Vera Edge Home Controller Command Injection Vulnerability

Vera Edge Home Controller is a smart home central control unit. A command injection vulnerability exists in the cgi-bin/cmh/webcam.sh file in Vera Edge Home Controller version 1.7.4452, which can be exploited by an attacker to execute illegal commands...

CVE-2019-15498

cgi-bin/cmh/webcam.sh in Vera Edge Home Controller 1.7.4452 allows remote unauthenticated users to execute arbitrary OS commands via --output argument injection in the username parameter to /cgi-bin/cmh/webcam.sh...

Logic Flaw Vulnerability in the Security Authentication of a Dahua Webcam Model

Zhejiang Dahua Technology Co., Ltd, is a video-centered intelligent IOT solution provider and operation service provider. A logic flaw vulnerability exists in the security authentication of a Dahua webcam model, which allows an attacker to forge packets and call the interface to execute arbitrary...

Infinova Swann SWWHD-INTCAM-HD Trust Management Issues Vulnerability

The Infinova Swann SWWHD-INTCAM-HD is a webcam from Infinova USA. A vulnerability with trust management issues exists in the Infinova Swann SWWHD-INTCAM-HD device. The vulnerability stems from the lack of an effective trust management mechanism in the network system or product. An attacker can...

Zoom Client Webcam Denial of Service (CVE-2019-13449)

A denial of service vulnerability exists in Zoom Client Webcam. Successful exploitation of this vulnerability could result in denial of service conditions...

Zoom Video Conferencing for macOS Also Vulnerable to Critical RCE Flaw

The chaos and panic that the disclosure of privacy vulnerability in the highly popular and widely-used Zoom video conferencing software created earlier this week is not over yet. As suspected, it turns out that the core issue—a locally installed web server by the software—was not just allowing an...

Apple Issues Silent Update Removing Zoom's Hidden Server

Apple has pushed a silent update to Mac users that removes a hidden web server from Zoom users’ machines. The Zoom web- and video-conferencing service has come under scrutiny for its handling of a zero-day bug CVE-2019–13450 found by researcher Jonathan Leitschuh, which would allow an attacker to...

Zoom Pushes Emergency Patch for Webcam Hijack Flaw

After facing public outcry over its handling of a zero-day vulnerability in its collaboration client for Mac, the Zoom web- and video-conferencing service has rushed out an emergency patch. The flaw CVE-2019–13450, allows a malicious website to hijack a user’s web camera without their permission,...

Zoom Client Webcam Hijacking (CVE-2019-13450)

A Webcam Hijacking vulnerability exists in Zoom Client for macOS. A machine remains vulnerable if the Zoom Client was installed in the past and then uninstalled. A remote attacker can force a user to join a video call with the video camera active...

Zoom Client for Meetings 4.x < 4.4.53932.0709 Multiple Vulnerabilities (macOS)

The version of Zoom Client for Meetings installed on the remote macOS host is 4.x prior to 4.4.53932.0709. It is, therefore, affected by multiple vulnerabilities. - A denial of service vulnerability exists in Zoom due to an issue with the local webserver. An unauthenticated, remote attacker can...

Zoom Will Fix the Flaw That Let Hackers Hijack Webcams

While it at first dismissed the vulnerability, Zoom says it will release a patch Tuesday night...

A Zoom Flaw Gives Hackers Easy Access to Your Webcam

All it takes is one wrong click, and the popular video conferencing software will put you in a meeting with a stranger...

Flaw in Zoom Video Conferencing Software Lets Websites Hijack Mac Webcams

If you use Zoom video conferencing software on your Mac computer—then beware—any website you're visiting in your web browser can turn on your device camera without your permission. Ironically, even if you had ever installed the Zoom client on your device and simply uninstalled it, a remote attack...

Zoom Client Information Disclosure (Webcam) CVE-2019-13450

In the Zoom Client through 4.4.4 and RingCentral 7.0.136380.0312 on macOS, remote attackers can force a user to join a video call with the video camera active. This occurs because any web site can interact with the Zoom web server on localhost port 19421 or 19424. NOTE: a machine remains vulnerab...

Fedora Update for elementary-camera FEDORA-2019-27e7b92407

The remote host is missing an update for the SPDX-FileCopyrightText: 2019 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

[SECURITY] Fedora 29 Update: elementary-camera-1.0.4-2.fc29

Camera is a simple app to take photos with a webcam...

[SECURITY] Fedora 30 Update: elementary-camera-1.0.4-2.fc30

Camera is a simple app to take photos with a webcam...

Sophisticated 'TajMahal APT Framework' Remained Undetected for 5 Years

Cybersecurity researchers yesterday unveiled the existence of a highly sophisticated spyware framework that has been in operation for at least last 5 years—but remained undetected until recently. DubbedTajMahal by researchers at Kaspersky Lab, the APT framework is a high-tech modular-based malwar...

Meet ‘TajMahal,’ A New and Highly Advanced APT Framework

SINGAPORE – Researchers at Kaspersky Lab have discovered a new, highly sophisticated advanced persistent threat APT framework targeting a single Central Asian diplomatic agency. Malware samples associated with the APT reveal a complex never-before-seen code base, making it extremely hard to detec...

A week in security (November 26 – December 2)

Last week on Malwarebytes Labs, we took a look at our cybersecurity predictions for 2019, we explained why Malwarebytes participated in AV testing and how we took part in an joint take down of massive ad fraud botnets, warned that ESTA registration websites still lurk in paid ads on Google,...