Vecna VGo Robot Information Disclosure Vulnerability

VGo is a new productivity improvement solution that allows individuals to replicate themselves in distant locations and move around freely as if they were there. An information disclosure vulnerability exists in versions prior to Vecna VGo Robot 3.0.3.52164, which can be exploited by an attacker ...

Intel 2G Modem

1. EXECUTIVE SUMMARY CVSS v3 8.2 ATTENTION : Exploitable remotely Vendor : Intel Equipment : Intel 2G Modem Vulnerability : Buffer Overflow 2. RISK EVALUATION Successful exploitation of this buffer overflow vulnerability may allow remote code execution. The vulnerability affects Intel 2G modem...

Google’s April Android Security Bulletin Warns of 9 Critical Bugs

Nine vulnerabilities rated critical were patched as part of Google’s Android Security Bulletin for April. Critical vulnerabilities ranged from two remote code execution vulnerabilities tied to the Android media framework, to a Qualcomm Wi-Fi component flaw that allowed a nearby attacker to use “a...

HPSBHF03581 rev. 4 - AMD Secure Processor and Promontory Chipset Exploits

Potential Security Impact Circumvention of platform security controls, unauthorized access to system memory, installation of difficult to detect malware. Source: CTS Reported By: CTS VULNERABILITY SUMMARY Vulnerability | Description | Impact ---|---|--- MASTERKEY | Attacker who already has...

HPSBPI03580 rev. 2 - Cross Site Request Forgery Vulnerability for Certain HP Enterprise and PageWide Printers

Potential Security Impact Elevation of Privilege. Reported by: Mohamed Abdelbaset Elnoby VULNERABILITY SUMMARY A potential security vulnerability has been identified with certain HP Enterprise and PageWide printers and MFPs. This vulnerability is known as Cross Site Request Forgery and could...

Volkswagen Customer-Link App and HTC Customer-Link Bridge Injection Vulnerability

The Volkswagen Customer-Link App is a mobile application from Volkswagen that monitors the status of vehicles.The HTC Customer-Link Bridge is an Internet of Things IoT device from Volkswagen and HTC that monitors vehicle information and provides additional roadway information. It is used to monit...

CVE-2018-1170

This vulnerability allows adjacent attackers to inject arbitrary Controller Area Network messages on vulnerable installations of Volkswagen Customer-Link App 1.30 and HTC Customer-Link Bridge. Authentication is not required to exploit this vulnerability. The specific flaw exists within the...

Design/Logic Flaw

This vulnerability allows adjacent attackers to inject arbitrary Controller Area Network messages on vulnerable installations of Volkswagen Customer-Link App 1.30 and HTC Customer-Link Bridge. Authentication is not required to exploit this vulnerability. The specific flaw exists within the...

CVE-2018-1170

This vulnerability allows adjacent attackers to inject arbitrary Controller Area Network messages on vulnerable installations of Volkswagen Customer-Link App 1.30 and HTC Customer-Link Bridge. Authentication is not required to exploit this vulnerability. The specific flaw exists within the...

CVE-2018-1170

The CVE-2018-1170 issue affects the Volkswagen Customer-Link App (v1.30) and HTC Customer-Link Bridge. The root cause is a failure to implement proper protection against unauthorized firmware updates, allowing adjacent attackers to inject arbitrary CAN messages on vulnerable installations. The vu...

Siemens SIMATIC Industrial PCs

CVSS v3 5.9 ATTENTION: Remotely exploitable Vendor: Siemens Equipment: SIMATIC Industrial PCs Vulnerability: Cryptographic Issues AFFECTED PRODUCTS Siemens reports that the vulnerability affects the following versions of SIMATIC Industrial PCs using a version of Infineon’s Trusted Platform Module...

Volkswagen Customer-Link App Protection Mechanism Failure CAN Message Injection Vulnerability

This vulnerability allows adjacent attackers to inject arbitrary Controller Area Network messages on vulnerable installations of Volkswagen Customer-Link App and HTC Customer-Link Bridge. Authentication is not required to exploit this vulnerability. The specific flaw exists within the Customer-Li...

CVE-2018-7298

In /usr/local/etc/config/addons/mh/loopupd.sh on eQ-3 AG HomeMatic CCU2 2.29.22 devices, software update packages are downloaded via the HTTP protocol, which does not provide any cryptographic protection of the downloaded contents. An attacker with a privileged network position which could be...

CVE-2018-7298

Affected product: eQ-3 AG HomeMatic CCU2 (version 2.29.22). Issue: loopupd.sh downloads software update packages over HTTP, which provides no cryptographic protection. Root cause: lack of integrity/ authenticity verification for firmware updates due to plain HTTP delivery. Impact: attacker with n...

CVE-2018-7298

In /usr/local/etc/config/addons/mh/loopupd.sh on eQ-3 AG HomeMatic CCU2 2.29.22 devices, software update packages are downloaded via the HTTP protocol, which does not provide any cryptographic protection of the downloaded contents. An attacker with a privileged network position which could be...

Siemens SIMATIC Industrial PCs (Update A)

CVSS v3 5.9 ATTENTION: Exploitable remotely Vendor: Siemens Equipment: SIMATIC Industrial PCs Vulnerability: Cryptographic Issues UPDATE INFORMATION This updated advisory is a follow-up to the original advisory titled ICSA-18-058-01 Siemens SIMATIC Industrial PCs that was published February 27,...

Intel Issues Updated Spectre Firmware Fixes For Newer Processors

Intel has issued updated microcode to help protect its newer processors from Spectre security exploits. The Santa Clara, Calif.-based company’s new microcode updates – which impact its newer chip platforms, such as Kaby Lake, Coffee Lake, and Skylake – have been released to OEM customers and...

Cisco RV132W and RV134W Remote Code Execution and Denial of Service Vulnerability

A vulnerability in the web interface of the Cisco RV132W ADSL2+ Wireless-N VPN and RV134W VDSL2 Wireless-AC VPN Routers could allow an unauthenticated, remote attacker to execute arbitrary code and gain full control of an affected system, including issuing commands with root privileges. The...

CVE-2018-5441

An Improper Validation of Integrity Check Value issue was discovered in PHOENIX CONTACT mGuard firmware versions 7.2 to 8.6.0. mGuard devices rely on internal checksums for verification of the internal integrity of the update packages. Verification may not always be performed correctly, allowing ...

Meltdown/Spectre: Intel Nixes Patches, Tech CEOs Questioned on Information Blackout

IT departments and tech vendors continued grappling with Spectre and Meltdown this week, as Intel pulled its glitchy patches and the U.S. Congress questioned the vulnerability disclosures' timing and scope. Spectre and Meltdown aren't typical vulnerabilities for a number of reasons, and as a...