CVE-2020-11256

CVE-2020-11256 concerns memory corruption caused by lack of validation of a pointer to a buffer passed to TrustZone in Snapdragon Wired Infrastructure and Networking. The vulnerability is described across multiple sources as affecting the TrustZone interface on Qualcomm Snapdragon platforms, with...

CVE-2020-11257

CVE-2020-11257 affects Qualcomm Snapdragon platforms, specifically the TrustZone BSP in Snapdragon Wired Infrastructure and Networking. The root cause is memory corruption due to lack of validation of pointer arguments passed to the TrustZone BSP. CVSS data indicates a high-severity, local-attack...

CVE-2020-11256

Memory corruption due to lack of check of validation of pointer to buffer passed to trustzone in Snapdragon Wired Infrastructure and Networking...

CVE-2020-11257

Memory corruption due to lack of validation of pointer arguments passed to TrustZone BSP in Snapdragon Wired Infrastructure and Networking...

CVE-2020-11250

CVE-2020-11250 is a use-after-free vulnerability caused by a race condition when reopening a Snapdragon device driver repeatedly across Snapdragon Auto/Compute/Connectivity/Consumer IoT/Industrial IoT/Mobile/Voice & Music/Wearables/Wired Infrastructure and Networking. Affects Qualcomm components ...

CVE-2020-11238

Possible Buffer over-read in ARP/NS parsing due to lack of check of packet length received in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer Electronics Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music...

CVE-2020-11235

Buffer overflow might occur while parsing unified command due to lack of check of input data received in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer Electronics Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon IoT, Snapdragon Mobil...

CVE-2020-11235

CVE-2020-11235 describes a buffer overflow that can occur while parsing a unified command due to insufficient input validation in Qualcomm Snapdragon components (Auto, Compute, Connectivity, etc.). The issue is triggered locally and can impact confidentiality, integrity, and availability, as indi...

CVE-2020-11165

Memory corruption due to buffer overflow while copying the message provided by HLOS into buffer without validating the length of buffer in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Wired...

CVE-2020-11165

CVE-2020-11165 : Memory corruption due to a buffer overflow when copying the HLOS message into a buffer without validating its length. Affects Qualcomm Snapdragon platforms (Snapdragon Auto, Compute, Connectivity, Consumer IOT, Industrial IOT, Mobile, Wired Infrastructure and Networking). Root ca...

CVE-2020-11134

CVE-2020-11134 affects Qualcomm Snapdragon family (Snapdragon Auto/Compute/Connectivity, etc.). The root cause is insufficient validation of time bitmap length and bit duration fields in NAN management frame attributes, leading to a possible stack out-of-bounds write within NAN ranging setup. The...

CVE-2020-11159

CVE-2020-11159 is a buffer over-read in Snapdragon/Qualcomm code while processing WPA/RSN IE in beacon and response frames. The flaw occurs when the IE length is shorter than the frame pointer being accessed, potentially affecting multiple Snapdragon product families (Auto, Compute, Connectivity,...

Bridgecrew Checkov 代码问题漏洞

Bridgecrew Checkov is an open source application. Static code analysis tool for infrastructure-as-code. Bridgecrew Checkov suffers from a code issue vulnerability that stems from insecure input validation when processing serialized data, which could allow a remote user to pass specially designed...

CISA Addresses the Rise in Ransomware Targeting Operational Technology Assets

CISA has published the Rising Ransomware Threat to OT Assets fact sheet in response to the recent increase in ransomware attacks targeting operational technology OT assets and control systems. The guidance: provides steps to prepare for, mitigate against, and respond to attacks; details how the...

Weak Password Vulnerability in HG630 V2 Home Gateway of Huawei Technologies Co.

Founded in 1987, Huawei Technologies Co., Ltd. is a leading global provider of ICT information and communications infrastructure and smart terminals. A weak password vulnerability exists in the Huawei Technologies HG630 V2 Home Gateway, which can be exploited by attackers to obtain sensitive...

Virtuozzo Hybrid Infrastructure 4.6 (4.6.0-208)

In this release, Virtuozzo Hybrid Infrastructure provides a wide range of new features that enhance service providers' operability. The improvements cover compute services, object storage, monitoring, security, localization, and the user interface. Additionally, this release delivers stability...

The U.S. EO on Ransomware: What Does it Mean? – Part 2

The White House is urging companies to do more to stem the tide of ransomware attacks now that they are starting to impact critical infrastructure and supply chains. It is a good start, but what will be the implication of this to U.S. businesses?...

Hackers Breached Colonial Pipeline Using Compromised VPN Password

The ransomware cartel that masterminded the Colonial Pipeline attack early last month crippled the pipeline operator's network using a compromised virtual private network VPN account password, the latest investigation into the incident has revealed. The development, which was reported by Bloomber...

Ransomware to be investigated like terrorism

The impact of recent ransomware attacks on vital infrastructure in the US has triggered a reaction from the US Attorney’s office. In an internal guidance it says that all ransomware investigations in the field should be centrally coordinated with a recently created task force in Washington...

API Securing in 2021 — Top 10 Best Practices

API Securing in 2021📋 — Top 10 Best Practices I love drawing inspiration from real life and todays article is no different. I often get asked the question on how to hack an API but what some people don’t realise is that almost everything is connected to an API these days, even the smart fridges i...