[SECURITY] Fedora 20 Update: krb5-1.11.5-10.fc20

Kerberos V5 is a trusted-third-party network authentication system, which can improve your network's security by eliminating the insecure practice of sending passwords over the network in unencrypted form...

PT-2014-6310 · Sap · Sap Hana Extended Application Services

Name of the Vulnerable Software and Affected Versions: SAP HANA Extend Application Services XS affected versions not specified Description: The issue concerns the lack of encryption for transmissions in applications that use form-based authentication with SSL, allowing remote attackers to interce...

Instagram Mobile App Issue Leads to Account Hijacking Vulnerability

In the era of Government surveillance, ensuring the security and safety of our private communications regardless of platform – email, VOIP, message, even cookies stored – should be the top priority of the Internet industry. Some industry came together to offer Encryption as the protection against...

Research Shows Increase in Internet Filtering and Usage of FireChat App in Iraq

Researchers at Citizen Lab have taken a close look at the extent of Internet filtering in Iraq, as well as the security of a popular offline chat app used there, and found an increase in the number of services blocked by the government and identified serious privacy and security problems with the...

nss: false start PR_Recv information disclosure security issue

A flaw was found in the way TLS False Start was implemented in NSS. An attacker could use this flaw to potentially return unencrypted information from the server...

Facebook SDK Vulnerability Puts Millions of Smartphone Users' Accounts at Risk

Security researchers from MetaIntell, the leader in intelligent led Mobile Risk Management MRM, have discovered a major security vulnerability in the latest version of Facebook SDK that put millions of Facebook user's Authentication Tokens at risk. Facebook SDK for Android and iOS is the easiest...

IISWorks FileMan fileman.mdb Remote User Database Disclosure

No description provided by source. Exploit Title: IISWorks FileMan fileman.mdb Remote User Database Disclosure Disclosure Date: July 5, 2005 Author: Known Vulnerability Software Link: http://www.scriptdungeon.com/scripts/asp/FileManASP.rar Version: OSVDB: 17824 Security Tracker ID: 1014383 Found...

constructr cms <= 3.02.5 stable Multiple Vulnerabilities

No description provided by source. Constructr CMS http://constructr-cms.org/ - = 3.02.5 Stable - magicquotesgpc = Off registerglobals = On - Directory Traversal - Source Disclosure - Arbitrary File Creation - Etc Etc Etc - http://site/constructr/backend/template.php?editfile= Db info:...

Bilyoner apps insecure data transmission

Under some conditions data is sent unencrypted...

Sensys Networks Traffic Sensor Vulnerabilities (Update A)

OVERVIEW This updated advisory is a follow-up to the original advisory titled ICSA-14-247-01A Sensys Networks traffic sensor vulnerabilities that was published September 04, 2014, on the NCCIC/ICS-CERT web site. Researcher Cesar Cerrudo of IOActive has identified vulnerabilities in the Sensys...

Microsoft Outlook App for Android Devices Stores Emails Unencrypted on File System

If you have an account with Microsoft's popular free email service Outlook.com, and using Outlook app for Android, then there is a bad news for you. Microsoft's Android app for Outlook.com, provides users to access their Outlook emails on their Android devices, fails to provide security and...

Skype leaves Sensitive User Data Unencrypted Locally On Computers

An application should always encrypt users' sensitive data, either it is local or stored on company servers, but still many popular services failed to provide fully secured solutions to their users. Cristian Dinu DrOptix and Dragoş Gaftoneanu, Romanian programmers at Hackyard Security Group, a...

Viber's Poor Data Security Practices Threaten Users' Privacy

Last week we reported a critical vulnerability in the world's most popular messaging application WhatsApp, that could expose users’ GPS location data to hackers and was discovered by the researchers at UNH Cyber Forensics Research & Education Group. Same Group of researchers reported new set of...

Localize: User credentials are sent in clear text

Vulnerability description User credentials are transmitted over an unencrypted channel. This information should always be transferred via an encrypted channel HTTPS to avoid being intercepted by malicious users. This vulnerability affects /pages/signup. Discovered by: MANUALLY Attack details Form...

WhatsApp Flaw leaves User Location Vulnerable to Hackers and Spy Agencies

If you are using WhatsApp to chit-chat with your friends or relatives, then you should be careful about sharing your location with them using WhatsApp ‘Location Share’ feature. No doubt, WhatsApp communication between your phone and company’s server is now encrypted with SSL, which means whatever...

mail/trojita -- may leak mail contents (not user credentials) over unencrypted connection

Jan Kundrát reports: An SSL stripping vulnerability was discovered in Trojitá, a fast Qt IMAP e-mail client. User's credentials are never leaked, but if a user tries to send an e-mail, the automatic saving into the "sent" or "draft" folders could happen over a plaintext connection even if the...

DEBIAN-CVE-2013-1853

Almanah Diary 0.9.0 and 0.10.0 does not encrypt the database when closed, which allows local users to obtain sensitive information by reading the database...

CVE-2013-1853

Almanah Diary 0.9.0 and 0.10.0 does not encrypt the database when closed, which allows local users to obtain sensitive information by reading the database...

Safari Stores Previous Browsing Session Data Unencrypted

Users of Apple’s Safari browser are at risk for information loss because of a feature common to most browsers that restores previous sessions. The problem with Safari is that it stores session information including authentication credentials used in previous HTTPS sessions in a plaintext XML file...

[SECURITY] Fedora 19 Update: krb5-1.11.3-13.fc19

Kerberos V5 is a trusted-third-party network authentication system, which can improve your network's security by eliminating the insecure practice of sending passwords over the network in unencrypted form...