CVE-2020-27199

The Magic Home Pro application 1.5.1 for Android allows Authentication Bypass. The security control that the application currently has in place is a simple Username and Password authentication function. Using enumeration, an attacker is able to forge a User specific token without the need for...

CVE-2020-27199

The Magic Home Pro application 1.5.1 for Android allows Authentication Bypass. The security control that the application currently has in place is a simple Username and Password authentication function. Using enumeration, an attacker is able to forge a User specific token without the need for...

Authentication flaw

The Magic Home Pro application 1.5.1 for Android allows Authentication Bypass. The security control that the application currently has in place is a simple Username and Password authentication function. Using enumeration, an attacker is able to forge a User specific token without the need for...

CVE-2020-27199

CVE-2020-27199 affects Magic Home Pro on Android (1.5.1). The issue is an Authentication Bypass enabling full control of a victim’s device group via token forgery and endpoint enumeration. Attack chain described includes: (1) enumerate bound users by mac address to obtain userName/userUniID/binde...

CVE-2020-27199

The Magic Home Pro application 1.5.1 for Android allows Authentication Bypass. The security control that the application currently has in place is a simple Username and Password authentication function. Using enumeration, an attacker is able to forge a User specific token without the need for...

Magic Pro Home License Issue Vulnerability

Magic Pro Home is a mobile software from China-based Magic Pro that allows intelligent control of LED light illumination. A security vulnerability exists in Magic Pro Home application 1.5.1, which stems from allowing authentication to be bypassed. The application currently has security controls...

Defending the Intelligent Edge from Evolving Attacks

Cybercriminals keep their fingers on the pulse of potential new attack vectors at all times, looking for their next opportunity. They are currently moving significant resources to target and exploit emerging network-edge environments, such as the cloud and remote workers, rather than just targeti...

Cyber Monday is Every Monday: Securing the 'New Normal'

Derek Manky Though eCommerce threats are usually only top-of-mind during the holiday shopping season, researchers have been on high alert when it comes to cybercriminal activity in the retail space during all of 2020, due to troves of new shoppers and stores going online. That’s according to Dere...

The story of the year: remote work

The coronavirus pandemic has caused sudden, sweeping change around the world. The necessary social distancing measures are having an impact on all of us. One large part of society that has been affected by these measures more than others is the employed. While direct customer facing businesses li...

D-Link Routers at Risk for Remote Takeover from Zero-Day Flaw

Buggy firmware opens a number of D-Link VPN router models to zero-day attacks. The flaws, which lack a complete vendor fix, allow adversaries to launch root command injection attacks that can be executed remotely and allow for device takeover. Impacted are D-Link router models DSR-150, DSR-250,...

SUSE SLES12 Security Update : samba (SUSE-SU-2020:2721-1)

"This update for samba fixes the following issues : ZeroLogon: An elevation of privilege was possible with some configurations when an attacker established a vulnerable Netlogon secure channel connection to a domain controller, using the Netlogon Remote Protocol MS-NRPC CVE-2020-1472, bsc1176579...

Locking down your cyber life in lockdown

Today the NCSC refreshed their advice for online shoppers, so I thought it’d be handy to review and advise on other aspects of consumer security hygiene. More than ever, we’re reliant on technology, so now that we’re in various stages of lockdown it’s a great time to have a look at your home and...

PYSEC-2020-109

In some conditions, a snap package built by snapcraft includes the current directory in LDLIBRARYPATH, allowing a malicious snap to gain code execution within the context of another snap if both plug the home interface or similar. This issue affects snapcraft versions prior to 4.4.4, prior to...

CVE-2020-27348 snapcraft may build snaps with incorrect LD_LIBRARY_PATH

In some conditions, a snap package built by snapcraft includes the current directory in LDLIBRARYPATH, allowing a malicious snap to gain code execution within the context of another snap if both plug the home interface or similar. This issue affects snapcraft versions prior to 4.4.4, prior to...

UBUNTU-CVE-2020-27348

In some conditions, a snap package built by snapcraft includes the current directory in LDLIBRARYPATH, allowing a malicious snap to gain code execution within the context of another snap if both plug the home interface or similar. This issue affects snapcraft versions prior to 4.4.4, prior to...

Manipulating Systems Using Remote Lasers

Many systems are vulnerable: Researchers at the time said that they were able to launch inaudible commands by shining lasers -- from as far as 360 feet -- at the microphones on various popular voice assistants, including Amazon Alexa, Apple Siri, Facebook Portal, and Google Assistant. … They...

Global Registration Service 1.0.0.3 - (GREGsvc.exe) Unquoted Service Path Vulnerability

Exploit Title: Global Registration Service 1.0.0.3 - 'GREGsvc.exe' Unquoted Service Path Discovery by: Emmanuel Lujan Vendor Homepage: https://www.acer.com/ac/en/US/content/home Tested Version: 1.0.0.3 Vulnerability Type: Unquoted Service Path Tested on OS: Windows 7 Home Premium x64 Step to...

Laser-Based Hacking from Afar Goes Beyond Amazon Alexa

Imagine someone hacking into an Amazon Alexa device using a laser beam and then doing some online shopping using that person account. This is a scenario presented by a group of researchers who are exploring why digital home assistants and other sensing systems that use sound commands to perform...

Home Download Photon OS User Documentation FAQ Security Advisories Related Information Lightwave - PHSA-2020-1.0-0340

An update of 'postgresql' packages of Photon OS has been released...

openGauss: Restricting the Permission for the Database Home Directory

$GAUSSHOME is the installation directory of openGauss. To prevent the installation package from being tampered or damaged and protect customer network from security threats, this directory must be protected and deny unauthorized user access. Copyright C 2020 Greenbone Networks GmbH Some text...