Information disclosure

An insecure storage of sensitive information vulnerability is present in Hickory Smart for iOS mobile devices from Belwith Products, LLC. The application's database was found to contain information that could be used to control the lock devices remotely. This issue affects Hickory Smart for iOS,...

Information disclosure

An insecure storage of sensitive information vulnerability is present in Hickory Smart for Android mobile devices from Belwith Products, LLC. The application's database was found to contain information that could be used to control the lock devices remotely. This issue affects Hickory Smart for...

CVE-2019-5634

CVE-2019-5634 affects Hickory Smart for Android (Belwith)

CVE-2019-5634 Hickory Smart Lock Insecure Logging on Android

An inclusion of sensitive information in log files vulnerability is present in Hickory Smart for Android mobile devices from Belwith Products, LLC. Communications to the internet API services and direct connections to the lock via Bluetooth Low Energy BLE from the mobile application are logged in...

CVE-2019-5635

CVE-2019-5635 describes a cleartext credential transmission in the Hickory Smart Ethernet Bridge (model H077646) from Belwith Products. The device reportedly communicates with an MQTT broker over the network without encryption, exposing the default username/password used for MQTT authentication. ...

CVE-2019-5633

CVE-2019-5633 concerns insecure storage of sensitive data in Hickory Smart for iOS (Cache.db), enabling potential remote control of locks. Affected: Hickory Smart for iOS, version 01.01.07 and earlier. The connected ThreatPost report notes this CVE alongside related flaws (e.g., 2019-5632, 2019-5...

CVE-2019-5632

CVE-2019-5632 affects Hickory Smart for Android (pre-01.01.43). Root cause: unencrypted sensitive data stored in the app’s Android SQLite database (SecureRemoteSmartDB.sqlite), enabling remote control of locks if data is exposed. Impact stated as information that could be used to control the lock...

openSUSE Security Update : python (openSUSE-2019-1906)

This update for python fixes the following issues : Security issue fixed : - CVE-2019-10160: Fixed a regression in urlparse and urlsplit introduced by the fix for CVE-2019-9636 bsc1138459. This update was imported from the SUSE:SLE-15:Update update project. C Tenable Network Security, Inc. The...

The Rise of “Bulletproof” Residential Networks

Cybercrooks increasingly are anonymizing their malicious traffic by routing it through residential broadband and wireless data connections. Traditionally, those connections have been mainly hacked computers, mobile phones, or home routers. But this story is about so-called "bulletproof residentia...

OSIsoft PI Web API

1. EXECUTIVE SUMMARY CVSS v3 8.5 ATTENTION: Exploitable remotely Vendor: OSIsoft LLC Equipment: OSIsoft PI Web API Vulnerabilities: Inclusion of Sensitive Information in Log Files, Protection Mechanism Failure 2. RISK EVALUATION Successful exploitation of these vulnerabilities may allow direct...

openSUSE Security Update : bzip2 (openSUSE-2019-1781)

This update for bzip2 fixes the following issues : Security issue fixed : - CVE-2019-12900: Fixed an out-of-bounds write in decompress.c with many selectors bsc1139083. This update was imported from the SUSE:SLE-15:Update update project. C Tenable Network Security, Inc. The descriptive text and...

Denial Of Service (DoS)

The kernel packages contain the Linux kernel, the core of any Linux operating system. This update fixes the following security issues: A flaw was found in the way the Linux kernel's IPv6 implementation handled certain UDP packets when the UDP Fragmentation Offload UFO feature was enabled. A remot...

Denial Of Service (DoS)

The kernel packages contain the Linux kernel, the core of any Linux operating system. This update fixes the following security issues: A flaw was found in the way the Linux kernel's IPv6 implementation handled certain UDP packets when the UDP Fragmentation Offload UFO feature was enabled. A remot...

Sensitive Information Disclosure

The kernel packages contain the Linux kernel, the core of any Linux operating system. This update fixes the following security issues: A flaw was found in the way the Linux kernel's IPv6 implementation handled certain UDP packets when the UDP Fragmentation Offload UFO feature was enabled. A remot...

Information Disclosure

kernel is vulnerable to information disclosure. The vulnerability exists as the llcuirecvmsg function in net/llc/afllc.c does not initialize a certain length variable...

CVE-2019-6543

AVEVA Software, LLC InduSoft Web Studio prior to Version 8.1 SP3 and InTouch Edge HMI formerly InTouch Machine Edition prior to Version 2017 Update. Code is executed under the program runtime privileges, which could lead to the compromise of the machine...

Electronegativity - Tool To Identify Misconfigurations And Security Anti-Patterns In Electron Applications

Electronegativity is a tool to identify misconfigurations and security anti-patterns in Electron-based applications. It leverages AST and DOM parsing to look for security-relevant configurations, as described in the "Electron Security Checklist - A Guide for Developers and Auditors" whitepaper...

Juniper Secure Access SSL VPN Privilege Escalation Vulnerability

Certain Secure Access SA Series SSL VPN products originally developed by Juniper Networks but now sold and supported by Pulse Secure, LLC allow privilege escalation, as demonstrated by Secure Access SSL VPN SA-4000 5.1R5 build 9627 4.2 Release build 7631. This occurs because appropriate controls...

Privilege escalation

Certain Secure Access SA Series SSL VPN products originally developed by Juniper Networks but now sold and supported by Pulse Secure, LLC allow privilege escalation, as demonstrated by Secure Access SSL VPN SA-4000 5.1R5 build 9627 4.2 Release build 7631. This occurs because appropriate controls...

CVE-2018-20193

CVE-2018-20193 affects Secure Access SSL VPN SA Series (notably SA-4000 5.1R5 build 9627 / 4.2 Release build 7631). Description: a privilege-escalation flaw where a readonly user can change the administrator password by cloning and modifying the /dana-admin/user/update.cgi page and saving changes...