CVE-2021-1928

CVE-2021-1928 affects a range of Qualcomm Snapdragon devices where emmc flashing code performs an improper buffer size check, causing a buffer over-read. Root cause: incorrect bounds check during memory handling in the emmc flashing path. Impact stated in CVSS: partial confidentiality and partial...

CVE-2021-1923

CVE-2021-1923 involves a Qualcomm/ Snapdragon trusted-application (TA) vulnerability where an incorrect pointer argument passed to a TA could cause unintended memory operations. Connected sources confirm the root cause as a mis-passed pointer to a TA, with affected Qualcomm/Snapdragon components ...

CVE-2021-1923

Incorrect pointer argument passed to trusted application TA could result in un-intended memory operations in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Industrial IOT...

CVE-2021-1920

Integer underflow can occur due to improper handling of incoming RTCP packets in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon IoT, Snapdragon Voice & Music, Snapdragon Wearables...

CVE-2021-1919

CVE-2021-1919 describes an integer underflow in Qualcomm Snapdragon video/RTCP handling where the RTCP length is smaller than the actual number of blocks, affecting Snapdragon Auto, Compute, Connectivity, Ciot, Industrial IoT, IoT, Voice & Music, Wearables and related Snapdragon lines. The vulner...

CVE-2021-1916

CVE-2021-1916 involves a buffer underflow in Qualcomm Snapdragon components due to a lack of input index checks. Public sources confirm a critical impact (CVSSv3 base 9.8, NETWORK attack vector; no user interaction) affecting Snapdragon Auto/Compute/Connectivity and Snapdragon IoT family; the iss...

CVE-2021-1914

CVE-2021-1914 affects Qualcomm Snapdragon families (Auto, Compute, Connectivity, Consumer IOT, Industrial IOT, IoT, Voice & Music, Wearables). Root cause: mishandling of unsupported input can cause a loop with an unreachable exit condition. Impact: described as a high-severity issue with potentia...

CVE-2021-1914

Loop with unreachable exit condition may occur due to improper handling of unsupported input in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon IoT, Snapdragon Voice & Music, Snapdragon Wearables...

CVE-2020-11264

Improper authentication of Non-EAPOL/WAPI plaintext frames during four-way handshake can lead to arbitrary network packet injection in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer Electronics Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT,...

iotglobalnetwork.com Cross Site Scripting vulnerability OBB-2135017

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: &nbsp&nbsp&nbsp&nbsp&nbsp&nbspa. verified the vulnerability and confirmed its existence; &nbsp&nbsp&nbsp&nbsp&nbsp&nbspb. notified the website operator about its existence...

IoT Attacks Skyrocket, Doubling in 6 Months

The first six months of 2021 have seen a more than 100-percent growth in cyberattacks against internet-of-things IoT devices, researchers have found. According to a Kaspersky analysis of its telemetry from honeypots shared with Threatpost, the firm detected more than 1.5 billion IoT attacks – up...

Contiki 代码问题漏洞

Contiki is an open source cross-platform operating system for IoT Internet of Things devices. Contiki-os Contiki has a code issue vulnerability that stems from improper handling of Telnet option negotiation in Contiki 3.0. The server and client may fail to give a WILL/WONT or DO/DONT response to ...

FBI warns of ransomware threat to food and agriculture

The FBI has issued a Private Industry Notification PIN about cybercriminal actors targeting the food and agriculture sector with ransomware attacks. Farms are literally the first step in one of the most important, if not the most important, supply chain in our economy: The food supply chain. As...

Espressif ESP-IDF 安全漏洞

Espressif ESP-IDF is an Internet of Things IoT development framework from China's Lexin Information Technology Espressif. Espressif ESP-IDF suffers from a security vulnerability that stems from a security issue in the commercial BT stack. The vulnerability can be exploited by an attacker to cause...

Bluetooth Bugs Open Billions of Devices to DoS, Code Execution

Researchers have disclosed a group of 16 different vulnerabilities collectively dubbed BrakTooth, which impact billions of devices that rely on Bluetooth Classic BT for communication. According to an academic paper from the University of Singapore, the bugs are found in the closed commercial BT...

Chinese Authorities Arrest Hackers Behind Mozi IoT Botnet Attacks

The operators of the Mozi IoT botnet have been taken into custody by Chinese law enforcement authorities, nearly two years after the malware emerged on the threat landscape in September 2019. News of the arrest, which originally happened in June, was disclosed by researchers from Netlab, the...

Why the Raspberry Pi isn’t suitable for IoT

Let’s start by praising the Raspberry Pi: it has brought cheap computing to many, has inspired and enabled education and undoubtedly been a huge benefit. I use my own Pi daily, and we have often used its flexibility to perform hardware testing, from accessing UART to reading flash memory. So why ...

Moxa Command Injection / Cross Site Scripting / Vulnerable Software

SEC Consult Vulnerability Lab Security Advisory ======================================================================= title: Multiple vulnerabilities product: see "Vulnerable / tested versions" vulnerable version: see "Vulnerable / tested versions" fixed version: see "Solution" CVE number:...

Researchers Propose Machine Learning-based Bluetooth Authentication Scheme

A group of academics has proposed a machine learning approach that uses authentic interactions between devices in Bluetooth networks as a foundation to handle device-to-device authentication reliably. Called "Verification of Interaction Authenticity" aka VIA, the recurring authentication scheme...

Doodle Smart app and Doodle Converter (smart socket) have a flawed logic vulnerability

Doodle Smart is an IoT cloud platform that connects brands, OEMs, developers and chain retailers with their intelligence needs, providing a one-stop AI IoT PaaS-level solution that covers hardware development, global cloud, and smart business platform development, providing comprehensive ecologic...