1881 matches found
PT-2020-8645
Name of the Vulnerable Software and Affected Versions: Neato Botvac Connected version 2.2.0 Description: An issue was discovered in the Neato Botvac Connected. The GenerateRobotPassword function of the NeatoCrypto library generates insufficiently random numbers for robot secret key values used fo...
Business in the front, party in the back: backdoors in elastic servers expose private data
It seems like every day we read another article about a data breach or leak of cloud storage exposing millions of users' data. The unfortunate truth is that the majority of these leaks require no actual "hacking" on the part of the attacker. Most of the time, this highly confidential data is just...
Xiaomi Cameras Connected to Google Nest Expose Video Feeds From Others
Internet-connected devices have been one of the most remarkable developments that have happened to humankind in the last decade. Although this development is a good thing, it also stipulates a high security and privacy risk to personal information. In one such recent privacy mishap, smart IP...
You’re In Safe Hands with Trend Micro Home Network Security
A three-part series on using Home Network Security to protect your home Your home should be a haven that protects you. In the cyber age, however, your router, computers, and TVs, your game consoles and smart devices, are continuously connected to the internet and run the risk of being...
Think Twice Before Giving Gifts With a Microphone or Camera
Black Friday is going to be overrun with cheap, internet-connected gifts. Just make sure you know exactly what you’re buying...
DDoS-for-Hire Boss Gets 13 Months Jail Time
A 21-year-old Illinois man was sentenced last week to 13 months in prison for running multiple DDoS-for-hire services that launched millions of attacks over several years. This individual's sentencing comes more than five years after KrebsOnSecurity interviewed both the defendant and his father a...
SYS.2.2.3.A25
Ziel des Bausteins SYS.2.2.3 ist der Schutz von Informationen, die durch und auf Windows 10-Clients verarbeiten werden. Die Standard-Anforderung SPDX-FileCopyrightText: 2019 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective rig...
Authentication flaw
On Signify Philips Taolight Smart Wi-Fi Wiz Connected LED Bulb 9290022656 devices, an unprotected API lets remote users control the bulb's operation. Anyone can turn the bulb on or off, or change its color or brightness remotely. There is no authentication or encryption to use the control API. Th...
CVE-2019-18980
The CVE describes an authentication-less control API on Signify Philips Taolight Smart Wi‑Fi Wiz Connected LED Bulb 9290022656. A remote attacker with network access can operate the bulb: turn it on/off, adjust color, or change brightness, due to no authentication or encryption on the control API...
PT-2019-15737
Name of the Vulnerable Software and Affected Versions Signify Philips Taolight Smart Wi-Fi Wiz Connected LED Bulb version 9290022656 Description The issue allows remote users to control the bulb's operation due to an unprotected API. This enables anyone with network access to the bulb to turn it ...
CVE-2019-18980: Missing Authentication for Critical Function
On Signify Philips Taolight Smart Wi-Fi Wiz Connected LED Bulb 9290022656 devices, an unprotected API lets remote users control the bulb's operation. Anyone can turn the bulb on or off, or change its color or brightness remotely. There is no authentication or encryption to use the control API. Th...
IoT Security Woes Plague Healthcare Industry
LAS VEGAS – More hospitals are adopting internet of things IoT devices, from wearables to smart insulin pens. But neither hospitals nor the device manufacturers themselves are ready to address the onslaught of security and privacy challenges that come with medical connected devices. At least 82...
CVE-2019-17524
An XSS vulnerability on Technicolor TC7300 STFA.51.20 devices allows remote attackers to inject arbitrary web script via the "Connected Clients" field to /wlanAccess.asp. An intranet host can use a crafted hostname to exploit this...
CVE-2019-17524
An XSS vulnerability on Technicolor TC7300 STFA.51.20 devices allows remote attackers to inject arbitrary web script via the "Connected Clients" field to /wlanAccess.asp. An intranet host can use a crafted hostname to exploit this...
Cross site scripting
An XSS vulnerability on Technicolor TC7300 STFA.51.20 devices allows remote attackers to inject arbitrary web script via the "Connected Clients" field to /wlanAccess.asp. An intranet host can use a crafted hostname to exploit this...
CVE-2019-17524
An XSS vulnerability on Technicolor TC7300 STFA.51.20 devices allows remote attackers to inject arbitrary web script via the "Connected Clients" field to /wlanAccess.asp. An intranet host can use a crafted hostname to exploit this...
PT-2019-15184
Name of the Vulnerable Software and Affected Versions Technicolor TC7300 version STFA.51.20 Description The issue allows remote attackers to inject arbitrary web script via the "Connected Clients" field to the "/wlanAccess.asp" API endpoint. This can be exploited by an intranet host using a craft...
Rockwellautomation Connected Uncontrolled Search Path Element
A DLL Hijack issue was discovered in Rockwell Automation Connected Components Workbench CCW. The following versions are affected: Connected Components Workbench - Developer Edition, v9.01.00 and earlier: 9328-CCWDEVENE, 9328-CCWDEVZHE, 9328-CCWDEVFRE, 9328-CCWDEVITE, 9328-CCWDEVDEE, 9328-CCWDEVES...
IoT security will set innovation free: Azure Sphere general availability scheduled for February 2020
Today, at the IoT Solutions World Congress, we announced that Azure Sphere will be generally available in February of 2020. General availability will mark our readiness to fulfill our security promise at scale, and to put the power of Microsoft’s expertise to work for our customers every day—by...
