Resources for Measuring Cybersecurity

Kathryn Waldron at R Street has collected all of the different resources and methodologies for measuring cybersecurity...

CVE-2019-17627

The Yale Bluetooth Key application for mobile devices allows unauthorized unlock actions by sniffing Bluetooth Low Energy BLE traffic during one authorized unlock action, and then calculating the authentication key via simple computations on the hex digits of a valid authentication request. This...

Authentication flaw

The Yale Bluetooth Key application for mobile devices allows unauthorized unlock actions by sniffing Bluetooth Low Energy BLE traffic during one authorized unlock action, and then calculating the authentication key via simple computations on the hex digits of a valid authentication request. This...

CVE-2019-17627

The Yale Bluetooth Key application for mobile devices allows unauthorized unlock actions by sniffing Bluetooth Low Energy BLE traffic during one authorized unlock action, and then calculating the authentication key via simple computations on the hex digits of a valid authentication request. This...

PT-2019-15236

Name of the Vulnerable Software and Affected Versions Yale Bluetooth Key application affected versions not specified Yale ZEN-R lock affected versions not specified Description The issue allows unauthorized unlock actions by sniffing Bluetooth Low Energy BLE traffic during one authorized unlock...

CVE-2019-17627: Improper Authentication

The Yale Bluetooth Key application for mobile devices allows unauthorized unlock actions by sniffing Bluetooth Low Energy BLE traffic during one authorized unlock action, and then calculating the authentication key via simple computations on the hex digits of a valid authentication request. This...

Buffer overflow

Certain D-Link products are affected by: Buffer Overflow. This affects DIR-880L 1.08B04 and DIR-895 L/R 1.13b03. The impact is: execute arbitrary code remote. The component is: htdocs/fileaccess.cgi. The attack vector is: A crafted HTTP request handled by fileacces.cgi could allow an attacker to...

PT-2019-8014

Name of the Vulnerable Software and Affected Versions D-Link DIR-880L version 1.08B04 D-Link DIR-895 L/R version 1.13b03 Description The issue allows an attacker to execute arbitrary code remotely. It involves a buffer overflow in the htdocs/fileaccess.cgi component. A crafted HTTP request to thi...

CVE-2017-14948: Buffer Copy without Checking Size of Input

Certain D-Link products are affected by: Buffer Overflow. This affects DIR-880L 1.08B04 and DIR-895 L/R 1.13b03. The impact is: execute arbitrary code remote. The component is: htdocs/fileaccess.cgi. The attack vector is: A crafted HTTP request handled by fileacces.cgi could allow an attacker to...

Input validation

Improper file permission in software installer for IntelR Smart Connect Technology for IntelR NUC may allow an authenticated user to potentially enable escalation of privilege via local access...

CVE-2019-14570

The CVE-2019-14570 issue is a memory corruption vulnerability in Intel NUC system firmware that could allow a local attacker with user access to escalate privileges, cause a DoS, or disclose information. Affected products include Intel NUC 8 Mainstream Game Kit/Mini PC, NUC Board DE3815TYBE (H269...

UNIX Co-Founder Ken Thompson's BSD Password Has Finally Been Cracked

A 39-year-old password of Ken Thompson, the co-creator of the UNIX operating system among, has finally been cracked that belongs to a BSD-based system, one of the original versions of UNIX, which was back then used by various computer science pioneers. In 2014, developer Leah Neukirchen spotted a...

CVE-2019-14569: Improper Restriction of Operations within the Bounds of a Memory Buffer

Pointer corruption in system firmware for IntelR NUC may allow a privileged user to potentially enable escalation of privilege, denial of service and/or information disclosure via local access...

CVE-2019-11167: Incorrect Permission Assignment for Critical Resource

Improper file permission in software installer for IntelR Smart Connect Technology for IntelR NUC may allow an authenticated user to potentially enable escalation of privilege via local access...

CVE-2019-11120: Undefined Security Weakness

Insufficient path checking in the installer for IntelR Active System Console before version 8.0 Build 24 may allow an authenticated user to potentially enable escalation of privilege via local access...

PT-2019-4277

Name of the Vulnerable Software and Affected Versions IntelR NUC affected versions not specified Description The issue is related to memory corruption in system firmware, potentially allowing a privileged user to enable escalation of privilege, denial of service, and/or information disclosure via...

CVE-2019-14570: Out-of-bounds Write

Memory corruption in system firmware for IntelR NUC may allow a privileged user to potentially enable escalation of privilege, denial of service and/or information disclosure via local access...

PT-2019-4278

Name of the Vulnerable Software and Affected Versions IntelR NUC affected versions not specified Description The issue is related to pointer corruption in system firmware, which may allow a privileged user to potentially enable escalation of privilege, denial of service, and/or information...

PT-2019-15145

Name of the Vulnerable Software and Affected Versions OISF LibHTP versions prior to 0.5.31 Suricata version 4.1.4 Description An HTTP protocol parsing error occurs in the affected software, causing the http header signature to not alert on a response with a single r ending. Recommendations For OI...

PT-2019-4061

Name of the Vulnerable Software and Affected Versions IntelR Smart Connect Technology affected versions not specified Description The issue is related to improper file permissions in the software installer for IntelR Smart Connect Technology, which may allow an authenticated user to potentially...