Amazon Alexa, Google Home Are On a Collision Course With Regulation

Voice assistants are growing rapidly in popularity — but at the same time, the privacy concerns and security issues with popular home assistant devices like Amazon Echo and Google Home are peaking too. Earlier in July, Amazon came under fire after acknowledging that it retains the voice recording...

A week in security (July 8 – 14)

Last week on Malwarebytes Labs, we looked at ways to send your sensitive information in a secure fashion, examined some tactics in incident response land, and explored federal data privacy law. We also looked at how security tools can turn against you, and took a deep dive into the rather fiendis...

CVE-2019-13598

LuaUPnP in Vera Edge Home Controller 1.7.4452 allows remote unauthenticated users to execute arbitrary OS commands via the code parameter to /port3480/datarequest because the "No unsafe lua allowed" code block is skipped...

Command injection

LuaUPnP in Vera Edge Home Controller 1.7.4452 allows remote unauthenticated users to execute arbitrary OS commands via the code parameter to /port3480/datarequest because the "No unsafe lua allowed" code block is skipped...

CVE-2019-13598

CVE-2019-13598 affects Vera Edge Home Controller (version 1.7.4452) via LuaUPnP. A remote, unauthenticated attacker can trigger arbitrary OS commands by passing the code parameter to /port_3480/data_request, because the expected safety check for unsafe Lua code is skipped. This is a remote code e...

CVE-2019-9886

Any URLs with downloadattachment.php under templates or home folders can allow arbitrary files downloaded without login in BroadLearning eClass before version ip.2.5.10.2.1...

Related vulnerabilities have now been patched: the Orvibo smart home devices disclosure of user information-bug warning-the black bar safety net

From Orvibo aspect to understand, this relates to the information disclosure of the security vulnerability has now been fixed, and the user information of the protection level, at the same time they also want and professional information security research team into cooperation with the protection...

Security Camera Firm Arlo Zaps High-Severity Bugs

Two high-severity vulnerabilities in Arlo Technologies’ wireless home security camera gear have been patched. The flaws, which indirectly impact Arlo’s popular fleet of wireless home security cameras, are limited to adversaries with local network and physical access to Arlo Base Stations. Both...

How we hacked our colleague’s smart home

In this article, we publish the results of our study of the Fibaro Home Center smart home. We identified vulnerabilities in Fibaro Home Center 2 and Fibaro Home Center Lite version 4.540, as well as vulnerabilities in the online API. An offer you cannot refuse The backbone of any technology compa...

EulerOS 2.0 SP8 : sssd (EulerOS-SA-2019-1660)

According to the version of the sssd packages installed, the EulerOS installation on the remote host is affected by the following vulnerability : - A vulnerability was found in sssd where, if a user was configured with no home directory set, sssd would return '/' the root directory instead of ''...

WhatBreach - OSINT Tool To Find Breached Emails And Databases

WhatBreach is a tool to search for breached emails and their corresponding database. It takes either a single email or a list of emails and searches them leveraging haveibeenpwned.com's API, from there if there are any breaches it will search for the query link on Dehashed pertaining to the...

Movie Tech Review: Child’s Play 2019

A while back, Rik & Kasia Ferguson shared their thoughts on the movie, “Unfriended: The Dark Web.” The dark web and technology in general plays a pivotal role in the movie's plot, so the team decided it would be interesting to have a real-world expert review. Everyone had a lot of fun, and thus...

Dell SupportAssist for Business PCs and Dell SupportAssist for Home PCs Privilege License and Access Control Issues Vulnerability

Dell SupportAssist for Business PCs and Dell SupportAssist for Home PCs are both products of Dell Inc.Dell SupportAssist for Business PCs is a client application for business PCs. The program provides automated, proactive and predictive technologies for troubleshooting, etc. Dell SupportAssist fo...

PT-2019-16679 · Dell · Dell Supportassist For Business Pcs +1

Name of the Vulnerable Software and Affected Versions: Dell SupportAssist for Business PCs version 2.0 Dell SupportAssist for Home PCs versions 2.2 through 3.2.1 Description: The issue concerns an Improper Privilege Management vulnerability. A malicious local user can exploit this by inheriting a...

CVE-2018-18471

The vulnerability CVE-2018-18471 affects the endpoint /api/2.0/rest/aggregator/xml in Axentra Hipserv firmware used by NETGEAR Stora, Seagate GoFlex Home, and MEDION LifeCloud. The issue is an XXE flaw that can be chained with an SSRF bug to achieve remote command execution as root, exploitable b...

CVE-2018-18471

/api/2.0/rest/aggregator/xml in Axentra firmware, used by NETGEAR Stora, Seagate GoFlex Home, and MEDION LifeCloud, has an XXE vulnerability that can be chained with an SSRF bug to gain remote command execution as root. It can be triggered by anyone who knows the IP address of the affected device...

Stored Cross-Site Scripting Vulnerability in Home Portal System

Home portal system is for the home furnishing industry to develop a set of decoration website PHP source code system. A stored cross-site scripting vulnerability exists in the Home Portal System. An attacker can insert malicious js code into the page to obtain user cookies and other information,...

Aida64 6.00.5100 - (Log to CSV File) Local SEH Buffer Overflow Exploit

Exploit for windows platform in category local exploits !/usr/bin/python Exploit : Aida64 6.00.5100 'Log to CSV File' Local SEH Buffer Overflow Exploit Author : Nipun Jaswal Tested On : Windows 7 Home Basicx86 Version : 6.00.5100 Vendor Homepage: https://www.aida64.com/downloads Software Link:...

Aida64 6.00.5100 - 'Log to CSV File' Local SEH Buffer Overflow

!/usr/bin/python Exploit : Aida64 6.00.5100 'Log to CSV File' Local SEH Buffer Overflow Exploit Author : Nipun Jaswal Tested On : Windows 7 Home Basicx86 Version : 6.00.5100 Release Date : 31/May/2019 Build : 21/May/2019 Vendor Homepage: https://www.aida64.com/downloads Software Link:...

Aida64 6.00.5100 - Log to CSV File Local SEH Buffer Overflow

Aida64 6.00.5100 - Log to CSV File Local SEH Buffer Overflow !/usr/bin/python Exploit : Aida64 6.00.5100 'Log to CSV File' Local SEH Buffer Overflow Exploit Author : Nipun Jaswal Tested On : Windows 7 Home Basicx86 Version : 6.00.5100 Release Date : 31/May/2019 Build : 21/May/2019 Vendor Homepage...