CUJO Smart Firewall mdnscap mDNS character-strings code execution vulnerability

Summary An exploitable heap overflow vulnerability exists in the mdnscap binary of the CUJO Smart Firewall running firmware 7003. The string lengths are handled incorrectly when parsing character strings in mDNS resource records, leading to arbitrary code execution in the context of the mdnscap...

Das U-Boot verified boot bypass

Summary An exploitable vulnerability exists in the verified boot protection of the Das U-Boot from version 2013.07-rc1 to 2014.07-rc2. The affected versions lack proper FIT signature enforcement, which allows an attacker to bypass U-Boot’s verified boot and execute an unsigned kernel, embedded in...

CUJO Smart Firewall mdnscap mDNS SRV record denial-of-service vulnerability

Summary An exploitable integer underflow vulnerability exists in the mdnscap binary of the CUJO Smart Firewall, version 7003. When parsing SRV records in an mDNS packet, the “RDLENGTH” value is handled incorrectly, leading to an out-of-bounds access that crashes the mdnscap process. An...

CVE-2019-6492

SmartDefragDriver.sys 2.0 in IObit Smart Defrag 6 never frees an executable kernel pool that is allocated with user defined bytes and size when IOCTL 0x9C401CC4 is called. This kernel pointer can be leaked if the kernel pool becomes a "big" pool...

CVE-2019-6492

CVE-2019-6492 affects IObit Smart Defrag 6, specifically SmartDefragDriver.sys (version 2.0). The issue: a kernel-pool allocation made with user-defined bytes/size via IOCTL 0x9C401CC4 is never freed, allowing a kernel-pointer leak if the pool grows large. This description is supported by Red Hat...

Privacy Regulations Needed for Next-Gen Cars

Driverless automobiles, long-haul trucks and military transport vehicles are on a fast track for wide deployment over the next five to 10 years. That much is clear. Vehicle manufacturers are all in, and innovation is racing forward. Meanwhile, captains of industry and political leaders are eager ...

Integer overflow

An Integer overflow vulnerability exists in the batchTransfer function of a smart contract implementation for CryptoBotsBattle CBTB, an Ethereum token. This vulnerability could be used by an attacker to create an arbitrary amount of tokens for any user...

CVE-2018-17882

Summary: CVE-2018-17882 concerns CryptoBotsBattle (CBTB), an Ethereum token. The flaw is an integer overflow in the smart contract’s batchTransfer function, enabling an attacker to create an arbitrary number of tokens for a user. Concrete details across connected sources confirm the affected comp...

CVE-2018-17882

An Integer overflow vulnerability exists in the batchTransfer function of a smart contract implementation for CryptoBotsBattle CBTB, an Ethereum token. This vulnerability could be used by an attacker to create an arbitrary amount of tokens for any user...

WordPress Smart Forms plugin <= 2.5.15 - Cross-Site Request Forgery (CSRF) vulnerability

Cross-Site Request Forgery CSRF vulnerability found by Toshiharu Sugiyama in WordPress Smart Forms plugin versions = 2.5.15. Solution Update the WordPress Smart Forms plugin to the latest available version at least 2.6.16...

CVE-2019-5924

Cross-site request forgery CSRF vulnerability in Smart Forms 2.6.15 and earlier allows remote attackers to hijack the authentication of administrators via a specially crafted page...

CVE-2019-5924

Cross-site request forgery CSRF vulnerability in Smart Forms 2.6.15 and earlier allows remote attackers to hijack the authentication of administrators via a specially crafted page...

Cross site request forgery (csrf)

Cross-site request forgery CSRF vulnerability in Smart Forms 2.6.15 and earlier allows remote attackers to hijack the authentication of administrators via a specially crafted page...

CVE-2019-5924

Cross-site request forgery CSRF vulnerability in Smart Forms 2.6.15 and earlier allows remote attackers to hijack the authentication of administrators via a specially crafted page...

CVE-2019-5924

The CVE-2019-5924 issue affects the WordPress Smart Forms plugin (versions 2.6.15 and earlier). The root cause is a Cross-Site Request Forgery (CSRF) vulnerability that can allow an attacker to hijack an administrator’s authenticated session via a malicious page, enabling unauthorized actions suc...

IoT-Home-Guard - A Tool For Malicious Behavior Detection In IoT Devices

IoT-Home-Guard is a project to help people discover malware in smart home devices. For users the project can help to detect compromised smart home devices. For security researchers it is also useful in network analysis and malicious hehaviors detection. In July 2018 we had completed the first...

PT-2019-17865 · Unknown · Smart Forms

Name of the Vulnerable Software and Affected Versions: Smart Forms versions 2.6.15 and earlier Description: A cross-site request forgery issue allows remote attackers to hijack the authentication of administrators via a specially crafted page. Recommendations: For versions 2.6.15 and earlier,...

Command execution vulnerability in the messagingagent module of Xiaoxi MINI smart speaker

Xiao Ai MINI Smart Speaker is an AI-based speaker that can be connected to the Internet. A command execution vulnerability exists in the messagingagent module of the Xiao-ai MINI smart speaker, which can be exploited by an attacker to remotely execute arbitrary commands to the device from the...

The vulnerability of the opensc authentication package for smart cards and system USB tokens in the Astra Linux operating system allows a hacker to trigger a service failure.

The vulnerability of the opensc authentication package for smart cards and operating system USB tokens in Astra Linux is related to incorrect operation of the Rutek S drivers. Exploiting this vulnerability can allow a hacker to cause service failure...

RSA Conference 2019: The Expanding Automation Platform Attack Surface

SAN FRANCISCO – Automation platforms are increasingly being used to chain multiple IoT devices together to create user-friendly smart applications – but that’s also creating unpredictable attack surfaces that can be hard to manage. A Trend Micro report released at RSA Conference 2019 warns that...