Authentication flaw

An unauthenticated root login may allow upon reboot when a commit script is used. A commit script allows a device administrator to execute certain instructions during commit, which is configured under the system scripts commit stanza. Certain commit scripts that work without a problem during norm...

CVE-2018-0008: Improper Authentication

An unauthenticated root login may allow upon reboot when a commit script is used. A commit script allows a device administrator to execute certain instructions during commit, which is configured under the system scripts commit stanza. Certain commit scripts that work without a problem during norm...

Foxit Reader JPEG2000 Image Parsing Process Information Disclosure Vulnerability

Foxit Reader is China's Foxit Foxit Software Corporation, a PDF document reader. An information disclosure vulnerability exists in the JPEG2000 image parsing process in Foxit Reader version 8.3.2.25013, which results from the program failing to properly validate user-submitted data. The...

Exosrv.com, an ad server for adult sites, tops Malwarebytes detections

Update 12/18/2017: Upon review, we have decided to lift the block on those two ad servers. You can read ExoClick's comments below: At Exoclick we use large resources to ensure that the ads that we serve are clear, clean and issue free. Where malwares and other forms of malvertising are detected...

Vaultek Gun Safe VT20i Information Disclosure Vulnerability (CNVD-2018-00316)

The Vaultek Gun Safe VT20i aka BlueSteal is a fingerprint-enabled gun safe product. A security vulnerability exists in the Vaultek Gun Safe VT20i that stems from the program's failure to encrypt the session between the Android application and the safe. An attacker could exploit the vulnerability ...

Vaultek Gun Safe VT20i Information Disclosure Vulnerability

The Vaultek Gun Safe VT20i aka BlueSteal is a fingerprint-enabled gun safe product. An information disclosure vulnerability exists in the Vaultek Gun Safe VT20i. A remote attacker could exploit this vulnerability to open any safe in this product line...

CVE-2017-17436

An issue was discovered in the software on Vaultek Gun Safe VT20i products. There is no encryption of the session between the Android application and the safe. The website and marketing materials advertise that this communication channel is encrypted with "Highest Level Bluetooth Encryption" and...

CVE-2017-17435

An issue was discovered in the software on Vaultek Gun Safe VT20i products, aka BlueSteal. An attacker can remotely unlock any safe in this product line without a valid PIN code. Even though the phone application requires it and there is a field to supply the PIN code in an authorization request,...

Authorization

An issue was discovered in the software on Vaultek Gun Safe VT20i products, aka BlueSteal. An attacker can remotely unlock any safe in this product line without a valid PIN code. Even though the phone application requires it and there is a field to supply the PIN code in an authorization request,...

Code injection

An issue was discovered in the software on Vaultek Gun Safe VT20i products. There is no encryption of the session between the Android application and the safe. The website and marketing materials advertise that this communication channel is encrypted with "Highest Level Bluetooth Encryption" and...

CVE-2017-17435

CVE-2017-17435 (Vaultek VT20i / BlueSteal) : A vulnerability in Vaultek Gun Safe VT20i products allows remote unlocking without a valid PIN. An attacker who observes the BLE advertisement can write a BLE characteristic to enable notifications, craft a getAuthor packet that returns a temporary key...

CVE-2017-17436

Technical details about CVE-2017-17436 are not present in the provided connected documents. No specific affected products, versions, root cause, or remediation are disclosed here. Monitor for updates as new information becomes available.

CVE-2017-17435

An issue was discovered in the software on Vaultek Gun Safe VT20i products, aka BlueSteal. An attacker can remotely unlock any safe in this product line without a valid PIN code. Even though the phone application requires it and there is a field to supply the PIN code in an authorization request,...

CVE-2017-17436: Inadequate Encryption Strength

An issue was discovered in the software on Vaultek Gun Safe VT20i products. There is no encryption of the session between the Android application and the safe. The website and marketing materials advertise that this communication channel is encrypted with "Highest Level Bluetooth Encryption" and...

CVE-2017-17436

An issue was discovered in the software on Vaultek Gun Safe VT20i products. There is no encryption of the session between the Android application and the safe. The website and marketing materials advertise that this communication channel is encrypted with "Highest Level Bluetooth Encryption" and...

PT-2017-14779

Name of the Vulnerable Software and Affected Versions Vaultek Gun Safe VT20i products affected versions not specified Description The issue concerns the lack of encryption in the communication session between the Android application and the Vaultek Gun Safe VT20i products. Despite claims of using...

PT-2017-14778

Name of the Vulnerable Software and Affected Versions Vaultek Gun Safe VT20i products Description An issue in the Vaultek Gun Safe VT20i products allows an attacker to remotely unlock any safe without a valid PIN code. The safe does not verify the PIN code supplied in the authorization request,...

CVE-2017-17435: Improper Authentication

An issue was discovered in the software on Vaultek Gun Safe VT20i products, aka BlueSteal. An attacker can remotely unlock any safe in this product line without a valid PIN code. Even though the phone application requires it and there is a field to supply the PIN code in an authorization request,...

Cross-Site Scripting (XSS)

league/commonmark is vulnerable to cross-site scripting XSS attacks. The attacks exist because it does not use HTML safe mode to handle untrusted user input...

Google Cracks Down On Nosy Android Apps

Google is cracking down on unwanted and harmful Android apps with a new effort that will show warnings on applications and on third-party websites distributing apps that collect personal data without user consent. The effort is an expansion of the Google Safe Browsing team’s mission to enforce th...