826 matches found
CVE-2019-8541
Summary: CVE-2019-8541 is a privacy issue in motion sensor calibration that could allow a malicious app to track users between installs. It affects Apple devices and was fixed in iOS 12.2 and watchOS 5.2 via improved motion sensor processing. Huawei’s advisory (HWPSIRT-2019-05147) confirms this C...
iobroker.mieleathome (=0.0.4), t-motion-detector (=0.5.42) potentially affected by CVE-2019-10767 via iobroker.js-controller (=1.5.14)
iobroker.js-controller NPM version =1.5.14 is affected by a known vulnerability. The following packages have a transitive dependency on iobroker.js-controller and may be impacted: - iobroker.mieleathome =0.0.4 - t-motion-detector =0.5.42 Source cves: CVE-2019-10767 Source advisory:...
iSmartViewPro 1.3.34 - Denial of Service (PoC)
iSmartViewPro 1.3.34 - Denial of Service PoC Exploit Title: iSmartViewPro 1.3.34 - Denial of Service PoC Discovery by: Ivan Marmolejo Discovery Date: 2019 -11-16 Vendor Homepage: http://www.smarteyegroup.com/ Software Link: https://apps.apple.com/mx/app/ismartviewpro/id834791071 Tested Version:...
CVE-2019-6837
A Server-Side Request Forgery SSRF: CWE-918 vulnerability exists in U.motion Server MEG6501-0001 - U.motion KNX server, MEG6501-0002 - U.motion KNX Server Plus, MEG6260-0410 - U.motion KNX Server Plus, Touch 10, MEG6260-0415 - U.motion KNX Server Plus, Touch 15, which could cause server...
CVE-2019-6840
A Format String: CWE-134 vulnerability exists in U.motion Server MEG6501-0001 - U.motion KNX server, MEG6501-0002 - U.motion KNX Server Plus, MEG6260-0410 - U.motion KNX Server Plus, Touch 10, MEG6260-0415 - U.motion KNX Server Plus, Touch 15, which could allow an attacker to send a crafted messa...
CVE-2019-6835
A Cross-Site Scripting XSS CWE-79 vulnerability exists in U.motion Server MEG6501-0001 - U.motion KNX server, MEG6501-0002 - U.motion KNX Server Plus, MEG6260-0410 - U.motion KNX Server Plus, Touch 10, MEG6260-0415 - U.motion KNX Server Plus, Touch 15, which could allow an attacker to inject...
CVE-2019-6838
A CWE-863: Incorrect Authorization vulnerability exists in U.motion Server MEG6501-0001 - U.motion KNX server, MEG6501-0002 - U.motion KNX Server Plus, MEG6260-0410 - U.motion KNX Server Plus, Touch 10, MEG6260-0415 - U.motion KNX Server Plus, Touch 15, which could allow a user with low privilege...
PT-2019-18375 · U.Motion · U.Motion Server
Name of the Vulnerable Software and Affected Versions: U.motion Server affected versions not specified Description: A Format String vulnerability exists in the U.motion Server, which could allow an attacker to send a crafted message to the target server, thereby causing arbitrary commands to be...
PT-2019-18372 · Unknown · U.Motion Server
Name of the Vulnerable Software and Affected Versions: U.motion Server MEG6501-0001 - U.motion KNX server, MEG6501-0002 - U.motion KNX Server Plus, MEG6260-0410 - U.motion KNX Server Plus, Touch 10, MEG6260-0415 - U.motion KNX Server Plus, Touch 15 Description: A Server-Side Request Forgery SSRF...
PT-2019-18370 · U.Motion · U.Motion Server
Name of the Vulnerable Software and Affected Versions: U.motion Server affected versions not specified Description: A Cross-Site Scripting XSS issue exists, which could allow an attacker to inject client-side script when a user visits a web page. Recommendations: At the moment, there is no...
More on Law Enforcement Backdoor Demands
The Carnegie Endowment for International Peace and Princeton University's Center for Information Technology Policy convened an Encryption Working Group to attempt progress on the "going dark" debate. They have released their report: "Moving the Encryption Policy Conversation Forward. The main...
PT-2021-5792 · FFmpeg +5 · Ffmpeg +5
Name of the Vulnerable Software and Affected Versions: FFmpeg version 4.2 Description: The issue is related to a heap-based Buffer Overflow Vulnerability in the convolution y 8bit function of the FFmpeg library. This vulnerability could allow a remote attacker to cause a Denial of Service. The...
Cerberus: A New Android 'Banking Malware For Rent' Emerges
After a few popular Android Trojans like Anubis, Red Alert 2.0, GM bot, and Exobot, quit their malware-as-a-service businesses, a new player has emerged on the Internet with similar capabilities to fill the gap, offering Android bot rental service to the masses. Dubbed "Cerberus," the new remote...
macOS / iOS JavaScriptCore - Loop-Invariant Code Motion (LICM) Leaves Object Property Access Unguarded
While fuzzing JavaScriptCore, I encountered the following modified and commented JavaScript program which crashes jsc from current HEAD and release /System/Library/Frameworks/JavaScriptCore.framework/Resources/jsc: function v2trigger // Force JIT compilation. for let v7 = 0; v7 1000000; v7++ if...
macOS iOS JavaScriptCore - Loop-Invariant Code Motion (LICM) Leaves Object Property Access Unguarded
macOS iOS JavaScriptCore - Loop-Invariant Code Motion LICM Leaves Object Property Access Unguarded While fuzzing JavaScriptCore, I encountered the following modified and commented JavaScript program which crashes jsc from current HEAD and release...
macOS / iOS JavaScriptCore - Loop-Invariant Code Motion (LICM) Leaves Object Property Access Unguard
macOS / iOS JavaScriptCore - Loop-Invariant Code Motion LICM Leaves Object Property Access Unguarded While fuzzing JavaScriptCore, I encountered the following modified and commented JavaScript program which crashes jsc from current HEAD and release...
New Attack Lets Android Apps Capture Loudspeaker Data Without Any Permission
Earlier this month, The Hacker News covered a story on research revealing how over 1300 Android apps are collecting sensitive data even when users have explicitly denied the required permissions. The research was primarily focused on how app developers abuse multiple ways around to collect locati...
VulnCheck KEV: CVE-2018-7841
A SQL Injection vulnerability exists in U.motion Builder software which could cause unwanted code execution when an improper set of characters is entered...
