CVE-2019-15340

The Xiaomi Redmi 6 Pro Android device with a build fingerprint of xiaomi/sakuraindia/sakuraindia:8.1.0/OPM1.171019.019/V9.6.4.0.ODMMIFD:user/release-keys contains a pre-installed app with a package name of com.huaqin.factory app versionCode=1, versionName=QL1715201805292006 that allows any app...

CVE-2019-15340

The CVE-2019-15340 entry concerns Xiaomi Redmi 6 Pro devices running Android 8.1.0 with a pre-installed app (package com.huaqin.factory app, versionCode=1, versionName=QL1715_201805292006). The app exposes an interface that lets any co-located app disable/enable Wi‑Fi, Bluetooth, and GPS without ...

CVE-2019-15340: Incorrect Permission Assignment for Critical Resource

The Xiaomi Redmi 6 Pro Android device with a build fingerprint of xiaomi/sakuraindia/sakuraindia:8.1.0/OPM1.171019.019/V9.6.4.0.ODMMIFD:user/release-keys contains a pre-installed app with a package name of com.huaqin.factory app versionCode=1, versionName=QL1715201805292006 that allows any app...

Unencrypted Mobile Traffic on Tor Network Leaks PII

Unencrypted, sensitive and confidential user data originating from millions of mobile devices is carried on the Tor network every day. Now researchers say they have devised away to scoop up that data and create personal profiles for specific mobile users, that include GPS coordinates, web...

Unspecified Vulnerability in Cobham plc EXPLORER 710

The Cobham plc EXPLORER 710 is a portable satellite terminal from Cobham plc, UK. It provides features such as satellite communications and Internet access. A security vulnerability exists in the Cobham plc EXPLORER 710 using firmware version 1.07, which originates from the program not validating...

Design/Logic Flaw

The Cobham EXPLORER 710, firmware version 1.07, does not validate its firmware image. Development scripts left in the firmware can be used to upload a custom firmware image that the device runs. This could allow an unauthenticated, local attacker to upload their own firmware that could be used to...

CVE-2019-9534 The Cobham EXPLORER 710, firmware version 1.07, does not validate its firmware image

The Cobham EXPLORER 710, firmware version 1.07, does not validate its firmware image. Development scripts left in the firmware can be used to upload a custom firmware image that the device runs. This could allow an unauthenticated, local attacker to upload their own firmware that could be used to...

gps-volga.ru Cross Site Scripting vulnerability

Open Bug Bounty ID: OBB-990922 Security Researcher geeknik Helped patch 8826 vulnerabilities Received 8 Coordinated Disclosure badges Received 20 recommendations , a holder of 8 badges for responsible and coordinated disclosure, found a security vulnerability affecting gps-volga.ru website and it...

In-depth exploration found in the wild iOS exploit chain VII-vulnerability warning-the black bar safety net

In a previous article, we studied how could an attacker on the iPhone as root for a sandbox escape code execution. In each chain at the end you can see the attacker calls posixspawn, the path passed to the/ tmp directory, the malicious binary file. Implanted code in the background to run as root,...

600,000 GPS child trackers found vulnerable to location tracking

By Sudais Avast set out to study a variety of GPS tools found on the internet and how secure they are which can be found on Amazon, Alibaba, and eBay among others. This is a post from HackRead.com Read the original post: 600,000 GPS child trackers found vulnerable to location tracking...

Default Password for GPS Trackers

Many GPS trackers are shipped with the default password 123456. Many users don't change them. We just need to eliminate default passwords. This is an easy win. EDITED TO ADD 9/12: A California law bans default passwords starting in 2020...

Flaws in Over Half a Million GPS Trackers Expose Children Location Data

What if the tech intended to ensure that your kids, senior citizens, and pets are safe even when they're out of sight inadvertently expose them to stalkers? An estimated 600,000 GPS tracking devices for sale on Amazon and other large online merchants for $25–$50 have been found vulnerable to a...

Flaws in Over Half a Million GPS Trackers Expose Children Location Data

What if the tech intended to ensure that your kids, senior citizens, and pets are safe even when they're out of sight inadvertently expose them to stalkers? An estimated 600,000 GPS tracking devices for sale on Amazon and other large online merchants for $25–$50 have been found vulnerable to a...

CVE-2019-14951

The Telenav Scout GPS Link app 1.x for iOS, as used with Toyota and Lexus vehicles, has an incorrect protection mechanism against brute-force attacks on the authentication process, which makes it easier for attackers to obtain multimedia-screen access via port 7050 on the cellular network, as...

Design/Logic Flaw

The Telenav Scout GPS Link app 1.x for iOS, as used with Toyota and Lexus vehicles, has an incorrect protection mechanism against brute-force attacks on the authentication process, which makes it easier for attackers to obtain multimedia-screen access via port 7050 on the cellular network, as...

CVE-2019-14951

The Telenav Scout GPS Link app 1.x for iOS, as used with Toyota and Lexus vehicles, has an incorrect protection mechanism against brute-force attacks on the authentication process, which makes it easier for attackers to obtain multimedia-screen access via port 7050 on the cellular network, as...

CVE-2019-14951

CVE-2019-14951 affects the Telenav Scout GPS Link iOS app (1.x) used with Toyota/Lexus vehicles. Root cause is an incorrect brute‑force protection on the authentication process, enabling potential access to multimedia-screen functionality over port 7050 on the cellular network, demonstrated by a ...

CVE-2019-14951: Improper Restriction of Excessive Authentication Attempts

The Telenav Scout GPS Link app 1.x for iOS, as used with Toyota and Lexus vehicles, has an incorrect protection mechanism against brute-force attacks on the authentication process, which makes it easier for attackers to obtain multimedia-screen access via port 7050 on the cellular network, as...

On the IoT road: perks, benefits and security of moving smartly

Kaspersky has repeatedly investigated security issues related to IoT technologies for instance, here, or here. Earlier this year our experts have even gained foothold in the security of biomechanical prosthetic devices. The same implies to smart car security: our own research has indicated that...

The vulnerability of the GPS logger data collection program, related to initialization errors, allows a violator to trigger a service failure.

The vulnerability of the GPS logger data collection program is related to initialization errors. Exploiting this vulnerability can allow a hacker to cause the program to terminate abnormally...