QuickTimePlayer suffers from dll hijacking vulnerability

QuickTimePlayers is a player released by Apple developed for macOS and Windows. A dll hijacking vulnerability exists in QuickTimePlayer, which can be exploited by attackers to remotely control a user's computer or implant a Trojan horse...

Skype Windows desktop version suffers from dll hijacking vulnerability

Skype Desktop is a free voice communication program. Skype Desktop for Windows has a dll hijacking vulnerability that can be exploited by attackers to remotely control a user's computer or implant a Trojan horse...

Google Warns of Critical Android Remote Code Execution Bug

Google has fixed two critical bugs affecting its Android handsets. The more serious flaws exists in the Android System component and allow remote attackers to execute arbitrary code. The two critical vulnerabilities are part of Google’s January Android security bulletin, released Monday. The...

Patch Tuesday, Good Riddance 2020 Edition

Microsoft today issued its final batch of security updates for Windows PCs in 2020, ending the year with a relatively light patch load. Nine of the 58 security vulnerabilities addressed this month earned Microsofts most-dire "critical" label, meaning they can be abused by malware or miscreants to...

Google Patches Critical Wi-Fi and Audio Bugs in Android Handsets

Google patched ten critical bugs as part of its December Android Security Bulletin. The worst of the bugs was tied to the Android media framework component and gives attacker remote control of vulnerable handsets. Google did not reveal the technical specifics of the critical flaw, tracked as...

Unauthorized Access Vulnerability in Aqara Smart Camera G2H (Gateway Edition)

The Aqara Smart Camera G2H is a smart camera with 1080P image quality and 140° wide angle. An unauthorized access vulnerability exists in Aqara Smart Camera G2H Gateway Edition. An attacker can exploit the vulnerability to gain remote access control of the device over WiFi without the permission ...

CVE-2020-13769

LDMS/alertlog.aspx in Ivanti Endpoint Manager through 2020.1 allows SQL Injection via a /remotecontrolauth/api/device request...

Sql injection

LDMS/alertlog.aspx in Ivanti Endpoint Manager through 2020.1 allows SQL Injection via a /remotecontrolauth/api/device request...

CVE-2019-7357

Subrion CMS 4.2.1 is vulnerable to CSRF in panel/modules/plugins/, enabling an attacker to remotely activate/deactivate plugins on an authenticated session. Root cause: CSRF in the plugins module. Impact: manipulation of plugins; no public fix version or remediation details are provided in the su...

Watch Out! New Android Banking Trojan Steals From 112 Financial Apps

Four months after security researchers uncovered a "Tetrade" of four Brazilian banking Trojans targeting financial institutions in Brazil, Latin America, and Europe, new findings show that the criminals behind the operation have expanded their tactics to infect mobile devices with spyware...

CVE-2020-26507

A CSV Injection also known as Formula Injection vulnerability in the Marmind web application with version 4.1.141.0 allows malicious users to gain remote control of other computers. By providing formula code in the “Notes” functionality in the main screen, an attacker can inject a payload into th...

Design/Logic Flaw

A CSV Injection also known as Formula Injection vulnerability in the Marmind web application with version 4.1.141.0 allows malicious users to gain remote control of other computers. By providing formula code in the “Notes” functionality in the main screen, an attacker can inject a payload into th...

CVE-2020-26507

A CSV Injection also known as Formula Injection vulnerability in the Marmind web application with version 4.1.141.0 allows malicious users to gain remote control of other computers. By providing formula code in the “Notes” functionality in the main screen, an attacker can inject a payload into th...

PT-2020-16428

Name of the Vulnerable Software and Affected Versions Marmind web application version 4.1.141.0 Description A CSV Injection vulnerability in the Marmind web application allows malicious users to gain remote control of other computers. By providing formula code in the "Notes" functionality, an...

SHUN HU Technology JUUKO Industrial Radio Remote Control

1. EXECUTIVE SUMMARY CVSS v3 8.3 ATTENTION: Exploitable from an adjacent network/low skill level to exploit Vendor: SHUN HU Technology Co., Ltd Equipment: JUUKO Industrial Radio Remote Control Vulnerabilities: Authentication Bypass by Capture-replay, Command Injection 2. RISK EVALUATION...

Hitachi ABB Power Grids XMC20 Multiservice-Multiplexer

1. EXECUTIVE SUMMARY CVSS v3 9.1 ATTENTION: Exploitable remotely/low skill level to exploit Vendor: Hitachi ABB Power Grids Equipment: XMC20 Multiservice-Multiplexer Vulnerability: Improper Authentication 2. RISK EVALUATION Successful exploitation of this vulnerability could allow an attacker to...

Comcast TV Remote Hack Opens Homes to Snooping

A security flaw allowing attackers to remotely snoop in on victims’ private conversations was found to stem from an unexpected device – their TV remotes. The flaw stems from Comcast’s XR11, a popular voice-activated remote control for cable TV, which has more than 18 million units deployed across...

Smart male chastity lock cock-up

TL;DR Smart Bluetooth male chastity lock, designed for user to give remote control to a trusted 3rd party using mobile app/API Multiple API flaws meant anyone could remotely lock all devices and prevent users from releasing themselves Removal then requires an angle grinder or similar, used in clo...

LIVE Webinar on Zerologon Vulnerability: Technical Analysis and Detection

I am sure that many of you have by now heard of a recently disclosed critical Windows server vulnerability—called Zerologon—that could let hackers completely take over enterprise networks. For those unaware, in brief, all supported versions of the Windows Server operating systems are vulnerable t...

Denial of Service Vulnerability in CSC-830 of Beijing Sifang Relay Automation Co. Ltd (CNVD-2020-59455)

CSC830 PLC is a compact controller for small and medium-sized discrete automation systems and stand-alone automation systems from Beijing Sifang Relay Automation Co. Beijing Sifang Relay Automation Co., Ltd CSC-830 has a denial of service vulnerability, which can be exploited by an attacker to...