CVE-2021-0997: Insertion of Sensitive Information into Log File

In handleUpdateNetworkState of GnssNetworkConnectivityHandler.java , there is a possible APN disclosure due to log information disclosure. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.Product:...

PT-2021-13402

Name of the Vulnerable Software and Affected Versions Android versions Android-12 Description The issue is related to a possible APN disclosure due to log information disclosure in the handleUpdateNetworkState function of GnssNetworkConnectivityHandler.java. This could lead to local information...

PUB-A-191086488

In handleUpdateNetworkState of GnssNetworkConnectivityHandler.java , there is a possible APN disclosure due to log information disclosure. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation...

From a TCU to Corporate Domain Admin

How we went from a telematics control unit in a vehicle to domain admin on a corporate network We’ve tested numerous telematics control units over recent years and gathered many of our findings in to some good practice guidance here. However, just occasionally we find something that blows our min...

Malicious Package

Overview apn-client is a malicious package. Affected versions of this package were found to be a Malicious Package, as it utilised typosquatting to run Malicious 3rd party scripts. It replaced genuine packages using an and replaced it with - and vice versa Remediation Avoid using apn-client...

Update APN database entry for China Mobile Hong Kong in Windows 8.1 and Windows 8

Update APN database entry for China Mobile Hong Kong in Windows 8.1 and Windows 8 This article describes an update for China Mobile Hong Kong CMHK in Windows 8.1, Windows RT 8.1, Windows 8, and Windows RT. Before you apply this update, notice that this update has a prerequisite. About this update...

Just An SMS Could Let Remote Attackers Access All Your Emails, Experts Warn

Beware! Billion of Android users can easily be tricked into changing their devices' critical network settings with just an SMS-based phishing attack. Whenever you insert a new SIM in your phone and connects to your cellular network for the very first time, your carrier service automatically...

AWS re:Inforce 2019 re:Cap

The inaugural AWS Cloud security conference—AWS re:Inforce—was held in Boston this week. Well over 8,000 attendees descended on the Boston Convention and Exhibition Center for two days jammed packed with security education and cloud content. This was a very interesting conference because the...

AWS Security Hub and Deep Security

One of the biggest challenges in maintaining your security posture is visibility. You have security controls deployed throughout the stack, and each fo these tools is generating its own set of data points and has its own view of your deployment. Managing the multitude of alerts and events from...

Default credentials

goform/getProfileList in Orange AirBox Y858FL01.1604 allows attackers to extract APN data name, number, username, and password via the rand parameter...

CVE-2018-18375

goform/getProfileList in Orange AirBox Y858FL01.1604 allows attackers to extract APN data name, number, username, and password via the rand parameter...

CVE-2018-18375

goform/getProfileList in Orange AirBox Y858FL01.1604 allows attackers to extract APN data name, number, username, and password via the rand parameter...

PT-2018-14422

Name of the Vulnerable Software and Affected Versions Orange AirBox Y858 FL 01.16 04 Description The issue allows attackers to extract APN data, including name, number, username, and password, via the rand parameter in the "goform/getProfileList" API endpoint. Recommendations For Orange AirBox Y8...

CVE-2018-18375: Use of Insufficiently Random Values

goform/getProfileList in Orange AirBox Y858FL01.1604 allows attackers to extract APN data name, number, username, and password via the rand parameter...

Soldering for Reverse Engineering. Swapping out eSIMs with “normal” SIMs

Sometimes, the mobile devices we work on only have cellular data connections. In those instances, we’re usually pretty interested in trying things like this to get credentials for the APN so we can start snooping around on that. We’re also really interested in monitoring what kind of traffic is...

Trend Micro Champions the AWS Marketplace Channel Opportunity Registration Program

Last year, Trend Micro launched our popular Deep Security as a Service offering on the AWS Marketplace, combining industry-leading threat protection for cloud workloads, effortless deployment, and the added bonus of a unified Amazon Web Services AWS bill. This has been a successful model for...

Malware That Can’t Clean Its Tracks: CCleaner and Ongoing Supply-Chain Attacks

A new malware compromise identified this week was using malware officially signed and provided by its software manufacturer for public download by millions of people. It’s a move that started the week for many organizations in a state of worry. This week, the Cisco Talos research team disclosed...

Cross site scripting

On the Axesstel MU553S MU55XS-V1.14, there is a Stored Cross Site Scripting vulnerability in the APN parameter under the "Basic Settings" page...

CVE-2017-13724

On the Axesstel MU553S MU55XS-V1.14, there is a Stored Cross Site Scripting vulnerability in the APN parameter under the "Basic Settings" page...

CVE-2017-13724

CVE-2017-13724 describes a stored Cross-Site Scripting vulnerability in the APN parameter on the Axesstel MU553S MU55XS devices running firmware v1.14, on the Basic Settings page. The affected component is the APN field handling in that page; the root cause is a stored XSS flaw that can persist u...