9313 matches found
CVE-2020-24219
An issue was discovered on URayTech IPTV/H.264/H.265 video encoders through 1.97. Attackers can send crafted unauthenticated HTTP requests to exploit path traversal and pattern-matching programming flaws, and retrieve any file from the device's file system, including the configuration file with t...
Smart male chastity lock cock-up
TL;DR Smart Bluetooth male chastity lock, designed for user to give remote control to a trusted 3rd party using mobile app/API Multiple API flaws meant anyone could remotely lock all devices and prevent users from releasing themselves Removal then requires an angle grinder or similar, used in clo...
PT-2020-15664
Name of the Vulnerable Software and Affected Versions URayTech IPTV/H.264/H.265 video encoders versions through 1.97 Description An issue allows attackers to send crafted unauthenticated HTTP requests to exploit path traversal and pattern-matching programming flaws. This enables retrieval of any...
Critical Flaws Discovered in Popular Industrial Remote Access Systems
Cybersecurity researchers have found critical security flaws in two popular industrial remote access systems that can be exploited to ban access to industrial production floors, hack into company networks, tamper with data, and even steal sensitive business secrets. The flaws, discovered by Tel...
Critical Flaws Discovered in Popular Industrial Remote Access Systems
Cybersecurity researchers have found critical security flaws in two popular industrial remote access systems that can be exploited to ban access to industrial production floors, hack into company networks, tamper with data, and even steal sensitive business secrets. The flaws, discovered by Tel...
The vulnerability of NSS libraries, related to deficiencies in the cryptographic algorithms used, allows attackers to gain access to confidential data.
The vulnerability of NSS libraries is related to deficiencies in the cryptographic algorithms used. Exploiting this vulnerability allows an attacker to gain access to confidential data...
webkitgtk: Multiple memory corruption issues leading to arbitrary code execution
Multiple memory corruption issues were addressed with improved memory handling. This issue is fixed in iOS 12.3, macOS Mojave 10.14.5, tvOS 12.3, Safari 12.1.1, iTunes for Windows 12.9.5, iCloud for Windows 7.12. Processing maliciously crafted web content may lead to arbitrary code execution...
The vulnerability of Intel Active Management Technology and Standard Manageability implementations lies in the possibility of operations exceeding the buffer boundaries in memory, allowing attackers to exploit their privileges.
The vulnerability of Intel Active Management Technology and Standard Manageability implementations lies in the execution of operations beyond the buffer boundaries in memory. Exploiting this vulnerability can allow a remote attacker to gain increased privileges...
White hat hacker infects smart coffee machine with ransowmare
By Waqas Avast security researcher reverse-engineered an IoT coffee machine to upload ransomware and mine Monero coin. Smart appliances have always remained a risky option for consumers, specifically when it comes to coffee machines. Back in 2015, Pen Test Partners researchers discovered security...
USN-4547-1 italc vulnerabilities
It was discovered that an information disclosure vulnerability existed in the LibVNCServer vendored in iTALC when sending a ServerCutText message. An attacker could possibly use this issue to expose sensitive information. CVE-2019-15681 It was discovered that the LibVNCServer and LibVNCClient...
This Week in Security News: Cybercriminals Distribute Backdoor with VPN Installer and New ‘Alien’ Malware can Steal Passwords from 226 Android Apps
Welcome to our weekly roundup, where we share what you need to know about the cybersecurity news and events that happened over the past few days. This week, learn about how threat actors are bundling Windscribe VPN installers with backdoors. Also, read about a new strain of Android malware that...
USN-4527-1 linux, linux-aws, linux-kvm, linux-lts-xenial, linux-raspi2, linux-snapdragon vulnerabilities
It was discovered that the Conexant 23885 TV card device driver for the Linux kernel did not properly deallocate memory in some error conditions. A local attacker could use this to cause a denial of service memory exhaustion. CVE-2019-19054 It was discovered that the Atheros HTC based wireless...
The vulnerabilities of Trend Micro Vulnerability Protection and Trend Micro Deep Security Manager, related to authentication deficiencies, allow attackers to enhance their privileges.
The vulnerabilities of Trend Micro Vulnerability Protection and Trend Micro Deep Security Manager are related to authentication deficiencies. Exploiting these vulnerabilities can allow attackers, operating remotely, to increase their privileges...
The vulnerability of the management tools for virtual infrastructure, such as VMware vCenter Server and VMware ESXi hypervisor, related to authentication deficiencies, allows attackers to cause partial service interruptions.
The vulnerability of the virtual infrastructure management tools VMware vCenter Server and VMware ESXi hypervisor is related to authentication deficiencies. Exploiting this vulnerability can allow a malicious actor to cause partial service disruption from a remote location...
The vulnerability of the group policy update mechanism in the Windows operating system allows a perpetrator to increase their privileges.
The vulnerability of the group policy update mechanism in the Windows operating system is related to deficiencies in access control. Exploiting this vulnerability can allow a malicious actor to enhance their privileges remotely...
The vulnerability of the dnsrslvr.dll library in the Windows operating system allows a hacker to increase their privileges.
The vulnerability of the dnsrslvr.dll library in the Windows operating system is related to errors in memory object handling. Exploiting this vulnerability can allow an attacker to enhance their privileges through a specially created application...
The vulnerability of the Workbench search system of Oracle Commerce Guided Search and the Oracle Commerce Experience Manager, a tool for managing the user environment, allows an attacker to gain access to modify, add, or delete data, or to unauthorizedly access protected information.
The vulnerability of the Workbench search engine component of Oracle Commerce Guided Search and the Oracle Commerce Experience Manager user environment management tool exists due to insufficient validation of input data. Exploiting this vulnerability may allow an attacker, operating remotely, to...
The vulnerability of the Security component of the Oracle AutoVue data visualization application allows a perpetrator to gain access to modify, add, or delete data.
The vulnerability of the Security component of the Oracle AutoVue data visualization application is related to deficiencies in access control. Exploiting this vulnerability could allow a malicious actor, operating remotely, to gain access to modify, add, or delete data using the HTTP protocol...
The vulnerability of the SWSE Server component of the Siebel UI Framework allows a perpetrator to gain access to modify, add, or delete data, or to unauthorizedly access protected information.
The vulnerability of the SWSE Server component of the Siebel UI Framework is related to deficiencies in access control. Exploiting this vulnerability could allow an attacker, operating remotely, to modify, add, or delete data, or to gain unauthorized access to protected information using the HTTP...
The vulnerability of the Oracle Security Service software, which arises due to insufficient validation of input data, allows a perpetrator to gain unauthorized access to protected information.
The vulnerability of the Oracle Security Service software exists due to insufficient validation of input data. Exploiting this vulnerability can allow a malicious actor, operating remotely, to gain unauthorized access to protected information using the HTTPS protocol...