CVE-2018-19864

NUUO NVRmini2 Network Video Recorder firmware through 3.9.1 allows remote attackers to execute arbitrary code or cause a denial of service buffer overflow, resulting in ability to read camera feeds or reconfigure the device...

December 5, 2018—KB4469342 (OS Build 17763.168)

None None...

Android Security Bulletin—December 2018Stay organized with collectionsSave and categorize content based on your preferences.

The Android Security Bulletin contains details of security vulnerabilities affecting Android devices. Security patch levels of 2018-12-05 or later address all of these issues. To learn how to check a device's security patch level, see Check and update your Android version. Android partners are...

The 25th anniversary of the webcam: What did it bring us?

How did the webcam progress from a simple convenience to a worldwide security concern in 25 years? November 2018 can be marked as the 25th anniversary of the webcam. This is a bit of an arbitrary choice, but if we consider a webcam that was installed at the University of Cambridge to keep an eye ...

TOOL UPDATE: Cameradar v2.1.0

PenTestIT RSS Feed My initial post covering this open source Real Time Streaming Protocol RTSP surveillance camera access multi-tool was about an older version - Cameradar v2.0.0. A lot has happened since then and an update – Cameradar v2.1.0 was made available by the author. This version comes...

Session fixation

SMMU secure camera logic allows secure camera controllers to access HLOS memory during session in Snapdragon Automobile, Snapdragon Mobile and Snapdragon Wear in versions MDM9206, MDM9607, MDM9650, MSM8996AU, SD 210/SD 212/SD 205, SD 425, SD 430, SD 450, SD 625, SD 820, SD 820A, SD 835, SD 845, S...

CVE-2018-11994

SMMU secure camera logic allows secure camera controllers to access HLOS memory during session in Snapdragon Automobile, Snapdragon Mobile and Snapdragon Wear in versions MDM9206, MDM9607, MDM9650, MSM8996AU, SD 210/SD 212/SD 205, SD 425, SD 430, SD 450, SD 625, SD 820, SD 820A, SD 835, SD 845, S...

CVE-2018-11994

SMMU secure camera logic allows secure camera controllers to access HLOS memory during session in Snapdragon Automobile, Snapdragon Mobile and Snapdragon Wear in versions MDM9206, MDM9607, MDM9650, MSM8996AU, SD 210/SD 212/SD 205, SD 425, SD 430, SD 450, SD 625, SD 820, SD 820A, SD 835, SD 845, S...

CVE-2018-11994

CVE-2018-11994 affects Qualcomm Snapdragon platforms where SMMU secure camera logic permits secure camera controllers to access HLOS memory during a session. Affected devices include Snapdragon Automobile, Snapdragon Mobile and Snapdragon Wear variants across MDM9206, MDM9607, MDM9650, MSM8996AU,...

Yi Technology Home Camera CRCDec Denial Of Service (CVE-2018-3935)

A denial of service vulnerability exists in the Yi Home Camera. Successful exploitation of this vulnerability could allow a remote attacker to allocate unlimited memory, resulting in denial of service...

dcraw floating point exception vulnerability (CNVD-2019-00790)

dcraw is a U.S. software developer David J. Coffin developed a set of open source for the camera to shoot the RAW film into PPM or TIFF format picture tool . A floating-point exception vulnerability exists in parsetiffifd in dcraw 9.28 and earlier versions, which can be exploited to cause an...

Advice on buying ‘smart’ gadgets for Christmas

Christmas isn’t far off, and many of you will be in full present buying mode. In the world of smart-this and connected-that there is more at stake than ever before, and we’re not talking about whether batteries are included or not. As we’ve been testing the security of smart products for over 5...

Yi Technology Home Camera 27US Denial Of Service (CVE-2018-3928)

A denial of service vulnerability exists in the firmware update functionality of Yi Home Camera. Successful exploitation of this vulnerability could allow a remote attacker to execute arbitrary code on the affected system, creating a denial of service condition...

Foscam OptiCam i5 Design Vulnerability

Foscam OptiCam i5 is an IP camera from Foscam China. A security vulnerability exists in Foscam Opticam i5 devices with System Firmware version 1.5.2.11 and Application Firmware version 2.21.1.128. An attacker could exploit the vulnerability to take control of the device...

CVE-2018-19071

An issue was discovered on Foscam C2 devices with System Firmware 1.11.1.8 and Application Firmware 2.72.1.32, and Opticam i5 devices with System Firmware 1.5.2.11 and Application Firmware 2.21.1.128. /mnt/mtd/boot.sh has 0777 permissions, allowing local users to control the commands executed at...

CVE-2018-19066

An issue was discovered on Foscam C2 devices with System Firmware 1.11.1.8 and Application Firmware 2.72.1.32, and Opticam i5 devices with System Firmware 1.5.2.11 and Application Firmware 2.21.1.128. The exported device configuration is encrypted with the hardcoded Pxift password in some cases...

Yi Technology Home Camera cloudAPI SSID Code Execution (CVE-2018-3910)

A remote code execution vulnerability exists in Yi Home Camera. Successful exploitation of this vulnerability could allow a remote attacker to execute arbitrary code on the affected system...

Yi Home Camera Code Execution Vulnerability (CNVD-2018-22808)

Yi Home Camera is an IoT home camera sold worldwide. A code execution vulnerability exists in the firmware update feature of the Yi Home Camera 27US 1.8.7.0D. An attacker can exploit the vulnerability by inserting an SD card and exploiting the vulnerability via a specially crafted file to cause a...

Yi Home Camera Code Execution Vulnerability (CNVD-2018-22812)

Yi Home Camera is an IoT home camera sold worldwide. A code execution vulnerability exists in the QR code scanning feature of Yi Home Camera 27US 1.8.7.0D. The vulnerability can be exploited by an attacker to cause a buffer overflow via a specially crafted QR code, which can be used for code...

Yi Technology Home Camera Time Sync Code Execution (CVE-2018-3892)

A remote code execution exists in the time syncing functionality of Yi Home Camera. Successful exploitation of this vulnerability could allow a remote attacker to execute arbitrary code on the affected system...