We Be Jammin’ – Bypassing Chamberlain myQ Garage Doors

ARCHIVED STORY We Be Jammin’ – Bypassing Chamberlain myQ Garage Doors Sam Quinn · JAN 06, 2020 The idea of controlling your garage door remotely and verifying that everything is secure at home, or having packages delivered directly into your garage is enticing for many people. The convenience tha...

PT-2020-9806

Name of the Vulnerable Software and Affected Versions DTEN D5 and D7 versions prior to 1.3.4 Description The issue allows for firmware reflash and Android Debug Bridge adb enablement due to factory settings. Recommendations For DTEN D5 and D7 versions prior to 1.3.4, update to version 1.3.4 or...

Sql injection

The bindReplace function in the query factory in includes/classes/database.php in Loaded Commerce 7 does not properly handle : colon characters, which allows remote authenticated users to conduct SQL injection attacks via the First name and Last name fields in the address book...

CVE-2014-5140

CVE-2014-5140 affects Loaded Commerce 7. The vulnerability is in the bindReplace function of the query factory (includes/classes/database.php), which does not properly handle colon characters. This enables SQL injection via the First name and Last name fields in the address book when used by remo...

PT-2020-7709

Name of the Vulnerable Software and Affected Versions Loaded Commerce version 7 Description The issue concerns the bindReplace function in the query factory, which fails to properly handle colon characters. This allows remote authenticated users to conduct SQL injection attacks through the First...

CVE-2019-18898

UNIX Symbolic Link Symlink Following vulnerability in the trousers package of SUSE Linux Enterprise Server 15 SP1; openSUSE Factory allowed local attackers escalate privileges from user tss to root. This issue affects: SUSE Linux Enterprise Server 15 SP1 trousers versions prior to 0.3.14-6.3.1...

OSGi Apache Karaf XMLInputFactory Code Execution

The vulnerability of the XMLInputFactory class in the OSGi Apache Karaf container is related to an incorrect limitation on XML references to external objects. Exploiting this vulnerability allows a malicious actor to execute arbitrary code remotely...

Lousy IoT Security

DTEN makes smart screens and whiteboards for videoconferencing systems. Forescout found that their security is terrible: In total, our researchers discovered five vulnerabilities of four different kinds: Data exposure: PDF files of shared whiteboards e.g. meeting notes and other sensitive files...

Unspecified Vulnerability in Tecno Camon (CNVD-2020-14802)

The Tecno Camon is a Camon series smartphone from the Chinese company Transocean. An unspecified vulnerability exists in Tecno Camon. The vulnerability can be exploited to execute code or commands with system privileges to record the screen, restore factory settings, obtain the user's Wi-Fi...

Unspecified Vulnerability in Tecno Camon iClick (CNVD-2020-14790)

The Transn Tecno Camon iClick is a smartphone from the Chinese company Transn. An unspecified vulnerability exists in Tecno Camon iClick. The vulnerability can be exploited to execute code or commands with system privileges to record the screen, restore factory settings, obtain the user's Wi-Fi...

Unspecified Vulnerability in Tecno Camon iClick 2

The Transn Tecno Camon iClick 2 is a smartphone from the Chinese company Transn. An unspecified vulnerability exists in Tecno Camon iClick 2. The vulnerability can be exploited to execute code or commands with system privileges to record the screen, restore factory settings, obtain user's Wi-Fi...

Unspecified Vulnerability in Tecno Camon iClick (CNVD-2020-14789)

The Transn Tecno Camon iClick is a smartphone from the Chinese company Transn. An unspecified vulnerability exists in Tecno Camon iClick. The vulnerability can be exploited to execute code or commands with system privileges to record the screen, restore factory settings, obtain the user's Wi-Fi...

WAGO PFC200 iocheckd service "I/O-Check" factory restore denial-of-service vulnerability

WAGO PFC200 iocheckd service “I/O-Check” factory restore denial-of-service vulnerability Summary An exploitable denial-of-service vulnerability exists in the iocheckd service “I/O-Check” functionality of WAGO PFC 200. A single packet can cause a denial of service and weaken credentials resulting ...

Meet the Activists Risking Prison to Film VR in Factory Farms

This animal liberation group actually wants to be put on trial. Their goal: force jurors to wear VR headsets and immerse them in the suffering of animals bound for slaughter...

PT-2020-10911

Name of the Vulnerable Software and Affected Versions SUSE Linux Enterprise Server 15 munge versions prior to 0.5.13-4.3.1 openSUSE Factory munge versions prior to 0.5.13-6.1 Description A Symbolic Link Symlink Following issue in the packaging of munge allowed local attackers to escalate privileg...

Analysing the Attack Surface of an Industrial Data Acquisition Device

Introduction The Data Station Plus from Red Lion Controls was handed to me to analyse the attack surface. The device is designed to connect to SCADA data acquisition devices over Modbus, Profibus, etc. by Serial or Ethernet connection. Data is collected and recorded to a local compact flash card...

Unspecified Vulnerability in Kata M4s

Kata M4s is a smartphone. The com.mediatek.factorymode app in the Kata M4s build fingerprint: alps/fullhct675066n/hct675066n:7.0/NRD90M/1495624556:user/test-keys has a security vulnerability. An attacker could use this vulnerability to make unauthorized changes to wireless settings via other...

Unspecified Vulnerability in Doogee BL5000

Doogee BL5000 is a smartphone from Doogee, a Chinese company. A security vulnerability exists in the com.mediatek.factorymode app in the Doogee BL5000 build fingerprint: DOOGEE/BL5000/BL5000:7.0/NRD90M/1497072355:user/release-keys. An attacker could use this vulnerability to make unauthorized...

Unspecified Vulnerability in Bluboo Bluboo_S1

Bluboo BlubooS1 is a smartphone. The com.mediatek.factorymode app in Bluboo BlubooS1 build fingerprint: BLUBOO/BlubooS1/BlubooS1:7.0/NRD90M/1495809471:user/release-keys A security vulnerability exists. An attacker could use this vulnerability to make unauthorized changes to wireless settings via...

PT-2019-6102

Name of the Vulnerable Software and Affected Versions privoxy versions 3.0.28-lp151.1.1 and prior versions privoxy versions 3.0.28-2.1 and prior versions Description The issue is related to a UNIX Symbolic Link Symlink Following vulnerability in the packaging of privoxy on openSUSE Leap 15.1 and...