Design/Logic Flaw

Viber through 11.7.0.5 allows a remote attacker who can capture a victim's internet traffic to steal their Viber account, because not all Viber protocol traffic is encrypted. TCP data packet 9 on port 4244 from the victim's device contains cleartext information such as the device model and OS...

CVE-2019-18673

On SHIFT BitBox02 devices, a side channel for the row-based OLED display was found. The power consumption of each row-based display cycle depends on the number of illuminated pixels, allowing a partial recovery of display contents. For example, a hardware implant in the USB cable might be able to...

Design/Logic Flaw

On Hyundai Pay Kasse HK-1000 devices, a side channel for the row-based OLED display was found. The power consumption of each row-based display cycle depends on the number of illuminated pixels, allowing a partial recovery of display contents. For example, a hardware implant in the USB cable might...

CVE-2019-14360

On Hyundai Pay Kasse HK-1000 devices, a side channel for the row-based OLED display was found. The power consumption of each row-based display cycle depends on the number of illuminated pixels, allowing a partial recovery of display contents. For example, a hardware implant in the USB cable might...

CVE-2019-14360

On Hyundai Pay Kasse HK-1000 devices, there is a side-channel vulnerability in the row-based OLED display: power consumption per display cycle leaks information about the number of illuminated pixels. This can enable partial recovery of display contents, and could let an attacker with control ove...

PT-2019-13639

Name of the Vulnerable Software and Affected Versions Hyundai Pay Kasse HK-1000 devices affected versions not specified Description A side channel was discovered related to the row-based OLED display on the devices. The power consumption of each display cycle varies based on the number of...

CVE-2019-14356

On Coldcard MK1 and MK2 devices, a side channel for the row-based OLED display was found. The power consumption of each row-based display cycle depends on the number of illuminated pixels, allowing a partial recovery of display contents. For example, a hardware implant in the USB cable might be...

CVE-2009-0368

OpenSC before 0.11.7 allows physically proximate attackers to bypass intended PIN requirements and read private data objects via a 1 low level APDU command or 2 debugging tool, as demonstrated by reading the 4601 or 4701 file with the opensc-explorer or opensc-tool program...

Razer: Payment PIN Verification Bypass

The tester originally reported a PIN bypass in the Razer Pay MY client and provided a video POC which was very helpful. This was fixed in client version 2.11. Razer Fintech appreciates the tester's assistance and patience helping us resolve this issue...

SUSE-SU-2019:2365-2 Security update for python-Werkzeug

This update for python-Werkzeug fixes the following issues: Security issue fixed: - CVE-2019-14806: Fixed the development server in Docker, the debugger security pin is now unique per container bsc1145383...

SUSE-SU-2019:2400-1 Security update for python-Werkzeug

This update for python-Werkzeug fixes the following issues: Security issue fixed: - CVE-2019-14806: Fixed the development server in Docker, the debugger security pin is now unique per container bsc1145383...

SUSE-SU-2019:2365-1 Security update for python-Werkzeug

This update for python-Werkzeug fixes the following issues: Security issue fixed: - CVE-2019-14806: Fixed the development server in Docker, the debugger security pin is now unique per container bsc1145383...

OPENSUSE-SU-2019:2118-1 Security update for python-Werkzeug

This update for python-Werkzeug fixes the following issues: Security issue fixed: - CVE-2019-14806: Fixed the development server in Docker, the debugger security pin is now unique per container bsc1145383. This update was imported from the SUSE:SLE-15:Update update project...

TrickBot Targets Verizon, T-Mobile, Sprint Users to Siphon PINs

The TrickBot malware, known previously for targeting U.S. banks, is now setting a bullseye on users of U.S.-based mobile carriers, including Verizon Wireless, T-Mobile and Sprint, to launch SIM swapping attacks. Researchers with Dell’s Secureworks research team warned that they have observed the...

Code injection

DISPUTED On BC Vault devices, a side channel for the row-based SSD1309 OLED display was found. The power consumption of each row-based display cycle depends on the number of illuminated pixels, allowing a partial recovery of display contents. For example, a hardware implant in the USB cable might...

CVE-2019-14357

On Mooltipass Mini devices, a side channel for the row-based OLED display was found. The power consumption of each row-based display cycle depends on the number of illuminated pixels, allowing a partial recovery of display contents. For example, a hardware implant in the USB cable might be able t...

Code injection

On Ledger Nano S and Nano X devices, a side channel for the row-based OLED display was found. The power consumption of each row-based display cycle depends on the number of illuminated pixels, allowing a partial recovery of display contents. For example, a hardware implant in the USB cable might ...

Design/Logic Flaw

DISPUTED On Mooltipass Mini devices, a side channel for the row-based OLED display was found. The power consumption of each row-based display cycle depends on the number of illuminated pixels, allowing a partial recovery of display contents. For example, a hardware implant in the USB cable might ...

CVE-2019-14357

CVE-2019-14357 affects Mooltipass Mini via a side-channel in the row-based OLED display. The power consumption per display cycle leaks information proportional to the number of illuminated pixels, potentially enabling partial recovery of on-screen secrets (e.g., PIN) when the attacker has control...

CVE-2019-14354

Ledger Nano S/Nano X suffer a side‑channel risk from the row‑based OLED display: power consumption per display cycle correlates with illuminated pixels, enabling partial recovery of display contents (e.g., PIN or BIP39 mnemonic) if an attacker can monitor USB power while secret data is shown. Thi...