CVE-2021-31428

This vulnerability allows local attackers to escalate privileges on affected installations of Parallels Desktop 15.1.5-47309. An attacker must first obtain the ability to execute high-privileged code on the target guest system in order to exploit this vulnerability. The specific flaw exists withi...

CVE-2022-25724

Memory corruption in graphics due to buffer overflow while validating the user address in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables...

CVE-2024-36558

Forever KidsWatch Call Me KW-50 R36YDRA3PWGM7SV1.02019071516.19.24cobh suffers from Cleartext Transmission of Sensitive Information due to lack of encryption in device-server communication...

CVE-2022-22522

In Carlo Gavazzi UWP3.0 in multiple versions and CPY Car Park Server in Version 2.8.3 a remote, unauthenticated attacker could make use of hard-coded credentials to gain full access to the device...

CVE-2020-8913

A local, arbitrary code execution vulnerability exists in the SplitCompat.install endpoint in Android's Play Core Library versions prior to 1.7.2. A malicious attacker could create an apk which targets a specific application, and if a victim were to install this apk, the attacker could perform a...

The vulnerability of the microprogrammed software of the CMS8000 Patient Monitor and Epsimed MN-120 medical devices lies in the fact that they send requests to a rigidly encoded external IP address. This allows attackers to circumvent security restrictions and upload or re-upload files onto the devices.

The vulnerability of the microprogrammed software in medical monitoring devices such as CMS8000 Patient Monitor and Epsimed MN-120 lies in the fact that requests are sent to a rigidly encoded external IP address. Exploiting this vulnerability allows an attacker to bypass security restrictions and...

CVE-2024-53943

An issue was discovered in NRadio N8-180 NROS-1.9.2.n3.c5 devices. The /cgi-bin/luci/nradio/basic/radio endpoint is vulnerable to XSS via the 2.4 GHz and 5 GHz name parameters, allowing an attacker to execute JavaScript within the context of the current user by injecting JavaScript into the SSID...

How Garmin watches reveal your personal data, and what you can do

TL;DR A walk-through of obtaining sensitive data from a Garmin watch using forensic techniques How digital forensics on a Garmin watch helped solve a double murder case A comparison of Garmin's privacy with other brands including Fitbit, Apple, and Samsung Understand the security and privacy...

Android's New Identity Check Feature Locks Device Settings Outside Trusted Locations

Google has launched a new feature called Identity Check for supported Android devices that locks sensitive settings behind biometric authentication when outside of trusted locations. "When you turn on Identity Check, your device will require explicit biometric authentication to access certain...

CVE-2024-43098

CVE-2024-43098 is a Linux kernel issue in the i3c subsystem where a deadlock may occur due to double acquisition of i3cbus->lock during i3c_master_register() and related operations. The root cause is calling i3c_device_get_info() (and also i3c_device_info()) instead of using i3cdev->desc-&g...

CVE-2021-26278

The wifi module exposes the interface and has improper permission control, leaking sensitive information about the device...

CVE-2024-54485

CVE-2024-54485 affects Apple iOS/iPadOS where a user’s lock-screen notifications could be viewed by an attacker with physical access. The issue is mitigated by updates: iPadOS 17.7.3, iOS 18.2, and iPadOS 18.2 fix the flaw by adding additional logic to prevent lock-screen notification content exp...

CVE-2024-28140 Violation of Least Privilege Principle

The scanner device boots into a kiosk mode by default and opens the Scan2Net interface in a browser window. This browser is run with the permissions of the root user. There are also several other applications running as root user. This can be confirmed by running "ps aux" as the root user and...

CVE-2024-34162

The web interface of the affected devices is designed to hide the LDAP credentials even for administrative users. But configuring LDAP authentication to "SIMPLE", the device communicates with the LDAP server in clear-text. The LDAP password can be retrieved from this clear-text communication. As...

CVE-2024-28955

Affected devices create coredump files when crashed, storing them with world-readable permission. Any local user of the device can examine the coredump files, and research the memory contents. As for the details of affected product names, model numbers, and versions, refer to the information...

CVE-2024-8360

Visteon Infotainment REFLASHDDUExtractFile Command Injection Remote Code Execution Vulnerability. This vulnerability allows physically present attackers to execute arbitrary code on affected installations of Visteon Infotainment systems. Authentication is not required to exploit this vulnerabilit...

CVE-2024-11120

CVE-2024-11120 is a pre-auth OS Command Injection affecting certain GeoVision EOL devices. Unauthenticated remote attackers can inject/execute commands, with active exploitation observed in the wild (Mirai-related activity via the /DateSetting.cgi endpoint and szSrvIpAddr parameter). Mitigations ...

CVE-2019-20472

An issue was discovered on One2Track 2019-12-08 devices. Any SIM card used with the device cannot have a PIN configured. If a PIN is configured, the device simply produces a "Remove PIN and restart!" message, and cannot be used. This makes it easier for an attacker to use the SIM card by stealing...

CVE-2024-48955

Broken access control in NetAdmin 4.030319 returns data with functionalities on the endpoint that "assembles" the functionalities menus, the return of this call is not encrypted and as the system does not validate the session authorization, an attacker can copy the content of the browser of a use...

Eliminating AI Deepfake Threats: Is Your Identity Security AI-Proof?

Artificial Intelligence AI has rapidly evolved from a futuristic concept to a potent weapon in the hands of bad actors. Today, AI-based attacks are not just theoretical threats—they're happening across industries and outpacing traditional defense mechanisms. The solution, however, is not...