IoT Company Wyze Leaks Emails, Device Data of 2.4M

An exposed Elasticsearch database, owned by Internet of Things IoT company Wyze, was discovered leaking connected device information and emails of millions of customers. Wyze makes smart home cameras and connected devices like connected bulbs and plugs, which can be integrated with smart home...

Android Security Bulletin—November 2019Stay organized with collectionsSave and categorize content based on your preferences.

The Android Security Bulletin contains details of security vulnerabilities affecting Android devices. Security patch levels of 2019-11-05 or later address all of these issues. To learn how to check a device's security patch level, see Check and update your Android version. Android partners are...

Google Assistant Audio Privacy Controls Updated After Outcry

Google is unveiling new privacy controls for the Google Assistant virtual assistant, after the company came under fire earlier this year for eavesdropping on users’ personal audio snippets – without their permission. The tech giant on Monday promised more transparency around the audio data that i...

CVE-2019-2103

In Google Assistant in Android 9, there is a possible permissions bypass that allows the Assistant to take a screenshot of apps with FLAGSECURE. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation...

CVE-2019-2103

In Google Assistant in Android 9, there is a possible permissions bypass that allows the Assistant to take a screenshot of apps with FLAGSECURE. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation...

Authentication flaw

In Google Assistant in Android 9, there is a possible permissions bypass that allows the Assistant to take a screenshot of apps with FLAGSECURE. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation...

CVE-2019-2103

In Google Assistant in Android 9, there is a possible permissions bypass that allows the Assistant to take a screenshot of apps with FLAGSECURE. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation...

CVE-2019-2103

CVE-2019-2103 affects Android 9 Framework. It describes a permissions bypass that could allow the Google Assistant to screenshot FLAG_SECURE apps, leading to local information disclosure without user interaction. The Android Security Bulletin lists CVE-2019-2103 under Framework with Type ID and H...

CVE-2019-2103

In Google Assistant in Android 9, there is a possible permissions bypass that allows the Assistant to take a screenshot of apps with FLAGSECURE. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation...

PT-2019-16195

Name of the Vulnerable Software and Affected Versions Google Assistant in Android version 9 Description The issue concerns a permissions bypass in Google Assistant on Android 9, allowing it to capture screenshots of apps that have the FLAG SECURE flag set. This could result in the disclosure of...

CVE-2019-2103: Exposure of Sensitive Information to an Unauthorized Actor

In Google Assistant in Android 9, there is a possible permissions bypass that allows the Assistant to take a screenshot of apps with FLAGSECURE. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation...

Google Nest Security Cam Bugs Allow Device Takeover

Multiple vulnerabilities in Google’s Nest Cam IQ connected indoor security camera would allow an attacker on the same network to take over the device, execute code on it and/or take it offline. Nest Labs’ Cam IQ Indoor integrates security-enhanced Linux in Android, Google Assistant and facial...

Nest Labs Nest Cam IQ indoor Weave CASE nlWeaveCertificate authentication bypass vulnerability

Talos Vulnerability Report TALOS-2019-0811 Nest Labs Nest Cam IQ indoor Weave CASE nlWeaveCertificate authentication bypass vulnerability August 19, 2019 CVE Number CVE-2019-5044 Summary An exploitable certificate authentication vulnerability exists in the Weave CASE Pairing function of the Nest...

Nest Labs Nest Cam IQ Indoor WeaveCASEEngine::DecodeCertificateInfo denial-of-service vulnerability

Summary An exploitable denial-of-service vulnerability exists in the Weave certificate loading functionality of the Nest Cam IQ Indoor camera, version 4620002. A specially crafted weave packet can cause an integer overflow and an out-of-bounds read on unmapped memory to occur, resulting in a deni...

Nest Labs Nest Cam IQ Indoor Weave Legacy Pairing Information Disclosure Vulnerability

Summary An exploitable information disclosure vulnerability exists in the Weave Legacy Pairing functionality of Nest Cam IQ Indoor version 4620002. A set of specially crafted weave packets can cause an out of bounds read, resulting in information disclosure. An attacker can send packets to trigge...

Nest Labs Openweave Weave DecodeMessageWithLength Information Disclosure Vulnerability

Summary An exploitable information disclosure vulnerability exists in the Weave MessageLayer parsing of Openweave-core version 4.0.2 and Nest Cam IQ Indoor version 4620002. A specially crafted weave packet can cause an integer overflow to occur, resulting in PacketBuffer data reuse. An attacker c...

Nest Labs Nest Cam IQ Indoor Weave TCP connection denial-of-service vulnerability

Summary An exploitable denial-of-service vulnerability exists in the Weave daemon of the Nest Cam IQ Indoor, version 4620002. A set of TCP connections can cause unrestricted resource allocation, resulting in a denial of service. An attacker can connect multiple times to trigger this vulnerability...

Nest Labs Nest Cam IQ Indoor Weave PASE pairing brute force vulnerability

Summary An exploitable information disclosure vulnerability exists in the Weave PASE pairing functionality of the Nest Cam IQ Indoor, version 4620002. A set of specially crafted weave packets can brute force a pairing code, resulting in greater Weave access and potentially full device control. An...

Android TV exposed the bug or cause of the user's private photos leaked-vulnerability warning-the black bar safety net

Recently, Twitter users prashanth broke the news, said he found the Android TV's a bug, or lead to users private photos being leaked. When he connected to a Vu Android TV, and select the“switch to another account”, turned out to be able to view all with this TV the name of the person and the...

Researchers discover vulnerabilities in smart assistants’ voice commands

Virtual personal assistants VPA, also known as smart assistants like Amazon’s Alexa and Google’s Assistant, are in the spotlight for vulnerabilities to attack. Take, for example, that incident about an Oregon couple’s Echo smart speaker inadvertently recording their conversation and sending it to...