CVE-2018-16272

The wpasupplicant system service in Samsung Galaxy Gear series allows an unprivileged process to fully control the Wi-Fi interface, due to the lack of its D-Bus security policy configurations. This affects Tizen-based firmwares including Samsung Galaxy Gear series before build RE2...

CVE-2018-16272

The CVE-2018-16272 issue affects the wpa_supplicant system service in Samsung Galaxy Gear devices running Tizen. The root cause is missing D-Bus security policy configurations, which allows an unprivileged process to fully control the Wi‑Fi interface on affected firmwares (Galaxy Gear series befo...

CVE-2018-16271

The wemailconsumerservice from the built-in application wemail in Samsung Galaxy Gear series allows an unprivileged process to manipulate a user's mailbox, due to improper D-Bus security policy configurations. An arbitrary email can also be sent from the mailbox via the paired smartphone. This...

CVE-2018-16271

CVE-2018-16271 concerns the wemail_consumer_service in Samsung Galaxy Gear series (Tizen-based firmwares) prior to build RE2. The vulnerability arises from improper D-Bus security policy configurations, enabling an unprivileged process to manipulate a user’s mailbox. Additionally, an arbitrary em...

CVE-2018-16270

The CVE concerns Samsung Galaxy Gear series prior to build RE2, where the hcidump utility lacks privilege/permission restrictions. The vulnerability allows an unprivileged process to dump Bluetooth HCI packets to an arbitrary file path, indicating exposure of sensitive Bluetooth data. The provide...

CVE-2018-16270

Samsung Galaxy Gear series before build RE2 includes the hcidump utility with no privilege or permission restriction. This allows an unprivileged process to dump Bluetooth HCI packets to an arbitrary file path...

CVE-2018-16269

CVE-2018-16269 affects the wnoti system service on Samsung Galaxy Gear (Tizen-based) before build RE2. The root cause is improper D‑Bus security policy configurations that allow an unprivileged process to take over internal notification message data. Affected scope is Tizen firmwares for Galaxy G...

CVE-2018-16268

The SoundServer/FocusServer system services in Tizen allow an unprivileged process to perform media-related system actions, due to improper D-Bus security policy configurations. Such actions include playing an arbitrary sound file or DTMF tones. This affects Tizen before 5.0 M1, and Tizen-based...

CVE-2018-16267

The system-popup system service in Tizen allows an unprivileged process to perform popup-related system actions, due to improper D-Bus security policy configurations. Such actions include the triggering system poweroff menu, and prompting a popup with arbitrary strings. This affects Tizen before...

CVE-2018-16267

The CVE affects Tizen’s system-popup service, where an unprivileged process can trigger popup actions and the power-off menu due to insecure D-Bus policy configurations. Affected versions include Tizen before 5.0 M1 and Tizen-based devices (e.g., Samsung Galaxy Gear series) before build RE2. Root...

CVE-2018-16265

The bt/btcore system service in Tizen allows an unprivileged process to create a system user interface and control the Bluetooth pairing process, due to improper D-Bus security policy configurations. This affects Tizen before 5.0 M1, and Tizen-based firmwares including Samsung Galaxy Gear series...

CVE-2018-16263

The CVE-2018-16263 entry concerns the PulseAudio system service on Tizen. The vulnerability arises from improper D-Bus security policy configurations that allow an unprivileged process to control the A2DP MediaEndpoint. Affected products include Tizen releases before 5.0 M1 and Tizen-based firmwa...

CVE-2018-16263

The PulseAudio system service in Tizen allows an unprivileged process to control its A2DP MediaEndpoint, due to improper D-Bus security policy configurations. This affects Tizen before 5.0 M1, and Tizen-based firmwares including Samsung Galaxy Gear series before build RE2...

CVE-2018-16262

The pkgmgr system service in Tizen allows an unprivileged process to perform package management actions, due to improper D-Bus security policy configurations. Such actions include installing, decrypting, and killing other packages. This affects Tizen before 5.0 M1, and Tizen-based firmwares...

CVE-2018-16262

The CVE-2018-16262 issue affects Tizen’s pkgmgr system service where an unprivileged process can perform package management actions due to improper D-Bus security policy configurations. This can enable installing, decrypting, or killing other packages. Affected platforms include Tizen up to 5.0 M...

CVE-2018-16266

The Enlightenment system service in Tizen allows an unprivileged process to fully control or capture windows, due to improper D-Bus security policy configurations. This affects Tizen before 5.0 M1, and Tizen-based firmwares including Samsung Galaxy Gear series before build RE2...

CVE-2018-16266

The CVE-2018-16266 issue affects the Enlightenment system service in Tizen, where improper D-Bus security policy configurations allow an unprivileged process to fully control or capture windows. Affected: Tizen before 5.0 M1 and Tizen-based firmwares (e.g., Samsung Galaxy Gear) before build RE2. ...

GoAhead 2.5.0 - Host Header Injection

Exploit Title: GoAhead Web server HTTP Header Injection. Shodan Query: Server: Goahead Discovered Date: 05/07/2019 Exploit Author: Ramikan Vendor Homepage: https://www.embedthis.com/goahead/ Affected Version: 2.5.0 may be others. Tested On Version: 2.5.0 in Cisco Switches and Net Gear routers...

Cisco Extends Patch for IPv6 DoS Vulnerability

Cisco has extended its patch for a high-severity IPv6 denial-of-service DoS vulnerability that was first addressed in 2016. The bug CVE-2016-1409 is a vulnerability in the IPv6 packet processing functions of multiple Cisco products, which could allow an unauthenticated, remote attacker to cause a...

'URGENT/11' Critical Infrastructure Bugs Threaten EternalBlue-Style Attacks

UPDATE A cadre of 11 vulnerabilities, six of them critical remote code-execution RCE bugs, have been uncovered that affect millions of critical infrastructure systems, such as SCADA gear at utilities, elevator and industrial controllers, patient monitors and MRI machines, programmable logic...