PT-2017-1072

Name of the Vulnerable Software and Affected Versions Android versions 6.0 through 7.1 Description A denial of service issue in core networking could allow a remote attacker to use specially crafted network packets to cause a device hang or reboot. The issue is related to insufficient input...

Clever Gmail Hack Let Attackers Take Over Accounts

Google patched a hole in its Gmail verification system last week that allowed an attacker to hijack a targeted Google Gmail account. The discovery was made by Ahmed Mehtab, a security researcher and founder of Security Fuse. The hack is simple to execute and requires less than dozen steps to pull...

[ASA-201609-25] gnutls: certificate verification bypass

Arch Linux Security Advisory ASA-201609-25 ========================================== Severity: Medium Date : 2016-09-26 CVE-ID : CVE-2016-7444 Package : gnutls Type : certificate verification bypass Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package gnutls...

[ASA-201609-26] lib32-gnutls: certificate verification bypass

Arch Linux Security Advisory ASA-201609-26 ========================================== Severity: Medium Date : 2016-09-26 CVE-ID : CVE-2016-7444 Package : lib32-gnutls Type : certificate verification bypass Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package...

[ASA-201609-22] firefox: multiple issues

Arch Linux Security Advisory ASA-201609-22 ========================================== Severity: Critical Date : 2016-09-22 CVE-ID : CVE-2016-5256 CVE-2016-5257 CVE-2016-5270 CVE-2016-5271 CVE-2016-5272 CVE-2016-5273 CVE-2016-5274 CVE-2016-5275 CVE-2016-5276 CVE-2016-5277 CVE-2016-5278 CVE-2016-52...

OpenSSH MAC Verification Security Bypass Vulnerability

OpenSSH is a set of connection tools maintained by the OpenBSD Project Group for secure access to remote computers. A security bypass vulnerability exists in OpenSSH MAC Verification, which allows attackers to bypass security restrictions and perform unauthorized operations...

The vulnerability of the Firefox browser, which allows a remote attacker to bypass certificate verification

The vulnerability of the Firefox browser in handling alternative HTTP services allows a malicious actor to bypass the X.509 certificate verification for SSL servers by modifying the server address in the uri-host header of the HTTP/2 response...

IBM Bluemix Liberty for Java Security Bypass Vulnerability

IBM Bluemix Liberty for Java is a set of dynamic application server runtime environments based on IBM Bluemix Platform as a Service, PaaS products from IBM in the United States. A security bypass vulnerability exists in Liberty for Java in versions prior to IBM Bluemix 2.7-20160321-1358, which ca...

Intel Driver Update Utility Information Disclosure Vulnerability

Intel Driver Update Utility is a tool that analyzes the drivers of your computer system. Intel Driver Update Utility version 2.2.0.5 has a man-in-the-middle attack vulnerability in its implementation, which can be exploited to bypass the domain authentication method VerifyDownloadURL if an attack...

Kingsoft Mobile Assistant Service Privilege Elevation Vulnerability

Kingsoft Mobile Assistant is the official cell phone resources access platform launched by Kingsoft, Kingsoft Mobile Assistant, formerly known as Kingsoft Mobile Control, can provide cell phone users with a huge number of applications to download, wonderful games, useful software, beautiful...

Verification Bypass

Overview Versions 4.2.1 and earlier of jsonwebtoken are affected by a verification bypass vulnerability. This is a result of weak validation of the JWT algorithm type, occuring when an attacker is allowed to arbitrarily specify the JWT algorithm. Recommendation Update to version 4.2.2 or later...

The vulnerability of the iOS operating system, which allows a hacker to bypass the signature verification mechanism for security checks

The vulnerability of the dyld component in the iOS operating system is related to security configuration errors. Exploiting this vulnerability allows a malicious actor to bypass the code signing verification mechanism by using a specially crafted application that embeds the signature within the...

USN-2705-1 python-keystoneclient, python-keystonemiddleware vulnerabilities

Qin Zhao discovered Keystone disabled certification verification when the "insecure" option is set in a paste configuration paste.ini file regardless of the value, which allows remote attackers to conduct machine-in-the-middle attacks via a crafted certificate. CVE-2014-7144 Brant Knudson...

PT-2015-6012

Name of the Vulnerable Software and Affected Versions NAMSHI | JOSE versions 5.0.0 and earlier Description The issue allows remote attackers to bypass signature verification via crafted tokens in a JSON Web Tokens JWT header. Recommendations For versions 5.0.0 and earlier, at the moment, there is...

CVE-2015-2964: Improper Input Validation

NAMSHI | JOSE 5.0.0 and earlier allows remote attackers to bypass signature verification via crafted tokens in a JSON Web Tokens JWT header...

CXF: SSL hostname verification bypass, incomplete CVE-2012-6153 fix

It was found that the fix for CVE-2012-6153 was incomplete: the code added to check that the server hostname matches the domain name in a subject's Common Name CN field in X.509 certificates was flawed. A man-in-the-middle attacker could use this flaw to spoof an SSL server using a specially...

CVE-2015-2951

JWT.php in F21 JWT before 2.0 allows remote attackers to bypass signature verification via crafted tokens...

CVE-2015-2951: Improper Input Validation

JWT.php in F21 JWT before 2.0 allows remote attackers to bypass signature verification via crafted tokens...

PT-2015-5999

Name of the Vulnerable Software and Affected Versions F21 JWT versions prior to 2.0 Description The issue allows remote attackers to bypass signature verification via crafted tokens. Recommendations For versions prior to 2.0, update to version 2.0 or later to resolve the issue...

CVE-2015-3903: Undefined Security Weakness

libraries/Config.class.php in phpMyAdmin 4.0.x before 4.0.10.10, 4.2.x before 4.2.13.3, 4.3.x before 4.3.13.1, and 4.4.x before 4.4.6.1 disables X.509 certificate verification for GitHub API calls over SSL, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information...