CVE-2020-11223

CVE-2020-11223 affects Qualcomm camera driver components (Snapdragon family). Root cause: out-of-bounds write due to lack of validation of array index before copying into an array. Impact described as high with local attacker access and potential to compromise confidentiality, integrity, and avai...

CVE-2020-11203

CVE-2020-11203 describes a stack overflow in Qualcomm/Snapdragon components triggered when a GSM/WCDMA broadcast config size received from user exceeds the size of a variable-length array. Affected products include Snapdragon Auto, Connectivity, and various IoT/Wearable families. Impact per CVSS ...

CVE-2020-11204

Possible memory corruption and information leakage in sub-system due to lack of check for validity and boundary compliance for parameters that are read from shared MSG RAM in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdrag...

CVE-2020-11198

Key material used for TZ diag buffer encryption and other data related to log buffer is not wiped securely due to improper usage of memset in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice &...

CVE-2020-11195

CVE-2020-11195 concerns an out-of-bounds read/write in the Trust Authority (TA) when processing commands from the NS side, caused by an improper length check on command and response buffers. Affected are Snapdragon platforms including Auto, Compute, Connectivity, Consumer IOT, Industrial IOT, Mob...

CVE-2020-11194

CVE-2020-11194 affects Qualcomm Snapdragon platforms (Snapdragon Auto/Compute/Connectivity/Consumer IOT/Industrial IOT/Mobile/Wired Infrastructure and Networking). The issue is a possible out-of-bounds access in the Trust Authority (TA) when processing a command received from the Network Subsyste...

CVE-2020-11177

CVE-2020-11177 affects Qualcomm closed‑source components in Snapdragon devices (Auto/Compute/Connectivity/IOT/Wearables, etc.). The issue arises from improper validation of the SPC code setting and device lock, allowing a local attacker to overwrite the Security Code NV item without current SPC b...

CVE-2020-11170

CVE-2020-11170 involves an out-of-bounds memory access during Vorbis audio playback due to improper header extraction checks in Qualcomm/ Snapdragon components (Auto, Compute, Connectivity, IOT, Mobile, etc.). Root cause: insufficient validation in header parsing leads to memory access beyond bou...

Credential Stuffing and Account Takeover -- The Business View

Account takeovers ATOs, in which criminals impersonate legitimate account owners in order to take control of an account, cause tremendous pain for businesses in all industries. This pain may be monetary, such as losses from stolen accounts, but may also include a number of related problems, like...

CVE-2021-25251

The Trend Micro Security 2020 and 2021 families of consumer products are vulnerable to a code injection vulnerability which could allow an attacker to disable the program's password protection and disable protection. An attacker must already have administrator privileges on the machine to exploit...

Phishing: Holiday Season Attacks on the Rise

Overview Phishing continues to be a major attack vector, and it's surprising just how many security incidents and breaches start with an employee clicking on a link in a carefully crafted phishing email and sometimes doing the same with a not-so-well crafted phishing email -- see this example...

CVE-2021-25227

Trend Micro Antivirus for Mac 2021 (Consumer) is affected by a memory exhaustion vulnerability causing a denial of service that can disable scanning. The issue stems from an input handling flaw in the iCoreService binary, requiring local access with low-privilege code and user interaction (visiti...

Trend Micro Antivirus for Mac 资源管理错误漏洞

Trend Micro Antivirus for Mac is a set of antivirus software based on Mac platform from Trend Micro. A denial of service vulnerability exists in Trend Micro Antivirus for Mac version 2020 Consumer. An attacker can exploit this vulnerability to disable all scanning features in the application...

CVE-2020-4081

In Digital Experience 8.5, 9.0, and 9.5, WSRP consumer is vulnerable to cross-site scripting XSS...

Cross site scripting

In Digital Experience 8.5, 9.0, and 9.5, WSRP consumer is vulnerable to cross-site scripting XSS...

CVE-2020-4081

In Digital Experience 8.5, 9.0, and 9.5, WSRP consumer is vulnerable to cross-site scripting XSS...

Privacy predictions for 2021

2020 saw an unprecedented increase in the importance and value of digital services and infrastructure. From the rise of remote working and the global shift in consumer habits to huge profits booked by internet entertainers, we are witnessing how overwhelmingly important the connected infrastructu...

CVE-2020-11213

Out of bound reads might occur in while processing Service descriptor due to improper validation of length of fields in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer Electronics Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon IoT,...

CVE-2020-11214

Buffer over-read while processing NDL attribute if attribute length is larger than expected and then FW is treating it as more number of immutable schedules in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer Electronics Connectivity, Snapdragon Consumer IOT,...

CVE-2020-11180

Out of bound access in computer vision control due to improper validation of command length before processing it in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile...