Huawei EMUI Heap Overflow Vulnerability

Huawei Emui is an Android-based mobile operating system developed by Huawei of China. Huawei EMUI is vulnerable to a heap overflow vulnerability, which can be exploited by remote attackers to submit special ad hoc requests that can perform denial-of-service attacks or execute arbitrary code in...

Former DOD Head: The US Needs a New Plan to Beat China on AI

In an interview with WIRED, former secretary of defense Ash Carter discussed how to build morality into AI—and make sure other countries do too...

Friday Squid Blogging: China Launches Six New Squid Jigging Vessels

From Pingtan Marine Enterprise: The 6 large-scale squid jigging vessels are normally operating vessels that returned to China earlier this year from the waters of Southwest Atlantic Ocean for maintenance and repair. These vessels left the port of Mawei on December 17, 2020 and are sailing to the...

China Bidding Public Service Platform Limited Bidding and Tendering Public Service Platform has Arbitrary File Download Vulnerability

China Bidding Public Service Platform Co., Ltd. is a public service enterprise approved by the State Council and set up under the guidance and promotion of the National Development and Reform Commission, and jointly invested by eight enterprises led by China Bidding and Tendering Association. The...

RCE vulnerability in FiberHome routers

Ltd., or FiberHome, is a listed company headquartered in Wuhan, China. FiberHome is a listed company in the telecommunications equipment manufacturing industry headquartered in Wuhan, China. A RCE vulnerability exists in FiberHome routers, which can be exploited by an attacker to execute arbitrar...

K7 Computing K7AntiVirus Premium Buffer Overflow Vulnerability (CNVD-2021-02816)

K7AntiVirus Premium is a security suite from K7 Computing that provides reliable protection against online threats and fraudulent activities, thus protecting you from viruses and cyber attacks. A buffer overflow vulnerability exists in K7 Computing K7AntiVirus Premium 15.01.00.53. No detailed...

Foxit Reader and PhantomPDF Competitive Conditions Vulnerability (CNVD-2021-04398)

Foxit Reader and Foxit PhantomPDF are both Chinese Foxit Foxit company a PDF document reader. A security vulnerability exists in Foxit Reader and PhantomPDF. An attacker could exploit the vulnerability to cause a stack buffer overflow or out-of-bounds read...

Google Chrome memory misreference vulnerability (CNVD-2021-04420)

Google Chrome is a web browser from Google, an American company. A memory misreference vulnerability exists in "Drag and Drop" in Google Chrome prior to version 87.0.4280.141. A remote attacker can exploit the vulnerability to perform sandbox escaping via specially crafted HTML pages...

Delta Electronics CNCSoft-B 安全漏洞

Delta Electronics CNCSoft-B is a CNC machine simulation system software from Delta Electronics, China. A security vulnerability exists in Delta Electronics CNCSoft-B, which can be exploited by an attacker to execute arbitrary code...

Denial of Service Vulnerability in GM220-S

China Mobile Communications Group is subordinate to China Mobile Communications Corporation. Its business scope includes: operating GSM digital mobile communications business; IP telephony business; Internet access service business, Internet backbone network data transmission business, and so on....

SQL Injection Vulnerability in China Coal Pilot Navigation and Positioning Monitoring Platform

The business scope of China Coal Aerospace Remote Sensing Group Co., Ltd. includes: geographic remote sensing information services; satellite remote sensing application system integration; satellite remote sensing data processing; satellite technology integrated application system integration, et...

China Coal Pilot Navigation and Positioning Monitoring Platform Has Overstepping Loopholes

The business scope of China Coal Aerospace Remote Sensing Group Co., Ltd. includes: geographic remote sensing information services; satellite remote sensing application system integration; satellite remote sensing data processing; satellite technology integrated application system integration, et...

A week in security (December 28 – January 3)

First off we would like to wish all our readers a happy and secure 2021! Last week on Malwarebytes Labs we presented an overview of developments in the SearchDimension hijackers, we looked at the most enticing cyberattacks of 2020, and we also looked back at the strangest cybersecurity events of...

HGiga MailSherlock SQL Injection Vulnerability (CNVD-2021-05402)

HGiga MailSherlock is an email archiving and auditing system that provides a complete email security solution. HGiga MailSherlock suffers from a SQL injection vulnerability. An attacker can exploit this vulnerability to inject and execute SQL commands in URL parameters...

The strangest cybersecurity events of 2020: a look back

This year is finally coming to an end, and it only took us about eight consecutive months of March to get here. There is a ton to talk about, and that’s without even discussing the literal global pandemic. You see, 2020s news stories were the pressure-cooker product of mania, chaos, and the...

Weak password vulnerability in China Telecom's Skywatch Store Camera

Skywing Watch Shop is a security business integrating camera, video recording, real-time monitoring, PTZ control, alarm and storage launched by CLP Hongxin Information Technology Co., Ltd. for companies, stores and other places that need to carry out visualization management, and through the clie...

A week in security (December 21- December 27)

Last week on Malwarebytes Labs we warned our readers about not so festive social media scams, how Emotet returned just in time for Christmas, we tried out some free online games your kids are playing and here’s what happened, and our VideoBytes episode talked about what penetration testing tools...

Weak Password Vulnerability in Jabil's 2nd Generation Firewall Management System

Jabil's second-generation firewall management system is a well-known firewall brand in China, and the related products include VPN, IDS, IPS, WAF, Situational Awareness, and Bastion Machine. Jabil's second-generation firewall management system has a weak password vulnerability, which can be...

How China Uses Stolen US Personnel Data

Interesting analysis of Chinas efforts to identify US spies: By about 2010, two former CIA officials recalled, the Chinese security services had instituted a sophisticated travel intelligence program, developing databases that tracked flights and passenger lists for espionage purposes. "We looked...

Huawei Imanager Neteco 6000 Information Disclosure Vulnerability

Huawei Imanager Neteco 6000 is a platform from China's Huawei that provides a management approach for data center infrastructure. The platform can implement unified management for medium-sized and large data centers and multiple data centers, and improve resource utilization in data centers by...