CVE-2020-25094

LogRhythm Platform Manager 7.4.9 allows Command Injection. To exploit this, an attacker can inject arbitrary program names and arguments into a WebSocket. These are forwarded to any remote server with a LogRhythm Smart Response agent installed. By default, the commands are run with LocalSystem...

CVE-2020-25094

LogRhythm Platform Manager 7.4.9 allows Command Injection. To exploit this, an attacker can inject arbitrary program names and arguments into a WebSocket. These are forwarded to any remote server with a LogRhythm Smart Response agent installed. By default, the commands are run with LocalSystem...

CVE-2020-25187

Medtronic MyCareLink Smart 25000 is vulnerable when an authenticated attacker runs a debug command, which can be sent to the patient reader and cause a heap overflow event within the MCL Smart Patient Reader software stack. The heap overflow could allow an attacker to remotely execute code on the...

CVE-2020-27252

Medtronic MyCareLink Smart 25000 is vulnerable to a race condition in the MCL Smart Patient Reader software update system, which allows unsigned firmware to be uploaded and executed on the Patient Reader. If exploited, an attacker could remotely execute code on the MCL Smart Patient Reader device...

Design/Logic Flaw

Medtronic MyCareLink Smart 25000 all versions contain an authentication protocol vuln where the method used to auth between MCL Smart Patient Reader and MyCareLink Smart mobile app is vulnerable to bypass. This vuln allows attacker to use other mobile device or malicious app on smartphone to auth...

Design/Logic Flaw

Medtronic MyCareLink Smart 25000 all versions are vulnerable when an attacker who gains auth runs a debug command, which is sent to the reader causing heap overflow in the MCL Smart Reader stack. A heap overflow allows attacker to remotely execute code on the MCL Smart Reader, could lead to contr...

Race condition

Medtronic MyCareLink Smart 25000 all versions are vulnerable to a race condition in the MCL Smart Patient Reader software update system, which allows unsigned firmware to be uploaded and executed on the Patient Reader. If exploited an attacker could remotely execute code on the MCL Smart Patient...

CVE-2020-27252 Medtronic MyCareLink Smart Time-of-check Time-of-use Race Condition

Medtronic MyCareLink Smart 25000 is vulnerable to a race condition in the MCL Smart Patient Reader software update system, which allows unsigned firmware to be uploaded and executed on the Patient Reader. If exploited, an attacker could remotely execute code on the MCL Smart Patient Reader device...

CVE-2020-27252

CVE-2020-27252 affects Medtronic MyCareLink Smart 25000 Patient Reader. A race condition in the MCL Smart Patient Reader software update system can allow unsigned firmware to be uploaded and executed, potentially enabling remote code execution and control of the paired device. Mitigations documen...

CVE-2020-25187 Medtronic MyCareLink Smart Heap-based Buffer Overflow

Medtronic MyCareLink Smart 25000 is vulnerable when an authenticated attacker runs a debug command, which can be sent to the patient reader and cause a heap overflow event within the MCL Smart Patient Reader software stack. The heap overflow could allow an attacker to remotely execute code on the...

CVE-2020-25187

CVE-2020-25187 affects Medtronic MyCareLink Smart 25000 Patient Reader. The vulnerability is a heap-based buffer overflow in the MCL Smart Patient Reader software stack triggered when an authenticated attacker issues a debug command, potentially allowing remote code execution and device control. ...

CVE-2020-25183

CVE-2020-25183 affects Medtronic MyCareLink Smart 25000; root cause is an authentication bypass between the MCL Smart Patient Reader and the MyCareLink Smart mobile app (CWE-287). Impact is authenticated access within Bluetooth range, allowing an attacker on a nearby device to fool the reader int...

CVE-2020-25183 Medtronic MyCareLink Smart Improper Authentication

Medtronic MyCareLink Smart 25000 contains an authentication protocol vulnerability where the method used to authenticate between the MCL Smart Patient Reader and the Medtronic MyCareLink Smart mobile app is vulnerable to bypass. This vulnerability enables an attacker to use another mobile device ...

[SECURITY] Fedora 33 Update: opensc-0.21.0-1.fc33

OpenSC provides a set of libraries and utilities to work with smart cards. Its main focus is on cards that support cryptographic operations, and facilitate their use in security applications such as authentication, mail encryption and digital signatures. OpenSC implements the PKCS11 API so...

Fedora: Security Advisory for opensc (FEDORA-2020-7c80831ffe)

The remote host is missing an update for the Copyright C 2020 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

Cyber Monday is Every Monday: Securing the 'New Normal'

Derek Manky Though eCommerce threats are usually only top-of-mind during the holiday shopping season, researchers have been on high alert when it comes to cybercriminal activity in the retail space during all of 2020, due to troves of new shoppers and stores going online. That’s according to Dere...

Smart DNS: Delivering the Best Subscriber Experience

This is the second in a series of blog posts that discuss how smart DNS resolvers can enhance ongoing network transformation efforts such as the transition to 5G, better integration of Wi-Fi, and new network designs that optimize the edge to improve the subscriber experience, service delivery, an...

Smart DNS: Delivering the Best Subscriber Experience

The presence of public "over-the-top" DNS resolution alternatives is a strong motivator for internet service providers ISPs to invest in making their DNS resolution infrastructure the best that it can be. Resolvers are the glue that binds subscribers to their fixed and mobile broadband services...

Medtronic MyCareLink Smart Model 25000 Patient Reader Buffer Error Vulnerability

The Medtronic MyCareLink Smart Model 25000 Patient Reader is a reader used in the healthcare industry to visually interact with medical devices from Medtronic, Inc. The Medtronic MyCareLink Smart Model 25000 Patient Reader suffers from a buffer error vulnerability that stems from the susceptibili...

Unauthorized Access Vulnerability in Alcatel OAW Series Smart Wireless AP Devices

Alcatel-Lucent, a multinational company providing telecommunications hardware and software equipment and services, is headquartered in Paris, France. An unauthorized access vulnerability exists in the Alcatel OAW series of Smart Wireless AP devices, which can be exploited by an attacker to...