PT-2024-3375 · Linux +3 · Linux Kernel +3

Name of the Vulnerable Software and Affected Versions: Linux kernel affected versions not specified Description: The issue is related to a potential NULL pointer dereference in the hx8357 probe function in the Linux kernel's HX-8357 driver. This could allow an attacker to cause a denial of servic...

PINs for Cryptography with Hardware Secure Elements

I’m a big fan of technologies that enable otherwise impossible security properties and user experiences, like cryptography often can. One such technology is hardware secure elements. Here’s a thing you can’t do with cryptography: encrypt data securely with a low-entropy secret, like a PIN. If a...

CVE-2023-49515

Insecure Permissiosn vulnerability in TP Link TC70 and C200 WIFI Camera v.3 firmware v.1.3.4 and fixed in v.1.3.11 allows a physically proximate attacker to obtain sensitive information via a connection to the UART pin components...

PT-2024-1169 · Tp Link · C200 Wifi Camera +1

Name of the Vulnerable Software and Affected Versions: TP Link TC70 and C200 WIFI Camera versions 1.3.4 through 1.3.10 Description: The issue is related to insecure permissions in the firmware of TP Link TC70 and C200 WIFI Cameras, allowing a physically proximate attacker to obtain sensitive...

CVE-2023-33744

TeleAdapt RoomCast TA-2400 1.0 through 3.1 suffers from Use of a Hard-coded Password PIN: 385521, 843646, and 592671...

CVE-2023-33744

TeleAdapt RoomCast TA-2400 1.0 through 3.1 suffers from Use of a Hard-coded Password PIN: 385521, 843646, and 592671...

WordPress GS Pins for Pinterest Plugin <= 1.6.1 is vulnerable to Cross Site Scripting (XSS)

Software GS Pins for Pinterest Type Plugin Vulnerable versions = 1.6.1 Fixed in 1.6.2 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE N/A Patch priority Medium CVSS severity Medium 6.5 Developer Claim ownership PSID d745127bf65a Credits Unknown Required...

WordPress GS Pins for Pinterest Plugin <= 1.6.2 is vulnerable to Cross Site Request Forgery (CSRF)

Software GS Pins for Pinterest Type Plugin Vulnerable versions = 1.6.2 Fixed in 1.6.3 OWASP Top 10 A5: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2022-47150 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID 65fda5a4e6dc Credits István Márton...

CVE-2023-21426

Hardcoded AES key to encrypt cardemulation PINs in NFC prior to SMR Jan-2023 Release 1 allows attackers to access cardemulation PIN...

CVE-2022-41505

An access control issue on TP-LInk Tapo C200 V1 devices allows physically proximate attackers to obtain root access by connecting to the UART pins, interrupting the boot process, and setting an init=/bin/sh value...

Design/Logic Flaw

An access control issue on TP-LInk Tapo C200 V1 devices allows physically proximate attackers to obtain root access by connecting to the UART pins, interrupting the boot process, and setting an init=/bin/sh value...

CVE-2022-41505

The CVE-2022-41505 entry concerns the TP-Link Tapo C200 V1 webcam, where an access-control flaw reportedly lets a physically proximate attacker obtain root access by connecting to UART pins, interrupting boot, and setting init=/bin/sh. Documents confirm physical access as the attack vector and th...

CVE-2022-41505

An access control issue on TP-LInk Tapo C200 V1 devices allows physically proximate attackers to obtain root access by connecting to the UART pins, interrupting the boot process, and setting an init=/bin/sh value...

CVE-2022-35572

On Linksys E5350 WiFi Router with firmware version 1.0.00.037 and lower, and potentially other vendors/devices due to code reuse, the /SysInfo.htm URI does not require a session ID. This web page calls a showsysinfo function which retrieves WPA passwords, SSIDs, MAC Addresses, serial numbers, WPS...

CVE-2022-35572

On Linksys E5350 WiFi Router with firmware version 1.0.00.037 and lower, and potentially other vendors/devices due to code reuse, the /SysInfo.htm URI does not require a session ID. This web page calls a showsysinfo function which retrieves WPA passwords, SSIDs, MAC Addresses, serial numbers, WPS...

Nearly 2,000 Signal users affected by Twilio phishing attack

New findings following the Twilio phishing attack revealed that Signal, one of its high-value clients and a popular encrypted messaging platform, was particularly affected. 1,900 of its users had their phone numbers and SMS registration codes exposed. However, Signal reassured users that the...

The vulnerability of the CRI-O Container Engine’s application programming interface’s pinns allows a hacker to exit the container and gain root access to the host.

The vulnerability of the CRI-O Container Engine’s application programming interface’s pinns function, a software tool for managing clusters of virtual machines in Kubernetes, is related to the lack of proper checks on kernel parameters. Exploiting this vulnerability could allow an attacker to exi...

CVE-2021-30322

Possible out of bounds write due to improper validation of number of GPIOs configured in an internal parameters array in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile...

T-Mobile customers, change your PINs

At the end of last week, T-Mobile was investigating reports of a “massive” customer data breach. A hacker claimed to stolen 100 million people’s data from T-Mobile’s servers, which included everything from names and driver licences to addresses and social security numbers. Its now confirmed...

100m T-Mobile Customer Records Purportedly Up for Sale

A threat actor is selling what they claim to be 30 million T-Mobile customers’ Social Security and driver license numbers on an underground web forum. The collection is a subset of the purported 100 million records contained in stolen databases. The seller told Motherboard – which first reported...