CVE-2025-25523

Buffer overflow vulnerability in Trendnet TEG-40128 Web Smart Switch v11.00.023 due to the lack of length verification, which is related to the mobile access point setup operation. The attacker can directly control the remote target device by successfully exploiting this vulnerability...

CVE-2025-25523

Buffer overflow vulnerability in Trendnet TEG-40128 Web Smart Switch v11.00.023 due to the lack of length verification, which is related to the mobile access point setup operation. The attacker can directly control the remote target device by successfully exploiting this vulnerability...

Vulnerability fixed in Apple iOS and iPadOS

Apple has fixed a vulnerability in iOS and iPadOS. A malicious person with physical access to the vulnerable device can exploit the vulnerability to bypass USB restrictions, even when the system is locked. This allows the malicious party to install arbitrary software on the device. Successful abu...

Schneider Electric EcoStruxure (Update A)

GENERAL SECURITY RECOMMENDATIONS We strongly recommend the following industry cybersecurity best practices. https://www.se.com/us/en/download/document/7EN52-0390/ Locate control and safety system networks and remote devices behind firewalls and isolate them from the business network. Install...

SUSE CVE-2024-54658

The issue was addressed with improved memory handling. This issue is fixed in Safari 17.4, iOS 17.4 and iPadOS 17.4, macOS Sonoma 14.4, tvOS 17.4, visionOS 1.1, watchOS 10.4. Processing web content may lead to a denial-of-service...

CVE-2025-25523

CVE-2025-25523 affects Trendnet TEG-40128 Web Smart Switch, version 1(1.00.023). The vulnerability is a buffer overflow caused by lack of length verification in the mobile access point setup operation, allowing an attacker to directly control the remote device. The issue is documented across mult...

PT-2025-6378 · Trendnet · Teg-40128 Web Smart Switch

Name of the Vulnerable Software and Affected Versions: Trendnet TEG-40128 Web Smart Switch version 11.00.023 Description: The issue is related to a buffer overflow vulnerability due to the lack of length verification in the mobile access point setup operation. This vulnerability allows an attacke...

CVE-2025-25523

Buffer overflow vulnerability in Trendnet TEG-40128 Web Smart Switch v11.00.023 due to the lack of length verification, which is related to the mobile access point setup operation. The attacker can directly control the remote target device by successfully exploiting this vulnerability...

CVE-2025-25523

Buffer overflow vulnerability in Trendnet TEG-40128 Web Smart Switch v11.00.023 due to the lack of length verification, which is related to the mobile access point setup operation. The attacker can directly control the remote target device by successfully exploiting this vulnerability...

Pairwise Authentication of Humans

Here's an easy system for two humans to remotely authenticate to each other, so they can be sure that neither are digital impersonations. To mitigate that risk, I have developed this simple solution where you can setup a unique time-based one-time passcode TOTP between any pair of persons. This i...

VulnCheck KEV: CVE-2025-24200

Apple iOS and iPadOS contains an incorrect authorization vulnerability that allows a physical attacker to disable USB Restricted Mode on a locked device...

ShareFile Support changes on Citrix Endpoint Management (CEM) Integration

Important Notice: Impact of ShareFile Support changes on Citrix Endpoint Management CEM Integration Citrix Endpoint Management CEM offers robust integration with ShareFile, enhancing secure file sharing and collaboration. However, it's crucial to understand that the continued functionality of the...

CVE-2024-36557

The device ID is based on IMEI in Forever KidsWatch Call Me KW50 R36YDRA3PWGM7SV1.02019071516.19.24cobh and Forever KidsWatch Call Me 2 KW60 R36CWYDES4A292V1.02023.05.2422.49.44cobb. If a malicious user changes the IMEI to the IMEI of a unit they registered in the mobile app, it is possible to...

CVE-2025-24804

Mobile Security Framework MobSF is an automated, all-in-one mobile application Android/iOS/Windows pen-testing, malware analysis and security assessment framework. According to Apple's documentation for bundle ID's, it must contain only alphanumeric characters A–Z, a–z, and 0–9, hyphens -, and...

CVE-2025-24803

Mobile Security Framework MobSF is an automated, all-in-one mobile application Android/iOS/Windows pen-testing, malware analysis and security assessment framework. According to Apple's documentation for bundle ID's, it must contain only alphanumeric characters A–Z, a–z, and 0–9, hyphens -, and...

CVE-2025-24805

Mobile Security Framework MobSF is an automated, all-in-one mobile application Android/iOS/Windows pen-testing, malware analysis and security assessment framework. A local user with minimal privileges is able to make use of an access token for materials for scopes which it should not be accepted...

CVE-2024-57238

Prolink 4G LTE Mobile Wi-Fi DL-7203E V4.0.0B05 is vulnerable to SQL Injection in in the /reqproc/procget endpoint. The vulnerability allows an attacker to manipulate SQL queries by injecting malicious SQL code into the orderby parameter...

CVE-2024-57237

Prolink 4G LTE Mobile Wi-Fi DL-7203E V4.0.0B05 is vulnerable to Cross Site Scripting XSS in the /reqproc/procget endpoint. The vulnerability arises because the cmd parameter does not properly sanitize input and the response is served with a Content-Type of text/html. This behavior allows the...

India's RBI Introduces Exclusive "bank.in" Domain to Combat Digital Banking Fraud

India's central bank, the Reserve Bank of India RBI, said it's introducing an exclusive "bank.in" internet domain for banks in the country to combat digital financial fraud. "This initiative aims to reduce cyber security threats and malicious activities like phishing; and, streamline secure...

Stored Cross-site Scripting (XSS)

Mobile Security Framework MobSF is vulnerable to Stored Cross-Site Scripting XSS. The vulnerability is due to improper sanitization of the bundle ID value in dynamicanalysis.html, which allows an attacker to inject special characters and break the HTML context, leading to Stored XSS...