Code injection

A user privacy issue was addressed by removing the broadcast MAC address. This issue is fixed in iOS 12.3, tvOS 12.3, watchOS 5.2.1. A device may be passively tracked by its WiFi MAC address...

CVE-2019-8620

CVE-2019-8620 describes a user privacy issue in Apple’s Wi‑Fi component where a device may be passively tracked by its Wi‑Fi MAC address. The underlying fix was to remove the broadcast MAC address, mitigating tracking risk. Public documentation indicates the vulnerability affects iOS, tvOS, and w...

CVE-2019-8620

A user privacy issue was addressed by removing the broadcast MAC address. This issue is fixed in iOS 12.3, tvOS 12.3, watchOS 5.2.1. A device may be passively tracked by its WiFi MAC address...

CVE-2019-8567

CVE-2019-8567 relates to a user privacy issue in macOS/iOS where a device could be passively tracked by its Wi‑Fi MAC address. The root cause is the broadcast MAC being present; mitigation is removing the broadcast MAC address. Apple fixes are in iOS 12.2 (and corresponding macOS/iOS advisories) ...

CVE-2019-8567

A user privacy issue was addressed by removing the broadcast MAC address. This issue is fixed in iOS 12.2. A device may be passively tracked by its WiFi MAC address...

W1.fi hostapd CAM table denial-of-service vulnerability

Summary An exploitable denial-of-service vulnerability exists in the hostapd 2.6, where an attacker could trigger AP to send IAPP location updates for stations, before the required authentication process has completed. This could lead to different denial of service scenarios, either by causing CA...

CVE-2018-8879

Stack-based buffer overflow in Asuswrt-Merlin firmware for ASUS devices older than 384.4 and ASUS firmware before 3.0.0.4.382.50470 for devices allows remote attackers to execute arbitrary code by providing a long string to the blocking.asp page via a GET or POST request. Vulnerable parameters ar...

CVE-2018-8879

Stack-based buffer overflow in Asuswrt-Merlin firmware for ASUS devices older than 384.4 and ASUS firmware before 3.0.0.4.382.50470 for devices allows remote attackers to execute arbitrary code by providing a long string to the blocking.asp page via a GET or POST request. Vulnerable parameters ar...

Wi-Fi Hotspot Tracking

Free Wi-Fi hotspots can track your location, even if you don't connect to them. This is because your phone or computer broadcasts a unique MAC address. What distinguishes location-based marketing hotspot providers like Zenreach and Euclid is that the personal information you enter in the captive...

CVE-2018-20958

The Bluetooth Low Energy BLE subsystem on Tapplock devices before 2018-06-12 relies on Key1 and SerialNo for unlock operations; however, these are derived from the MAC address, which is broadcasted by the device...

CVE-2018-20958

The Bluetooth Low Energy BLE subsystem on Tapplock devices before 2018-06-12 relies on Key1 and SerialNo for unlock operations; however, these are derived from the MAC address, which is broadcasted by the device...

Design/Logic Flaw

The Bluetooth Low Energy BLE subsystem on Tapplock devices before 2018-06-12 relies on Key1 and SerialNo for unlock operations; however, these are derived from the MAC address, which is broadcasted by the device...

CVE-2018-20958

The Bluetooth Low Energy BLE subsystem on Tapplock devices before 2018-06-12 relies on Key1 and SerialNo for unlock operations; however, these are derived from the MAC address, which is broadcasted by the device...

CVE-2018-20958

Tapplock’s BLE unlock mechanism before 2018-06-12 relies on Key1 and SerialNo, which are derived from the device’s MAC address that is broadcast publicly. This weak linkage means that credential material used for unlocks is effectively tied to observable hardware identifiers. The Red Hat entry an...

CVE-2019-13143

An HTTP parameter pollution issue was discovered on Shenzhen Dragon Brothers Fingerprint Bluetooth Round Padlock FB50 2.3. With the user ID, user name, and the lock's MAC address, anyone can unbind the existing owner of the lock, and bind themselves instead. This leads to complete takeover of the...

CVE-2019-13143

An HTTP parameter pollution issue was discovered on Shenzhen Dragon Brothers Fingerprint Bluetooth Round Padlock FB50 2.3. With the user ID, user name, and the lock's MAC address, anyone can unbind the existing owner of the lock, and bind themselves instead. This leads to complete takeover of the...

PT-2019-13151 · Shenzhen Dragon Brothers · Shenzhen Dragon Brothers Fingerprint Bluetooth Round Padlock Fb50

Name of the Vulnerable Software and Affected Versions: Shenzhen Dragon Brothers Fingerprint Bluetooth Round Padlock FB50 version 2.3 Description: An HTTP parameter pollution issue allows attackers to unbind the existing owner of the lock and bind themselves instead, leading to complete takeover o...

JetBlue Bomb Scare Set Off with Apple AirDrop

The feature in Apple mobile devices that allows people to send photos to nearby phones via Bluetooth is at the heart of a terrorism scare on a JetBlue flight over the weekend. According to the New York Daily News, a prankster sent a photo of a suicide vest to everyone who had an Apple device on t...

Over 1,300 Android Apps Caught Collecting Data Even If You Deny Permissions

Smartphones are a goldmine of sensitive data, and modern apps work as diggers that continuously collect every possible information from your devices. The security model of modern mobile operating systems, like Android and iOS, is primarily based on permissions that explicitly define which sensiti...

The vulnerability in the implementation of the hwarc_probe handler in the operating system kernel of Astra Linux allows a hacker to trigger a service failure.

The vulnerability in the implementation of the hwarcprobe function in the kernel of the Astra Linux operating system’s driver module drivers/uwb/hwa-rc.ko is related to a memory release error. In the hwarcprobe function, memory is allocated to hwarc, but this memory is not released correctly when...