prior to 1.5.1 did not verify server certificate hostname during TLS handshake when overriding Certificate Authorities CA in...
Insecure Certificate Validation
aws/aws-iot-device-sdk-js-v2 is vulnerable to Insecure Certificate Validation. Attackers are able to compromise certificate authorities in their trust stores on Linux/Unix, by spoofing DNS records to bypass CA pinning...
Insecure Certificate Validation
aws-iot-device-sdk-v2 uses insecure certificate validation. The library does not verify server certificate hostname during TLS handshake, allowing attackers to override certificate authorities in their trust stores on Microsoft Windows...
Insecure Certificate Validation
aws-iot-device-sdk-v2 uses insecure certificate validation. The library does not verify server certificate hostname during TLS handshake, allowing attackers to override certificate authorities in their trust stores on MacOS...
Improper Certificate Validation
Connections initialized by the AWS IoT Device SDK v2 for Java, Python , C++ and Node.js does not verify server certificate hostname during TLS handshake when overriding Certificate Authorities CA in their trust stores on MacOS. This issue has been addressed in aws-c-io submodule onward. This issu...
Costco Confirms: A Data Skimmer’s Been Ripping Off Customers
Costco has discovered a payment card skimming device at one of its retail stores and has sent out notification letters informing customers that their card data may have been ripped off if they shopped there recently. Some customers have been aware for weeks that something was fishy and have been...
This New Android Malware Can Gain Root Access to Your Smartphones
An unidentified threat actor has been linked to a new Android malware strain that features the ability to root smartphones and take complete control over infected smartphones while simultaneously taking steps to evade detection. The malware has been named "AbstractEmu" owing to its use of code...
GriftHorse Money-Stealing Trojan Takes 10M Android Users for a Ride
More than 10 million Android users have been saddled with a malware called GriftHorse that’s trojanizing various applications and secretly subscribing victims to premium mobile services – a type of billing fraud that researchers categorize as “fleeceware.” Zimperium uncovered more than 130...
The vulnerability of the Magento Commerce software platform for developing and managing online stores stems from improper code generation, allowing attackers to execute arbitrary code.
The vulnerability of the Magento Commerce software platform for developing and managing online stores is related to improper code generation. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...
After command-line install of Workspace App 2107, there in no Add button to add additional Stores
When installing CWA via command line that includes a store, the Add button in Accounts may be missing...
Android Malware ‘FlyTrap’ Hijacks Facebook Accounts
Researchers have uncovered a new Android trojan, dubbed FlyTrap, that’s spread to more than 10,000 victims via rigged apps on third-party app stores, sideloaded apps and hijacked Facebook accounts. In a report posted on Monday, Zimperium’s zLabs mobile threat research teams wrote that FlyTrap has...
The vulnerability of the Magento Commerce software platform for developing and managing online stores relates to access control errors, which allow unauthorized users to gain unauthorized access to protected data.
The vulnerability of the Magento Commerce software platform for developing and managing online stores is related to lack of access control. Exploiting this vulnerability could allow an attacker operating remotely to gain unauthorized access to protected data...
Unpatched Flaw in Linux Pling Store Apps Could Lead to Supply-Chain Attacks
Cybersecurity researchers have disclosed a critical unpatched vulnerability affecting Pling-based free and open-source software FOSS marketplaces for Linux platform that could be potentially abused to stage supply-chain attacks and achieve remote code execution RCE. "Linux marketplaces that are...
编号撤回
OpenSSL is an open source capable general-purpose cryptographic library from the Openssl team that implements the Secure Sockets Layer SSLv2/v3 and Secure Transport Layer TLSv1 protocols. The product supports a variety of cryptographic algorithms , including symmetric ciphers , hash algorithms ,...
hw: information disclosure on some Intel Atom processors
A potential domain bypass transient execution vulnerability was discovered on some Intel Atom® processors that uses a microarchitectural incidental channel. Currently this channel can reveal supervisor data in the L1 cache and the contents of recent stores. As a consequence, this issue may allow ...
hw: information disclosure on some Intel Atom processors
A potential domain bypass transient execution vulnerability was discovered on some Intel Atom® processors that uses a microarchitectural incidental channel. Currently this channel can reveal supervisor data in the L1 cache and the contents of recent stores. As a consequence, this issue may allow ...
hw: information disclosure on some Intel Atom processors
A potential domain bypass transient execution vulnerability was discovered on some Intel Atom® processors that uses a microarchitectural incidental channel. Currently this channel can reveal supervisor data in the L1 cache and the contents of recent stores. As a consequence, this issue may allow ...
hw: information disclosure on some Intel Atom processors
A potential domain bypass transient execution vulnerability was discovered on some Intel Atom® processors that uses a microarchitectural incidental channel. Currently this channel can reveal supervisor data in the L1 cache and the contents of recent stores. As a consequence, this issue may allow ...
The vulnerability of the Magento Commerce software platform for developing and managing online stores, related to authentication errors, allows a perpetrator to gain unauthorized access to protected information.
The vulnerability of the Magento Commerce development and management software platform is related to authentication errors. Exploiting this vulnerability can allow an attacker, operating remotely, to gain unauthorized access to protected information...
Citrix Workspace App - Duplicate published app icons showing up in the endpoints
The customer recently deployed CWA through all company’s workstations and created a GPO to push the Store to CWA in the machines He noticed after the deployment that the endpoints and CWA show a duplicate of each published app Also, CWA shows two stores of the same name...