Kernel: KVM: potential use-after-free via kvm_ioctl_create_device()

A use-after-free vulnerability was found in the way the Linux kernel's KVM hypervisor implements its device control API. While creating a device via kvmioctlcreatedevice, the device holds a reference to a VM object, later this reference is transferred to the caller's file descriptor table. If suc...

CVE-2019-6974

A use-after-free vulnerability was found in the way the Linux kernel's KVM hypervisor implements its device control API. While creating a device via kvmioctlcreatedevice, the device holds a reference to a VM object, later this reference is transferred to the caller's file descriptor table. If suc...

CVE-2019-19051

A flaw was found in the way the Linux kernel's WiMAX i2400 driver handled memory release in certain error codes path in the RF kill switch control function. A local attacker able to control the device could use this flaw to crash the system. Mitigation As the i2400m module will be auto-loaded whe...

CVE-2019-15344

The Tecno Camon iClick Android device with a build fingerprint of TECNO/H633/TECNO-IN6:8.1.0/O11019/A-180409V96:user/release-keys contains a pre-installed platform app with a package name of com.lovelyfont.defcontainer versionCode=7, versionName=7.0.8. This app contains an exported service named...

hw: Intel GPU Denial Of Service while accessing MMIO in lower power state

A flaw was found in Intel graphics hardware GPU where a local attacker with the ability to issue an ioctl could trigger a hardware level crash if MMIO registers were read while the graphics card was in a low-power state. This creates a denial of service situation and the GPU and connected display...

hw: Intel GPU Denial Of Service while accessing MMIO in lower power state

A flaw was found in Intel graphics hardware GPU where a local attacker with the ability to issue an ioctl could trigger a hardware level crash if MMIO registers were read while the graphics card was in a low-power state. This creates a denial of service situation and the GPU and connected display...

Communication Key Leakage Vulnerability in Jingdong Xiaojingyu Intelligent Platform

The Little Jingyu Intelligent Platform integrates the original Jingdong Alpha Platform and introduces Jingdong's artificial intelligence and big data capabilities, which not only focuses on the original smart hardware, smart home, and smart travel solutions, but also expands its IoT capabilities ...

Vulnerability of the driver /drivers/android/binder.c in the Android operating system, allowing a hacker to gain full control over the device

The vulnerability in the Android operating system’s driver/driver/binder.c code relates to the use of memory after it is freed. Exploiting this vulnerability can allow a hacker to gain full control over the device by using a specially created application...

Unauthorized access vulnerability in Xiaomi Mi Home Smart Platform

Xiaomi Mijia Intelligent Platform is Xiaomi's open platform for the IoT field, which can realize the interconnection of consumer smart hardware such as smart home devices, smart home appliances, smart wearable devices, smart travel devices and other consumer smart hardware. Xiaomi Mijia intellige...

The vulnerability in the virtual remote connection service for microprogramming control devices of the BMC Supermicro family allows a hacker to gain full control over the device.

The vulnerability of the virtual remote connection service for Microprogramming Software Control Devices of Supermicro is due to insufficient security restrictions for critical management functions. Exploiting this vulnerability allows a malicious actor to gain full control over the device by...

ASUS SmartHome Gateway HG100 Access Control Bypass Vulnerability

The ASUS SmartHome Gateway HG100 is a smart home central control gateway device. The ASUS SmartHome Gateway HG100 implementation suffers from a security vulnerability that allows a remote attacker can exploit the vulnerability to submit special requests that can bypass security restrictions and...

CVE-2019-11063

A broken access control vulnerability in SmartHome app Android versions up to 3.0.42190515, ios versions up to 2.0.22 allows an attacker in the same local area network to list user accounts and control IoT devices that connect with its gateway HG100 via http://target/smarthome/devicecontrol witho...

CVE-2019-5035

An exploitable information disclosure vulnerability exists in the Weave PASE pairing functionality of the Nest Cam IQ Indoor, version 4620002. A set of specially crafted weave packets can brute force a pairing code, resulting in greater Weave access and potentially full device control. An attacke...

CVE-2019-5035

An exploitable information disclosure vulnerability exists in the Weave PASE pairing functionality of the Nest Cam IQ Indoor, version 4620002. A set of specially crafted weave packets can brute force a pairing code, resulting in greater Weave access and potentially full device control. An attacke...

Information disclosure

An exploitable information disclosure vulnerability exists in the Weave PASE pairing functionality of the Nest Cam IQ Indoor, version 4620002. A set of specially crafted weave packets can brute force a pairing code, resulting in greater Weave access and potentially full device control. An attacke...

CVE-2017-8333

An issue was discovered on Securifi Almond, Almond+, and Almond 2015 devices with firmware AL-R096. The device provides a user with the capability of adding new routes to the device. It seems that the POST parameters passed in this request to set up routes on the device can be set in such a way...

Computrols CBAS Web Authentication Bypass Vulnerability

CBAS Web is a Web-based building management system BMS from Computrols. An authentication bypass vulnerability exists in Computrols CBAS Web. An unauthenticated attacker could use this vulnerability to bypass authentication and gain full control of the device...

Step 9. Protect your OS: top 10 actions to secure your environment

In “Step 9. Protect your OS” of the Top 10 actions to secure your environment blog series, we provide resources to help you configure Microsoft Defender Advanced Threat Protection Microsoft Defender ATP to defend your Windows, macOS, Linux, iOS, and Android devices from advanced threats. In an...

Use-After-Free

Linux kernel is vulnerable to use-after-free attacks. This is because the way the Linux kernel's KVM hypervisor implements its device control API While creating a device via kvmioctlcreatedevice. An attacker could use this flaw to crash the guest VM resulting in a denial of service issue or...

Three Common Questions (and Answers) About Next-Gen AV

Most organizations with traditional, or legacy, antivirus AV solutions are well aware that they are no longer protected from the more advanced tactics and threats of attackers today. Signatures just can’t keep up with emerging threats. But that doesn’t mean that everyone is ready to dive head fir...