CVE-2020-3620

u'Lack of check of integer overflow while doing a round up operation for data read from shared memory for G-link SMEM transport can lead to corruption and potential information leak' in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer Electronics Connectivity,...

CVE-2020-3619

u'Non-secure memory is touched multiple times during TrustZone\u2019s execution and can lead to privilege escalation or memory corruption' in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice &...

CVE-2020-11117

u'In the lbd service, an external user can issue a specially crafted debug command to overwrite arbitrary files with arbitrary content resulting in remote code execution.' in Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Wired Infrastructure and Networking in IPQ4019, IPQ6018,...

CVE-2020-11118

CVE-2020-11118 is an information-exposure issue tied to processing of IE headers (beacon IE frame) on Qualcomm Snapdragon platforms. The NVD entry lists affected families (Snapdragon Auto, Compute, Consumer Electronics Connectivity, Consumer IOT, Industrial IOT, Mobile, Wearables, etc.) and a lon...

CVE-2019-14119

CVE-2019-14119 describes a TOCTOU race condition in Snapdragon platforms (Auto, Compute, Connectivity, IoT, Mobile, etc.) triggered while processing the SMCInvoke asynchronous message header. The race modifies the message count and leads to memory corruption, affecting a broad set of Qualcomm/Sna...

CVE-2019-13999

CVE-2019-13999 involves a lack of check for integer overflow during round-up and addition, causing memory corruption and potential information leakage on multiple Qualcomm/Snapdragon platforms. The vulnerability affects a wide range of Snapdragon products (Auto, Compute, Connectivity, Consumer El...

CVE-2019-10596

u'Improper access control can lead signed process to guess pid of other processes and access their address space' in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Wired Infrastructure and Networking ...

CVE-2019-10562

u'Improper authentication and signature verification of debug polices in secure boot loader will allow unverified debug policies to be loaded into secure memory and leads to memory corruption' in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon...

CVE-2019-10562

CVE-2019-10562 affects Qualcomm Snapdragon families (including IPQ6018, MSM CPUs) with an improper authentication and signature verification of debug policies in the secure boot loader. The root cause is insecure policy loading into secure memory, leading to memory corruption and potential local ...

CVE-2020-11117: Improper Neutralization of Special Elements used in a Command

u'In the lbd service, an external user can issue a specially crafted debug command to overwrite arbitrary files with arbitrary content resulting in remote code execution.' in Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Wired Infrastructure and Networking in IPQ4019, IPQ6018,...

EulerOS 2.0 SP8 : tigervnc (EulerOS-SA-2020-1885)

According to the versions of the tigervnc packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - TigerVNC version prior to 1.10.1 is vulnerable to stack use-after-return, which occurs due to incorrect usage of stack memory in ZRLEDecoder. ...

Microsoft Zero Trust deployment guide for your applications

Introduction More likely than not, your organization is in the middle of a digital transformation characterized by increased adoption of cloud apps and increased demand for mobility. In the age of remote work, users expect to be able to connect to any resource, on any device, from anywhere in the...

CVE-2019-20150

In TreasuryXpress 19191105, a logged-in user can discover saved credentials, even though the UI hides them. Using functionality within the application and a malicious host, it is possible to force the application to expose saved SSH/SFTP credentials. This can be done by using the application's...

Securing Remote Work: More Connectivity and Visibility

When the pandemic hit, no one knew the impact it was going to have on the world. And while having connectivity and visibility became increasingly important for humanity, it also quickly became central for employees to work from home securely...

CVE-2019-20150: Undefined Security Weakness

In TreasuryXpress 19191105, a logged-in user can discover saved credentials, even though the UI hides them. Using functionality within the application and a malicious host, it is possible to force the application to expose saved SSH/SFTP credentials. This can be done by using the application's...

PT-2020-10351

Name of the Vulnerable Software and Affected Versions TreasuryXpress version 19191105 Description The issue allows a logged-in user to discover saved credentials, which are hidden by the UI. An attacker can exploit this by using the application's editor to change the expected SFTP Host IP to a...

Debian DLA-2318-1 : wpa security update

The following CVEs have been reported against src:wpa. CVE-2019-10064 hostapd before 2.6, in EAP mode, makes calls to the rand and random standard library functions without any preceding srand or srandom call, which results in inappropriate use of deterministic values. This was fixed in conjuncti...

Black Hat 2020: Mercedes-Benz E-Series Rife with 19 Bugs

The Mercedes-Benz E-Class went to market riddled with 19 vulnerabilities, which, among other things, could enable attackers to remotely unlock the car door and start its engine. Researchers say the flaws, detailed at Black Hat USA on Thursday, potentially impacted over 2 million Mercedes-Benz...

MGASA-2020-0304 Updated gssdp/gupnp packages fix security vulnerability

The Open Connectivity Foundation UPnP specification before 2020-04-17 does not forbid the acceptance of a subscription request with a delivery URL on a different network segment than the fully qualified event-subscription URL, aka the CallStranger issue. CVE-2020-12695...

Updated gssdp/gupnp packages fix security vulnerability

The Open Connectivity Foundation UPnP specification before 2020-04-17 does not forbid the acceptance of a subscription request with a delivery URL on a different network segment than the fully qualified event-subscription URL, aka the CallStranger issue. CVE-2020-12695...