CVE-2017-2484

An issue was discovered in certain Apple products. iOS before 10.3 is affected. The issue involves the "Phone" component. It allows attackers to trigger telephone calls to arbitrary numbers via a third-party app...

CVE-2017-2484

An issue was discovered in certain Apple products. iOS before 10.3 is affected. The issue involves the "Phone" component. It allows attackers to trigger telephone calls to arbitrary numbers via a third-party app...

Code injection

An issue was discovered in certain Apple products. iOS before 10.3 is affected. The issue involves the "Phone" component. It allows attackers to trigger telephone calls to arbitrary numbers via a third-party app...

Police Arrest Man Potentially Linked to Group Threatening to Wipe Millions Of iPhones

The British authority has reportedly arrested a 20-years-old young man – potentially one of the member of a cyber criminal gang 'Turkish Crime Family' who threatened Apple last week to remotely wipe data from millions of iOS devices unless Apple pays a ransom of $75,000. The UK's National Crime...

Stable Channel Updates for Chrome OS

The Stable channel has been updated to 57.0.2987.137 Platform version: 9202.60.0 for all Chrome OS devices except AOpen Chromebase Mini, AOpen Chromebox Mini, Google Chromebook Pixel 2015, ASUS Chromebook Flip C100PA, Samsung Chromebook Plus. This build contains a number of bug fixes, security...

Symantec API Flaws reportedly let attackers steal Private SSL Keys and Certificates

A security researcher has disclosed critical issues in the processes and third-party API used by Symantec certificate resellers to deliver and manage Symantec SSL certificates. The flaw, discovered by Chris Byrne, an information security consultant and instructor for Cloud Harmonics, could allow ...

Supply Chain Security: Akamai from a Customer's Risk Perspective

Managing risk is a key aspect of any business. This becomes more complicated when additional parties, such as vendors are brought into the mix. One of the strongest pieces of guidance on managing vendors that customers have brought to Akamai comes from the US Office of the Comptroller of the...

Android WiFi Denial of Service Vulnerability

Android is a Linux-based open source operating system developed by Google Inc. and the Open Handheld Consortium. A denial of service vulnerability exists in Android WiFi. The vulnerability arises due to the system-level Intent mechanism "com.android.server.WifiManager.action.DEVICEIDLE" in...

Android System Clock Alert Elimination Vulnerability

Android is a Linux-based open source operating system developed by Google Inc. and the Open Handheld Consortium. A security vulnerability exists in the Android System Clock Alert. The vulnerability is caused by the system-level Intent mechanism "com.android.deskclock.ALARMDISMISS" in...

Android Emergency Dialing Initiation Vulnerability

Android is a Linux-based open source operating system developed by Google Inc. and the Open Handheld Consortium. A security vulnerability exists in Android's emergency dialing activation feature. The vulnerability is caused by the system-level Intent mechanism...

Android Dialog Denial of Service Vulnerability

Android is a Linux-based open source operating system developed by Google Inc. and the Open Handheld Consortium. A denial of service vulnerability exists in the Android system dialog. The vulnerability is caused by the system-level Intent mechanism "android.intent.action.CLOSESYSTEMDIALOGS" in...

Virtuozzo 7 : vmauth (VZA-2017-018)

According to the version of the vmauth package installed, the Virtuozzo installation on the remote host is affected by the following vulnerability : - Incorrect checking of locked VM accounts in Virtuozzo SDK allowed one to use any password to log in to a VM with such a locked account via a...

Android Home Screen Hiding Vulnerability

Android is a Linux-based open source operating system developed by Google Inc. and the Open Handheld Consortium. A security vulnerability exists in the Android home screen. The vulnerability is caused by the system-level Intent mechanism "android.intent.action.MANAGEDPROFILEADDED" and...

CareFusion Pyxis SupplyStation System Vulnerabilities

OVERVIEW Independent researchers Billy Rios and Mike Ahmadi in collaboration with CareFusion have identified numerous third-party software vulnerabilities in end-of-life versions of CareFusion’s Pyxis SupplyStation system. The Pyxis SupplyStation was obtained through a third-party that resells...

[R1] LCE 5.0.1 Fixes Two Third-party Library Vulnerabilities

Log Correlation Engine LCE 5.0.0 is impacted by multiple vulnerabilities reported in a third-party library and an encryption algorithm. LCE was errantly using 3DES on TCP port 1243. The following vulnerabilities have been resolved with the updated libraries...

Oracle Knowledge Management XXE Leading to a RCE

Vulnerability Summary The following advisory describe Information Disclosure found in Oracle Knowledge Management version 8.5.1. By enabling searches across a wide variety of sources, Oracle’s InQuira knowledge management products offer simple and convenient ways for users to access knowledge tha...

Oracle Knowledge Management 12.1.1 < 12.2.5 - XML External Entity Leading To Remote Code Execution

SSD Advisory – Oracle Knowledge Management XXE Leading to a RCE Vulnerability Summary The following advisory describe Information Disclosure found in Oracle Knowledge Management version 8.5.1. By enabling searches across a wide variety of sources, Oracle's InQuira knowledge management products...

Hundreds of High-Profile Twitter Accounts Hacked through 3rd-Party App

In a large-scale Twitter hack, thousands of Twitter accounts from media outlets to celebrities, including the European Parliament, Forbes, BlockChain, Amnesty International, UNICEF, Nike Spain and numerous other individuals and organizations, were compromised early Wednesday. The compromised...

Fedora 24 : php-pear-PHP-CodeSniffer (2017-aaf92c483c)

Version 2.8.1 - This release contains a fix for a security advisory related to the improper handling of shell commands - Uses of shellexec and exec were not escaping filenames and configuration settings in most cases - A properly crafted filename or configuration option would allow for arbitrary...

LocalTapiola: XSS on 3rd party service Localtapiola is using

Basic report information Summary: Localtapiola is using careers.fi service to job applicants at http://www.lahitapiola.fi/tietoa-lahitapiolasta/toihin-meille/avoimet-tyopaikat/haemme-juuri-nyt Description: XSS on 3rd party careers.fi job service which may lead loss of personal data for the...