CVE-2017-7920

An Improper Authentication issue was discovered in ABB VSN300 WiFi Logger Card versions 1.8.15 and prior, and VSN300 WiFi Logger Card for React versions 2.1.3 and prior. By accessing a specific uniform resource locator URL on the web server, a malicious user is able to access internal information...

CVE-2017-7916

A Permissions, Privileges, and Access Controls issue was discovered in ABB VSN300 WiFi Logger Card versions 1.8.15 and prior, and VSN300 WiFi Logger Card for React versions 2.1.3 and prior. The web application does not properly restrict privileges of the Guest account. A malicious user may be abl...

CVE-2017-7920

The CVE-2017-7920 issue affects ABB VSN300 WiFi Logger Card and VSN300 WiFi Logger Card for React (versions 1.8.15 and prior; 2.1.3 and prior, respectively). The root cause is Improper Authentication: a malicious actor can access internal status and connected-device information by requesting a sp...

CVE-2017-7920

An Improper Authentication issue was discovered in ABB VSN300 WiFi Logger Card versions 1.8.15 and prior, and VSN300 WiFi Logger Card for React versions 2.1.3 and prior. By accessing a specific uniform resource locator URL on the web server, a malicious user is able to access internal information...

CVE-2017-7916

A Permissions, Privileges, and Access Controls issue was discovered in ABB VSN300 WiFi Logger Card versions 1.8.15 and prior, and VSN300 WiFi Logger Card for React versions 2.1.3 and prior. The web application does not properly restrict privileges of the Guest account. A malicious user may be abl...

CVE-2017-7916

ABB VSN300 WiFi Logger Card and VSN300 WiFi Logger Card for React (versions 1.8.15 and prior; 2.1.3 and prior) are affected by a Privileges/Access Controls vulnerability where the Guest account isn’t properly restricted, potentially allowing access to restricted configuration information. The ICS...

CVE-2017-9244

Cross-site scripting XSS vulnerability in the Trello app before 4.0.8 for iOS might allow remote attackers to inject arbitrary web script or HTML by uploading and attaching a crafted photo to a Card...

CVE-2017-9244

Cross-site scripting XSS vulnerability in the Trello app before 4.0.8 for iOS might allow remote attackers to inject arbitrary web script or HTML by uploading and attaching a crafted photo to a Card...

IC3 Releases Alert on Gift Card Scams

The Internet Crime Complaint Center IC3 has released an alert warning consumers of music gift card scams. This type of scam targets victims, gains their confidence, and tricks them into providing gift card information. To stay safer online, review the IC3 alert on Online Scammers Require Payment...

Qemu: libcacard: host memory leakage while creating new APDU

Memory leak in the vcardapdunew function in card7816.c in libcacard before 2.5.3 allows local guest OS users to cause a denial of service host memory consumption via vectors related to allocating a new APDU object...

Qemu: net: rtl8139: infinite loop while transmit in C+ mode

The rtl8139cplustransmit function in hw/net/rtl8139.c in QEMU aka Quick Emulator allows local guest OS administrators to cause a denial of service infinite loop and CPU consumption by leveraging failure to limit the ring descriptor count...

Qemu: usb: integer overflow in emulated_apdu_from_guest

An integer overflow flaw was found in Quick Emulator QEMU in the CCID Card device support. The flaw could occur while passing messages via command/response packets to and from the host. A privileged user inside a guest could use this flaw to crash the QEMU process...

Qemu: usb: integer overflow in emulated_apdu_from_guest

An integer overflow flaw was found in Quick Emulator QEMU in the CCID Card device support. The flaw could occur while passing messages via command/response packets to and from the host. A privileged user inside a guest could use this flaw to crash the QEMU process...

Moderate: Red Hat Security Advisory: qemu-kvm security, bug fix, and enhancement update

An update for qemu-kvm is now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from t...

Guizhou Provincial People's Hospital's Android App Has Override Access Vulnerability

Guizhou Provincial People's Hospital APP is a medical app for local people in Guizhou, making it easier and faster for people to see a doctor. Download Guizhou Provincial People's Hospital APP to utilize ID cards, visiting cards and other identification to get all the information about the visit,...

Gas Pump Skimmer Sends Card Data Via Text

Skimming devices that crooks install inside fuel station gas pumps frequently rely on an embedded Bluetooth component allowing thieves to collect stolen credit card data from the pumps wirelessly with any mobile device. The downside of this approach is that Bluetooth-based skimmers can be detecte...

JVN#16136413: Installers of Sony PaSoRi related software may insecurely load Dynamic Link Libraries

PaSoRi provided by Sony Corporation is contactless IC card reader/writer. Installers of PaSoRi driver and other related software for Windows contain an issue with the DLL search path, which may lead to insecurely loading Dynamic Link Libraries CWE-427. Impact Arbitrary code may be executed with t...

ABB VSN300 WiFi Logger Card and VSN300 WiFi Logger Card for React Privilege Access Control Vulnerability

The ABB VSN300 WiFi Logger Card and the VSN300 WiFi Logger Card for React are both wireless data logger card products from Asea Brown Boveri ABB, Switzerland. A security vulnerability exists in the ABB VSN300 WiFi Logger Card and VSN300 WiFi Logger Card for React, which stems from the program...

GPS Logger - Exported components, External URLs, SD-card access vulnerabilities

HackApp vulnerability scanner discovered that application GPS Logger published at the 'play' market has multiple vulnerabilities...

July 20, 2017 – Morning Cyber Coffee Headlines – “British Open” Edition

Good morning! Sit with Carbon Black this morning over a cup of coffee or tea and browse a few industry headlines to get the day started. We’ve got just enough information below to get you through that first cup…enjoy! July 20, 2017 - Headlines Carbon Black in the News: The dark web goes corporate...