CVE-2017-16905

The DuoLingo TinyCards application before 1.0 for Android has one use of unencrypted HTTP, which allows remote attackers to spoof content, and consequently achieve remote code execution, via a man-in-the-middle attack...

PT-2017-14535 · Abb · Ellipse

Name of the Vulnerable Software and Affected Versions: ABB Ellipse versions 8.3 through 8.9 Description: An issue with unprotected transport of credentials was found in the authentication of Ellipse to LDAP/AD using the LDAP protocol. This allows an attacker to exploit the issue by sniffing local...

Trend Micro ScanMail for Exchange Security Restriction Bypass Vulnerability

Trend Micro ScanMail for Exchange is a mail firewall solution developed and maintained by Trend Micro that is designed to protect Exchange mail servers from viruses, spyware and spam threats. A security vulnerability exists in Trend Micro ScanMail for Exchange version 12.0, which arises from the...

Huawei Changsha 5S Information Disclosure Vulnerability

The Huawei Changshare 5S is a smartphone from the Chinese company Huawei Huawei. An information disclosure vulnerability exists in Huawei 畅享5S. Attackers have successfully exploited the vulnerability to cause information leakage by tricking users into installing a carefully constructed applicatio...

CVE-2017-14090

A vulnerability in Trend Micro ScanMail for Exchange 12.0 exists in which some communications to the update servers are not encrypted...

Design/Logic Flaw

A vulnerability in Trend Micro ScanMail for Exchange 12.0 exists in which some communications to the update servers are not encrypted...

CVE-2017-14090

A vulnerability in Trend Micro ScanMail for Exchange 12.0 exists in which some communications to the update servers are not encrypted...

FreeBSD -- OpenSSL multiple vulnerabilities

Problem Description: Invoking SSLread/SSLwrite while in an error state causes data to be passed without being decrypted/encrypted directly from the SSL/TLS record layer. In order to exploit this issue an application bug would have to be present that resulted in a call to SSLread/SSLwrite being...

Vaultek Gun Safe VT20i Information Disclosure Vulnerability (CNVD-2018-00316)

The Vaultek Gun Safe VT20i aka BlueSteal is a fingerprint-enabled gun safe product. A security vulnerability exists in the Vaultek Gun Safe VT20i that stems from the program's failure to encrypt the session between the Android application and the safe. An attacker could exploit the vulnerability ...

CVE-2017-17436

An issue was discovered in the software on Vaultek Gun Safe VT20i products. There is no encryption of the session between the Android application and the safe. The website and marketing materials advertise that this communication channel is encrypted with "Highest Level Bluetooth Encryption" and...

CVE-2017-14953

HikVision Wi-Fi IP cameras, when used in a wired configuration, allow physically proximate attackers to trigger association with an arbitrary access point by leveraging a default SSID with no WiFi encryption or authentication. NOTE: Vendor states that this is not a vulnerability, but more an...

Hikvision Wi-Fi IP Cameras Default SSID Unencrypted Vulnerability

HikVision Wi-Fi IP cameras is a network camera product from Hikvision China. A security vulnerability exists in HikVision Wi-Fi IP cameras. An attacker in close physical proximity could exploit the vulnerability to associate an arbitrary access point...

HikVision Wi-Fi IP Camera Wireless Access Point State

Hikvision Wi-Fi IP Cameras associate to a default unencrypted rogue SSIDs in a wired configuration Full disclosure Nov 27, 2017 Synopsis: --- HikVision Wi-Fi IP cameras come with a default SSID "davinci", with a setting of no WiFi encryption or authentication. Depending on the firmware version,...

CVE-2017-8168

FusionSphere OpenStack with software V100R006C00SPC102NFV and V100R006C10 have an information leak vulnerability. Due to an incorrect configuration item, the information transmitted by a transmission channel is not encrypted. An attacker accessing the internal network may obtain sensitive...

[SECURITY] Fedora 27 Update: krb5-1.15.2-4.fc27

Kerberos V5 is a trusted-third-party network authentication system, which can improve your network's security by eliminating the insecure practice of sending passwords over the network in unencrypted form...

Philips Hue Bridge BSB002 public API security bypass vulnerability

Philips Hue Bridge BSB002 is a smart home lighting system from Philips in the Netherlands. public API is one of the public interfaces. A security vulnerability exists in the public API in the Philips Hue Bridge BSB002 using firmware version 1707040932, where the vulnerable program fails to encryp...

Data Pours from Cloud—And ‘The Enemy is Us’

Accenture, Verizon, Dow Jones and Deep Root Analytics are just the tip of the iceberg when it comes to the millions of private records and sensitive enterprise data exposed on cloud backends this year. And the problem is getting worse not better. “The enemy is us,” said Chris Vickery, director of...

Apple macOS High Sierra APFS is vulnerable

Apple macOS High Sierra is a specialized operating system developed by Apple for Mac computers.APFS is one of the file system components for Apple devices. A security vulnerability exists in the APFS component of Apple macOS High Sierra versions prior to 10.13.1. The vulnerability can be exploite...

CVE-2017-15581

In the "Diary with lock" aka WriteDiary application 4.72 for Android, neither HTTPS nor other encryption is used for transmitting data, despite the documentation that the product is intended for "a personal journal of ... secrets and feelings," which allows remote attackers to obtain sensitive...

Huawei FusionSphere Openstack Information Disclosure Vulnerability (CNVD-2017-33879)

Huawei FusionSphere and FusionSphere OpenStack FSO are both Huawei products. The former is a cloud operating system product developed based on the OpenStack framework, and the latter is FusionSphere's cloud platform software in ICT scenarios. Huawei FusionSphere Openstack suffers from an...