CIRCONTROL CirCarLife Information Disclosure Vulnerability

CIRCONTROL CirCarLife is a parking lot automation management system from Circontrol, Spain. An information disclosure vulnerability exists in CIRCONTROL CirCarLife versions prior to 4.3, which stems from the program's lack of authentication against /html/device-id. An attacker could exploit this...

EulerOS Virtualization 2.5.1 : kernel (EulerOS-SA-2018-1263)

According to the versions of the kernel packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : - A statement in the System Programming Guide of the Intel 64 and IA-32 Architectures Software Developer's Manual SDM was mishandle...

EulerOS Virtualization 2.5.0 : kernel (EulerOS-SA-2018-1266)

According to the version of the kernel packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerability : - An address corruption flaw was discovered in the Linux kernel built with hardware breakpoint CONFIGHAVEHWBREAKPOINT support. While...

Researchers Heat Up Cold-Boot Attack That Works on All Laptops

A pair of researchers have developed an attack method that can bypass mitigations for cold-boot attacks on laptops. A physical attacker can compromise a laptop that’s in sleep mode, potentially lifting sensitive passwords, encryption keys and other information. The ramifications are, on the...

The vulnerability of Microsoft Hyper-V hardware virtualization system for Windows operating systems allows a perpetrator to execute arbitrary code.

The vulnerability of Microsoft Hyper-V hardware virtualization technology for Windows operating systems is related to insufficient validation of input data. Exploiting this vulnerability allows a malicious actor to execute arbitrary code on the host operating system through a specially created...

Hacking an assault tank… A Nerf one

TL;DR A complex, challenging reverse and hijack of a toy tank Nerf gun camera, but the result was we got to shoot the 44Con conference organiser with it! Why A remote-controlled Nerf gun with video feed and aiming crosshairs. Who wouldn’t want to reverse the RF and firmware, with a view to...

Microsoft Windows: Turn On Virtualization Based Security (Select Platform Security Level)

Specifies whether Virtualization Based Security is enabled. Virtualization Based Security uses the Windows Hypervisor to provide support for security services. Virtualization Based Security requires Secure Boot, and can optionally be enabled with the use of DMA Protections. DMA protections requir...

Microsoft Windows: Turn On Virtualization Based Security (Credential Guard Configuration)

Specifies whether Virtualization Based Security is enabled. Virtualization Based Security uses the Windows Hypervisor to provide support for security services. Virtualization Based Security requires Secure Boot, and can optionally be enabled with the use of DMA Protections. DMA protections requir...

Mobile matters: How to ready your apps for the holiday shopping spike

While more consumers now shop on smartphones, retailers have a lot of work to do to make mobile shopping easy. Developers must account for the wide variety of mobile hardware and software, take into account how consumers use their phones in stores and ensure easy checkout. The cheer and good...

Assessing the security of a portable router: a look inside its hardware

Network administrators should perform security assessments of hardware that they will provide their users, or particularly paranoid users might want to poke at their devices just to be extra sure. In this blog post, we will demonstrate the techniques used to assess security on a generic portable...

Tenda ADSL Router D152 - Cross-Site Scripting Vulnerability

Exploit for hardware platform in category web applications Exploit Title: Tenda D152 ADSL Router - Cross-Site Scripting Exploit Author: Sandip Dey Vendor Homepage: http://www.tendacn.com Hardware Link:...

Tenda ADSL Router D152 - Cross-Site Scripting

Tenda ADSL Router D152 - Cross-Site Scripting Exploit Title: Tenda D152 ADSL Router - Cross-Site Scripting Exploit Author: Sandip Dey Date: 2018-07-21 Vendor Homepage: http://www.tendacn.com Hardware Link:...

Tenda ADSL Router D152 Cross Site Scripting

Exploit Title: Tenda D152 ADSL Router - Cross-Site Scripting Exploit Author: Sandip Dey Date: 2018-07-21 Vendor Homepage: http://www.tendacn.com Hardware Link:...

Tenda ADSL Router D152 - Cross-Site Scripting

Exploit Title: Tenda D152 ADSL Router - Cross-Site Scripting Exploit Author: Sandip Dey Date: 2018-07-21 Vendor Homepage: http://www.tendacn.com Hardware Link:...

CVE-2018-7938

P10 Huawei smartphones with the versions before Victoria-AL00AC00B217 have an information leak vulnerability due to the lack of permission validation. An attacker tricks a user into installing a malicious application on the smart phone, and the application can read some hardware serial number,...

DEBIAN-CVE-2018-16425

A double free when handling responses from an HSM Card in scpkcs15emuschsminit in libopensc/pkcs15-sc-hsm.c in OpenSC before 0.19.0-rc1 could be used by attackers able to supply crafted smartcards to cause a denial of service application crash or possibly have unspecified other impact...

UBUNTU-CVE-2018-16425

A double free when handling responses from an HSM Card in scpkcs15emuschsminit in libopensc/pkcs15-sc-hsm.c in OpenSC before 0.19.0-rc1 could be used by attackers able to supply crafted smartcards to cause a denial of service application crash or possibly have unspecified other impact...

CVE-2018-7938: Exposure of Sensitive Information to an Unauthorized Actor

P10 Huawei smartphones with the versions before Victoria-AL00AC00B217 have an information leak vulnerability due to the lack of permission validation. An attacker tricks a user into installing a malicious application on the smart phone, and the application can read some hardware serial number,...

D-Link DIR-615 - Denial of Service Vulnerability

Exploit for hardware platform in category dos / poc Exploit Title: D-Link DIR-615 - Denial of Service PoC Vendor Homepage: http://www.dlink.co.in Hardware Link: https://www.amazon.in/D-Link-DIR-615-Wireless-N300-Router-Black/dp/B0085IATT6 Version: D-Link DIR-615 Category: Hardware Exploit Author:...

Google 'Titan Security Key' Is Now On Sale For $50

Google just made its Titan Security Key available on its store for $50. First announced last month at Google Cloud Next '18 convention, Titan Security Key is a tiny USB device—similar to Yubico's YubiKey—that offers hardware-based two-factor authentication 2FA for online accounts with the highest...