Code injection

On TCL Alcatel Cingular Flip 2 B9HUAH1 devices, there is an undocumented web API that allows unprivileged JavaScript, including JavaScript running within the KaiOS browser, to view and edit the device's firmware over-the-air update settings. This web API is normally used by the system application...

CVE-2019-16243

CVE-2019-16243 affects TCL Alcatel Cingular Flip 2 B9HUAH1. An undocumented web API accessible from unprivileged JavaScript (including KaiOS browser) lets an attacker view and edit the device’s firmware OTA update settings; this API is normally used by OmaService.js by the system app. The root ca...

Apple Security Update: iOS 13.2.3 and iPadOS 13.2.3

Apple recommends to install security update iOS 13.2.3 and iPadOS 13.2.3 on devices iPhone 6s and later, iPad Air 2 and later, iPad mini 4 and later, and iPod touch 7th generation...

Schiphol hijack false alarm. An insiders view of what happened

I had the misfortune of being at Schiphol last night as this unfolded: All ended well, delayed by about an hour. Had the incident been real, it could have been much worse. Here’s what the pilot had to say about it thanks to @asantosb: Our flight was at D16, the incident flight was directly the...

Apple Security Update: iOS 13.2.2 and iPadOS 13.2.2

Apple recommends to install security update iOS 13.2.2 and iPadOS 13.2.2 on devices iPhone 6s and later, iPad Air 2 and later, iPad mini 4 and later, and iPod touch 7th generation...

Krakow's Commitment to a Sustainable Office and Community

Written by Courtney Hadden, Corporate Sustainability, and Karolina Galeziowska, Krakow Sustainability Team Lead As an essential part of the Internet for over 20 years, Akamai believes it is our responsibility to help create digital experiences that are fast, intelligent and secure, while caring f...

The Air Force Ditches Its Nuclear Command Floppy Disks

A Samsung Galaxy 10 fingerprint goof, a Tor impostor, and more of the week's top security news...

Apple Security Update: macOS Catalina 10.15 Supplemental Update

Apple recommends to install security update macOS Catalina 10.15 Supplemental Update on devices MacBook Early 2015 and later, MacBook Air Mid 2012 and later, MacBook Pro Mid 2012 and later, Mac mini Late 2012 and later, iMac Late 2012 and later, iMac Pro all models, and Mac Pro Late 2013 and late...

Apple Security Update: macOS Catalina 10.15 Supplemental Update

Apple recommends to install security update macOS Catalina 10.15 Supplemental Update on devices MacBook Early 2015 and later, MacBook Air Mid 2012 and later, MacBook Pro Mid 2012 and later, Mac mini Late 2012 and later, iMac Late 2012 and later, iMac Pro all models, and Mac Pro Late 2013 and late...

Apple Security Update: iOS 13.1.3 and iPadOS 13.1.3

Apple recommends to install security update iOS 13.1.3 and iPadOS 13.1.3 on devices iPhone 6s and later, iPad Air 2 and later, iPad mini 4 and later, and iPod touch 7th generation...

SQL Injection Vulnerability in Air Quality System Publishing System

Zhuhai Goling Information Technology Co., Ltd. is a high-tech enterprise engaged in research and development of core technology of information network, production of professional equipment and network application service. An SQL injection vulnerability exists in the Air Quality System Publishing...

Apple macOS Multiple Security Vulnerabilities

Description Apple macOS is prone to multiple security vulnerabilities. Attackers can exploit these issues to execute arbitrary code, bypass security restrictions or obtain sensitive information. Technologies Affected Apple IMac Apple Mac Pro Apple MacBook Apple MacMini Apple Macbook Air Apple...

Apple Security Update: iOS 13.1.2 and iPadOS 13.1.2

Apple recommends to install security update iOS 13.1.2 and iPadOS 13.1.2 on devices iPhone 6s and later, iPad Air 2 and later, iPad mini 4 and later, and iPod touch 7th generation...

Apple Security Update: iOS 12.4.2

Apple recommends to install security update iOS 12.4.2 on devices iPhone 5s, iPhone 6, iPhone 6 Plus, iPad Air, iPad mini 2, iPad mini 3, and iPad touch 6th generation...

The Air Force Will Let Hackers Try to Hijack an Orbiting Satellite

At the Defcon hacking conference next year, the Air Force will bring a satellite for fun and glory...

Friday Squid Blogging: Robot Squid Propulsion

Interesting research: The squid robot is powered primarily by compressed air, which it stores in a cylinder in its nose do squids have noses?. The fins and arms are controlled by pneumatic actuators. When the robot wants to move through the water, it opens a value to release a modest amount of...

New Flaws in Qualcomm Chips Expose Millions of Android Devices to Hacking

A series of critical vulnerabilities have been discovered in Qualcomm chipsets that could allow hackers to compromise Android devices remotely just by sending malicious packets over-the-air with no user interaction. Discovered by security researchers from Tencent's Blade team, the vulnerabilities...

libxslt CVE-2019-13118 Stack Buffer Overflow Vulnerability

Description libxslt is prone to a stack-based buffer-overflow vulnerability. An attacker can exploit this issue to obtain sensitive information that may aid in further attacks. libxslt 1.1.33 is vulnerable; other versions may also be affected. Technologies Affected Apple TV Apple Watch Apple iOS ...

CVE-2017-10721

Recently it was discovered as a part of the research on IoT devices in the most recent firmware for Shekar Endoscope that the device has Telnet functionality enabled by default. This device acts as an Endoscope camera that allows its users to use it in various industrial systems and settings, car...

CVE-2017-10723

Recently it was discovered as a part of the research on IoT devices in the most recent firmware for Shekar Endoscope that an attacker connected to the device Wi-Fi SSID can exploit a memory corruption issue and execute remote code on the device. This device acts as an Endoscope camera that allows...