Lousy IoT Security

DTEN makes smart screens and whiteboards for videoconferencing systems. Forescout found that their security is terrible: In total, our researchers discovered five vulnerabilities of four different kinds: Data exposure: PDF files of shared whiteboards e.g. meeting notes and other sensitive files...

Security Advisory - Buffer Overflow Vulnerability in Some Huawei Smart Phones

There is a buffer overflow vulnerability in some Huawei smart phones. An attacker may intercept and tamper with the packet in the local area network LAN to exploit this vulnerability. Successful exploitation may cause the affected phone abnormal. Vulnerability ID: HWPSIRT-2019-09447 This...

Hackers Could Use Smart Displays to Spy on Meetings

By exploiting flaws in popular video conferencing hardware from DTEN, attackers can monitor audio, capture slides—and take full control of devices...

A week in security (December 9 – 15)

Last week on Malwarebytes Labs, we cautioned readers against purchasing potentially privacy-invasive, cyber-insecure smart doorbells, warned about a new credit card skimmer vulnerability embedded within hundreds of fraudulent web sites selling supposedly name-brand shoes, and looked at the newest...

SQL Injection Vulnerability in Jinwei Intelligent Food Order Payment Management System

Jinwei Smart Order Payment Management System is a free restaurant management software. It is suitable for all kinds of large and small restaurants, as well as fast food, Chinese food, western food, hot pot restaurant and other kinds of catering business. SQL injection vulnerability exists in Jinw...

CVE-2019-5235

Some Huawei smart phones have a null pointer dereference vulnerability. An attacker crafts specific packets and sends to the affected product to exploit this vulnerability. Successful exploitation may cause the affected phone to be abnormal...

Null pointer dereference

Some Huawei smart phones have a null pointer dereference vulnerability. An attacker crafts specific packets and sends to the affected product to exploit this vulnerability. Successful exploitation may cause the affected phone to be abnormal...

CVE-2019-5264

There is an information disclosure vulnerability in certain Huawei smartphones Mate 10;Mate 10 Pro;Honor V10;Changxiang 7S;P-smart;Changxiang 8 Plus;Y9 2018;Honor 9 Lite;Honor 9i;Mate 9. The software does not properly handle certain information of applications locked by applock in a rare conditio...

CVE-2019-5235

CVE-2019-5235 affects certain Huawei smartphones, where a null pointer dereference can be triggered by specially crafted packets, potentially causing the device to behave abnormally. The vulnerability is associated with a Huawei null pointer reference issue (HWPSIRT-2019-05097). Huawei has publis...

CVE-2019-5264

There is an information disclosure vulnerability in certain Huawei smartphones Mate 10;Mate 10 Pro;Honor V10;Changxiang 7S;P-smart;Changxiang 8 Plus;Y9 2018;Honor 9 Lite;Honor 9i;Mate 9. The software does not properly handle certain information of applications locked by applock in a rare conditio...

The vulnerability of the installer of Intel Smart Connect Technology allows a perpetrator to enhance their privileges.

The vulnerability of the Intel Smart Connect Technology software installer is related to deficiencies in access control. Exploiting this vulnerability can allow attackers to enhance their privileges...

“The Smartest Lock Ever” KeyWe is Vulnerable to Hacking

By Waqas The smart lock from KeyWe is marketed as the “smartest” lock ever and sells at $155 on Amazon. This is a post from HackRead.com Read the original post: "The Smartest Lock Ever” KeyWe is Vulnerable to Hacking...

Your Smart Christmas Lights Are Safer Than They Were Last Year

Thinking about putting up smart Christmas lights but worried about your internet of things IoT security? You can rest a bit easier this year because at least one festive light option is a bit safer than it used to be, new research has found. Manufacturers of the Twinkly smart lights have taken in...

CVE-2019-13945

A vulnerability has been identified in SIMATIC S7-1200 CPU family incl. SIPLUS variants All versions, SIMATIC S7-1200 CPU family V4.x incl. SIPLUS variants All versions, SIMATIC S7-1200 CPU family V4.x incl. SIPLUS variants All versions with Function State FS 11, SIMATIC S7-200 SMART CPU CR20s 6E...

CVE-2019-13945

A vulnerability has been identified in SIMATIC S7-1200 CPU family incl. SIPLUS variants All versions, SIMATIC S7-1200 CPU family V4.x incl. SIPLUS variants All versions, SIMATIC S7-1200 CPU family V4.x incl. SIPLUS variants All versions with Function State FS 11, SIMATIC S7-200 SMART CPU CR20s 6E...

Design/Logic Flaw

A vulnerability has been identified in SIMATIC S7-1200 CPU family incl. SIPLUS variants All versions, SIMATIC S7-1200 CPU family V4.x incl. SIPLUS variants All versions, SIMATIC S7-1200 CPU family V4.x incl. SIPLUS variants All versions with Function State FS 11, SIMATIC S7-200 SMART CPU CR20s 6E...

CVE-2019-13945

A vulnerability has been identified in SIMATIC S7-1200 CPU family incl. SIPLUS variants All versions, SIMATIC S7-1200 CPU family V4.x incl. SIPLUS variants All versions, SIMATIC S7-1200 CPU family V4.x incl. SIPLUS variants All versions with Function State FS 11, SIMATIC S7-200 SMART CPU CR20s 6E...

CVE-2019-13945

The CVE-2019-13945 vulnerability affects Siemens SIMATIC S7-1200 and S7-200 SMART CPU families (multiple revisions and SIPLUS variants) and arises from an access mode during manufacturing that grants additional diagnostic functionality. An attacker with physical access to the UART interface durin...

Serious Security Flaws Found in Children's Connected Toys

Various connected toys for children – hot off the shelves from this holiday shopping season – have been found with deep-rooted security issues, including missing authentication for device pairing and a lack of encryption for connected online accounts. The research, formed by a partnership between...

DRUPAL-CONTRIB-2019-092

The Smart Trim module allows site builders additional control with text summary fields. The module doesn't sufficiently filter text when certain options are selected. This vulnerability is mitigated by the fact that an attacker must have a role with the ability to create content on the site when...