PT-2023-13821 · Qualcomm · Snapdragon +143

Name of the Vulnerable Software and Affected Versions: No specific software or versions are mentioned in the provided descriptions. Description: The issue involves memory corruption in the Bluetooth HOST when processing the AVRC PDU GET PLAYER APP VALUE TEXT AVRCP response. This suggests a proble...

The vulnerability in the web interface of the Unified Remote software, a remote control program for computers, allows a hacker to execute arbitrary code.

The vulnerability of the Unified Remote web interface for remote control software management is related to an incorrect authentication process. Exploiting this vulnerability allows a malicious actor to execute arbitrary code remotely...

Malicious code in nokia-smp (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware d2dd16f41855f78df40de39f97e0b9724df12d2b0f4caca18025ec16150be4a7 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

SUSE CVE-2016-2392

The isrndis function in the USB Net device emulator hw/usb/dev-network.c in QEMU before 2.5.1 does not properly validate USB configuration descriptor objects, which allows local guest OS administrators to cause a denial of service NULL pointer dereference and QEMU process crash via vectors...

Qualcomm 芯片缓冲区错误漏洞

A Qualcomm chip is a chip from Qualcomm Incorporated USA. A way of miniaturizing circuits mainly semiconductor devices, but also passive components, etc. and is often manufactured on the surface of semiconductor wafers. A security vulnerability exists in the Bluetooth module of the Qualcomm chip,...

Moderate: Red Hat Security Advisory: openvswitch2.16 security, bug fix and enhancement update

An update for openvswitch2.16 is now available for Fast Datapath for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for...

PT-2023-13285 · Unknown · Bluetooth Host

Name of the Vulnerable Software and Affected Versions: Bluetooth HOST affected versions not specified Description: The issue is related to memory corruption caused by accessing an uninitialized pointer in the Bluetooth HOST while processing the AVRCP packet. Recommendations: At the moment, there ...

Korean Word Processor Scam Alert Orcus RAT Lurking in Cracked Versions

Threat Level Attack Report For a detailed threat advisory, download the pdf file here Summary Orcus RAT, formerly known as Schnorchel, first appeared in April 2016 and allows for remote control of infected systems. Intruders are attempting to deploy a variant of Orcus RAT along with XMRig...

NetSupport RAT employs phishing campaigns that incorporate Pokemon lures

Threat Level Attack Report For a detailed threat advisory, download the pdf file here Summary NetSupport Manager is a remote control tool that can be used by ordinary or corporate users to remotely control systems, but it is being abused by threat actors as it allows external control over specifi...

PT-2023-15538 · Unknown · Bluetooth Avrcp

Name of the Vulnerable Software and Affected Versions: Bluetooth AVRCP module affected versions not specified Description: The Bluetooth AVRCP module has a vulnerability that can lead to Denial of Service DoS attacks. Successful exploitation of this vulnerability may cause the Bluetooth process t...

SOUND4 IMPACT/FIRST/PULSE/Eco 2.x Hardcoded Credentials

SOUND4 IMPACT/FIRST/PULSE/Eco =2.x sound4server Hardcoded Credentials Vendor: SOUND4 Ltd. Product web page: https://www.sound4.com | https://www.sound4.biz Affected version: FM/HD Radio Processing: Impact/Pulse/First Version 2: 1.1/2.15 Impact/Pulse/First Version 1: 2.1/1.69 Impact/Pulse Eco 1.16...

Zoom Client for Meetings < 4.1.34460.1105 Vulnerability (ZSB-18001)

The version of Zoom Client for Meetings installed on the remote host is prior to 4.1.34460.1105. It is, therefore, affected by a vulnerability as referenced in the ZSB-18001 advisory. - A vulnerability in the Zoom client could allow a remote, unauthenticated attacker to control meeting...

SOUND4 IMPACT/FIRST/PULSE/Eco <=2.x (sound4server) Hardcoded Credentials

Summary The SOUND4 IMPACT introduces an innovative process - mono and stereo parts of the signal are processed separately to obtain perfect consistency in terms of both sound and level. Therefore, in moving reception, when the FM receiver switches from stereo to mono and back to stereo, the sound...

CVE-2022-44636

The Samsung TV 2021 and 2022 model smart remote control allows attackers to enable microphone access via Bluetooth spoofing when a user is activating remote control by pressing a button. This is fixed in xxx72510, E9172511 for 2021 models, xxxA1000, 4x2A0200 for 2022 models...

Design/Logic Flaw

The Samsung TV 2021 and 2022 model smart remote control allows attackers to enable microphone access via Bluetooth spoofing when a user is activating remote control by pressing a button. This is fixed in xxx72510, E9172511 for 2021 models, xxxA1000, 4x2A0200 for 2022 models...

PT-2022-27273 · Samsung · Samsungtv

Name of the Vulnerable Software and Affected Versions: Samsung TV versions 2021 through 2022 Description: The smart remote control of the Samsung TV allows attackers to enable microphone access via Bluetooth spoofing when a user is activating the remote control by pressing a button...

CVE-2022-44636

CVE-2022-44636 affects Samsung TV models from 2021 and 2022, where the smart remote control can enable microphone access via Bluetooth spoofing when a user activates the remote by pressing a button. The vulnerability is mitigated in 2021 models by updates to versions xxx72510 or E9172511, and in ...

CVE-2022-44636

The Samsung TV 2021 and 2022 model smart remote control allows attackers to enable microphone access via Bluetooth spoofing when a user is activating remote control by pressing a button. This is fixed in xxx72510, E9172511 for 2021 models, xxxA1000, 4x2A0200 for 2022 models...

SiriusXM Vulnerability Lets Hackers Remotely Unlock and Start Connected Cars

Cybersecurity researchers have discovered a security vulnerability that exposes cars from Honda, Nissan, Infiniti, and Acura to remote attacks through a connected vehicle service provided by SiriusXM. The issue could be exploited to unlock, start, locate, and honk any car in an unauthorized manne...

Metasploit Weekly Wrap-Up

ProxyNotShell This week's Metasploit release includes an exploit module for CVE-2022-41082, AKA ProxyNotShell by DA-0x43-Dx4-DA-Hx2-Tx2-TP-S-Q, Orange Tsai, Piotr Bazydło, Rich Warren, Soroush Dalili, and our very own Spencer McIntyre. The vulnerability CVE-2022-41082, AKA ProxyNotShell is a...