CVE-2020-3703

u'Buffer over-read issue in Bluetooth peripheral firmware due to lack of check for invalid opcode and length of opcode received from central deviceThis CVE is equivalent to Link Layer Length Overfow issue CVE-2019-16336,CVE-2019-17519 and Silent Length Overflow issueCVE-2019-17518 mentioned in...

CVE-2020-3693

u'Use out of range pointer issue can occur due to incorrect buffer range check during the execution of qseecom.' in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables in APQ8009, APQ8017,...

CVE-2020-3673

u'Buffer overflow can happen as part of SIP message packet processing while storing values in array due to lack of check to validate the index length' in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon...

CVE-2020-3654

CVE-2020-3654 is a buffer overflow in Qualcomm closed‑source components (Qualcomm/ Snapdragon) where SIP message processing fails to validate an index before copying data. The vulnerability is rated Critical (CVSS v3.1/10.0) with network access and no user interaction, implying potential remote c...

CVE-2020-11153

CVE-2020-11153 affects Qualcomm Snapdragon platforms (Auto, Compute, Connectivity, CEC, IOT, Mobile) including APQ8053, QCA6390/9379, QCN7605, SC8180X, SDX55. Root cause: out-of-bounds memory access while processing GATT data due to insufficient validation of PDU length. This can lead to remote c...

CVE-2020-11141

CVE-2020-11141 describes a buffer over-read in Bluetooth estack caused by a missing length check on the L2CAP configuration request from a peer. Affected are Qualcomm Snapdragon platforms (e.g., APQ8009, APQ8053, QCA6390, QCN7605, SM8250, and others across Snapdragon Auto/Compute/Connectivity/UIs...

California’s Prop 24 splits data privacy supporters

California’s data privacy house is divided. On the Golden State’s November ballot this year is the question as to whether to amend California’s barely-two-year-old data privacy law, the California Consumer Privacy Act. Far from the first attempt to change the fledgling law, Proposition 24 sets...

CVE-2020-27014

Trend Micro Antivirus for Mac 2020 (Consumer) is affected by a local race-condition vulnerability in the Web Threat Protection Blocklist. The flaw, exploitable by an attacker with high-privilege code execution, can trigger a kernel panic/crash (local privilege escalation via the KERedirect kext)....

CVE-2020-27015

CVE-2020-27015 affects Trend Micro Antivirus for Mac 2020 (Consumer). The flaw is an error message information disclosure in the KERedirect kext that can leak kernel pointers and debug messages to userland when an attacker already has high-privilege code execution locally. Exploitation is local a...

Lock and Code S1Ep18: Finding consumer value in Cybersecurity Awareness Month with Jamie Court

This week on Lock and Code, we discuss the top security headlines generated right here on Labs and around the Internet. In addition, we talk to Jamie Court, president of the non-profit advocacy group Consumer Watchdog, about the consumer value in Cybersecurity Awareness Month. Launched initially ...

CVE-2020-25778

Trend Micro Antivirus for Mac 2020 Consumer has a vulnerability in a specific kernel extension where an attacker could supply a kernel pointer and leak several bytes of memory. An attacker must first obtain the ability to execute high-privileged code on the target system in order to exploit this...

CVE-2020-25777

CVE-2020-25777 affects Trend Micro Antivirus for Mac 2020 (Consumer). A vulnerability in the kernel extension request flow allows bypassing the product's Web Threat Protection. The exploit requires user interaction (visiting a malicious page or opening a malicious file). The specific flaw is desc...

Fitbit Spyware Steals Personal Data via Watch Face

A wide-open app-building API would allow an attacker to build a malicious application that could access Fitbit user data, and send it to any server. Kev Breen, director of cyber threat research for Immersive Labs, created a proof-of-concept for just that scenario, after realizing that Fitbit...

Offering Users More For Their Activity - Similar Items Upon Checkout

The shopping isn't finished once you've purchased your item. If you've ever done shopping online, then you know all about being presented with related items to the one you just purchased. This feature is common for online retail websites and quite useful for both the consumer and the producers. I...

CVE-2020-25776

Trend Micro Antivirus for Mac 2020 (Consumer) has a local, privilege-escalation vulnerability (CVE-2020-25776) due to a symbolic link flaw in the iTISPlugin module. An attacker who can run low-privileged code could craft a symbolic link to escalate to root and access/modify protected files. The v...

CVE-2020-25775

CVE-2020-25775 affects Trend Micro Security 2020 (Consumer) and related products. Multiple connected sources describe a race condition in the Secure Erase feature that could let an unprivileged/local attacker delete files with higher privileges by abusing the feature’s file handling (vulnerabilit...

CVE-2020-15604

An incomplete SSL server certification validation vulnerability in the Trend Micro Security 2019 v15 consumer family of products could allow an attacker to combine this vulnerability with another attack to trick an affected client into downloading a malicious update instead of the expected one...

Design/Logic Flaw

An incomplete SSL server certification validation vulnerability in the Trend Micro Security 2019 v15 consumer family of products could allow an attacker to combine this vulnerability with another attack to trick an affected client into downloading a malicious update instead of the expected one...

CVE-2020-24560

The connected Red Hat, NVD, JVN and related records identify CVE-2020-24560 as an incomplete SSL server certificate validation vulnerability in Trend Micro Security 2019 (v15) consumer products. The issue arises in the update channel: an attacker could leverage improper server certificate verific...

CVE-2020-15604

An incomplete SSL server certification validation vulnerability in the Trend Micro Security 2019 v15 consumer family of products could allow an attacker to combine this vulnerability with another attack to trick an affected client into downloading a malicious update instead of the expected one...