CVE-2017-18124

CVE-2017-18124 : The description in the linked sources states that during secure boot an addition is performed on uint8 pointers, causing an overflow. This affects a broad set of Qualcomm/Snapdragon devices (e.g., FSM9055, IPQ4019, MDM9xxx, MSM/SDA/XOA families and many SD series SKUs). The conne...

CVE-2017-18294

While reading file class type from ELF header, a buffer overread may happen if the ELF file size is less than the size of ELF64 header size in Small Cell SoC, Snapdragon Automobile, Snapdragon Mobile, Snapdragon Wear in version FSM9055, MDM9206, MDM9607, MDM9650, MSM8909W, MSM8996AU, SD 210/SD...

Design/Logic Flaw

While reading file class type from ELF header, a buffer overread may happen if the ELF file size is less than the size of ELF64 header size in Small Cell SoC, Snapdragon Automobile, Snapdragon Mobile, Snapdragon Wear in version FSM9055, MDM9206, MDM9607, MDM9650, MSM8909W, MSM8996AU, SD 210/SD...

Default credentials

Insufficient memory allocation in boot due to incorrect size being passed could result in out of bounds access in Small Cell SoC, Snapdragon Automobile, Snapdragon Mobile and Snapdragon Wear in version FSM9055, MDM9206, MDM9607, MDM9640, MDM9650, MSM8909W, MSM8996AU, SD 210/SD 212/SD 205, SD 425,...

CVE-2017-18304

CVE-2017-18304 involves Insufficient memory allocation in boot due to an incorrect size being passed, causing out-of-bounds access. The affected devices span Qualcomm Snapdragon-family platforms and SoCs, including Small Cell SoC, Snapdragon Automobile, Snapdragon Mobile, and Snapdragon Wear acro...

CVE-2017-18294

While reading file class type from ELF header, a buffer overread may happen if the ELF file size is less than the size of ELF64 header size in Small Cell SoC, Snapdragon Automobile, Snapdragon Mobile, Snapdragon Wear in version FSM9055, MDM9206, MDM9607, MDM9650, MSM8909W, MSM8996AU, SD 210/SD...

CVE-2017-18294

CVE-2017-18294 describes a buffer overread when reading the ELF header file class type on Qualcomm closed‑source components (e.g., SoCs in Snapdragon/SD lines). The root cause is a size check mismatch where the ELF file size is less than the ELF64 header, potentially enabling local code execution...

Forging a Relationship With Tyler Barriss, the Internet’s Most Hated Swatter

Journalist Brendan Koerner strikes up a jail-cell correspondence with a man charged with instigating a fatal shooting. “Only by peering into the abyss of human malice can we divine how we can muster the strength to forgive the truly lost," he writes...

Code injection

In Small Cell SoC and Snapdragon Automobile, Mobile, Wear in version FSM9055, FSM9955, MDM9607, MDM9640, MDM9650, MSM8909W, SD 425, SD 427, SD 430, SD 435, SD 450, SD 617, SD 625, SD 650/52, SD 820, SD 820A, SD 835, SD 845, SDM630, SDM636, SDM660, SDX20, SnapdragonHighMed2016, providing the NULL...

CVE-2017-18301

In Small Cell SoC and Snapdragon Automobile, Mobile, Wear in version FSM9055, FSM9955, MDM9607, MDM9640, MDM9650, MSM8909W, SD 425, SD 427, SD 430, SD 435, SD 450, SD 617, SD 625, SD 650/52, SD 820, SD 820A, SD 835, SD 845, SDM630, SDM636, SDM660, SDX20, SnapdragonHighMed2016, providing the NULL...

CVE-2017-18301

CVE-2017-18301 concerns Qualcomm/ Snapdragon components used in Small Cell SoC and Snapdragon devices (Automobile, Mobile, Wear) including FSM9055, FSM9955, MDM9607, MDM9640, MDM9650, MSM8909W, SD 425/427/430/435/450, SD 617/625/650/52, SD 820/820A, SD 835, SD 845, SDM630/636/660, SDX20, Snapdrag...

CVE-2017-18301

In Small Cell SoC and Snapdragon Automobile, Mobile, Wear in version FSM9055, FSM9955, MDM9607, MDM9640, MDM9650, MSM8909W, SD 425, SD 427, SD 430, SD 435, SD 450, SD 617, SD 625, SD 650/52, SD 820, SD 820A, SD 835, SD 845, SDM630, SDM636, SDM660, SDX20, SnapdragonHighMed2016, providing the NULL...

exceljs cross-site scripting vulnerability

exceljs is a software package for reading, manipulating and writing spreadsheet data and styles. A cross-site scripting vulnerability exists in versions of exceljs prior to 1.6. A remote attacker can exploit this vulnerability to execute JavaScript code embedded in an XLS worksheet with the help ...

CVE-2018-16459

An unescaped payload in exceljs v1.6 allows a possible XSS via cell value when worksheet is displayed in browser...

CVE-2018-16459

An unescaped payload in exceljs v1.6 allows a possible XSS via cell value when worksheet is displayed in browser...

Cell-Site surveillance devices (Stingray) could disrupt 911 emergency calls

By Uzair Amir Senator Ron Wyden of Oregon has made startling new revelations about CSS or cell-site stimulators. These cell surveillance devices, better known as Stingray, are used to disrupt communications of cell phones, mostly of criminals and lawbreakers. However, Sen. Wyden asserts that the...

Supreme Court: Police Need Warrant for Mobile Location Data

The U.S. Supreme Court today ruled that the government needs to obtain a court-ordered warrant to gather location data on mobile device users. The decision is a major development for privacy rights, but experts say it may have limited bearing on the selling of real-time customer location data by...

Siemens SCALANCE X Switches, RUGGEDCOM WiMAX, RFID 181-EIP, and SIMATIC RF182C (Update D)

1. EXECUTIVE SUMMARY CVSS v3 7.5 ATTENTION: Exploitable from the same local network segment OSI Layer 2 Vendor: Siemens Equipment: SCALANCE X switches, RUGGEDCOM Win, RFID 181-EIP, and SIMATIC RF182C Vulnerability: Heap-based Buffer Overflow 2. UPDATE INFORMATION This updated advisory is a...

Cloud Foundry Diego Privilege Gain Vulnerability

Cloud Foundry Diego is a container management system used in the Cloud Foundry cloud computing platform from the Cloud Foundry Foundation in the United States. A security vulnerability exists in Cloud Foundry Diego versions prior to 2.8.0, which stems from the program's failure to properly filter...

CVE-2018-1265

Cloud Foundry Diego, release versions prior to 2.8.0, does not properly sanitize file paths in tar and zip files headers. A remote attacker with CF admin privileges can upload a malicious buildpack that will allow a complete takeover of a Diego Cell VM and access to all apps running on that Diego...