Sony Smart TV Information Disclosure / File Read Vulnerabilities

Exploit for hardware platform in category local exploits ADVISORY INFORMATION TITLE: Multiple vulnerabilities in Sony Smart TVs ADVISORY URL: https://www.darkmatter.ae/blogs/security-flaws-uncovered-in-sony-smart-tvs/ DATE PUBLISHED: 23/04/2019 AFFECTED VENDORS: Sony RELEASE MODE: Coordinated...

Sony Smart TV Information Disclosure / File Read

UNCLASSIFIED ADVISORY INFORMATION TITLE: Multiple vulnerabilities in Sony Smart TVs ADVISORY URL: https://www.darkmatter.ae/blogs/security-flaws-uncovered-in-sony-smart-tvs/ DATE PUBLISHED: 23/04/2019 AFFECTED VENDORS: Sony RELEASE MODE: Coordinated release CVE: CVE-2019-10886, CVE-2019-11336...

Security Advisory - FRP Bypass Vulnerability in Huawei Smart Phones

There is Factory Reset Protection FRP bypass security vulnerability in some Huawei smart phones. When re-configuring the mobile phone using the factory reset protection FRP function, an attacker can login the Talkback mode and can perform some operations to access the setting page. As a result, t...

IoT Zero-Days – Is Belkin WeMo Smart Plug the Next Malware Target?

ARCHIVED STORY IoT Zero-Days – Is Belkin WeMo Smart Plug the Next Malware Target? By Steve Povolny · April 18, 2019 Effective malware is typically developed with intention, targeting specific victims using either known or unknown vulnerabilities to achieve its primary functions. In this blog, we...

IoT Zero-Days – Is Belkin WeMo Smart Plug the Next Malware Target?

ARCHIVED STORY IoT Zero-Days – Is Belkin WeMo Smart Plug the Next Malware Target? By Steve Povolny · April 18, 2019 Effective malware is typically developed with intention, targeting specific victims using either known or unknown vulnerabilities to achieve its primary functions. In this blog, we...

[SECURITY] Fedora 30 Update: gnome-disk-utility-3.32.1-2.fc30

This package contains the Disks and Disk Image Mounter applications. Disks supports partitioning, file system creation, encryption, fstab/crypttab editing, ATA SMART and other features...

Is Your Baby Monitor Susceptible to Hacking?

There’s no doubt that digital technology, in many of its forms, brings everyday tasks much closer-to-hand. From discovering breaking news, to online shopping, to keeping tabs on your home via security cameras—everything is within the touch of a button. Even so, with the growing reach of the...

Multiple Vulnerabilities in Zhikuan Life App

Smart Broadlife app is a broadband assistant app. There are multiple vulnerabilities in Smart Broadband Life App that can be exploited by attackers to obtain sensitive information...

The vulnerability of the Cisco Smart Call Home component for Cisco IOS XE and Cisco IOS operating systems allows attackers to disclose sensitive information that should be protected.

The vulnerability of the Cisco Smart Call Home component for Cisco IOS XE and Cisco IOS exists due to insufficient verification of certificate authenticity. Exploiting this vulnerability can allow a malicious actor, operating remotely, to disclose sensitive information...

How To Make Your Amazon Echo and Google Home as Private as Possible

With news that Amazon lets human employees listen to Alexa recordings, you might want to tighten up your smart assistant ship...

Design/Logic Flaw

SmartDefragDriver.sys 2.0 in IObit Smart Defrag 6 never frees an executable kernel pool that is allocated with user defined bytes and size when IOCTL 0x9C401CC0 is called. This kernel pointer can be leaked if the kernel pool becomes a "big" pool...

CVE-2019-6493

SmartDefragDriver.sys 2.0 in IObit Smart Defrag 6 never frees an executable kernel pool that is allocated with user defined bytes and size when IOCTL 0x9C401CC0 is called. This kernel pointer can be leaked if the kernel pool becomes a "big" pool...

CVE-2019-6493

SmartDefragDriver.sys 2.0 in IObit Smart Defrag 6 never frees an executable kernel pool that is allocated with user defined bytes and size when IOCTL 0x9C401CC0 is called. This kernel pointer can be leaked if the kernel pool becomes a "big" pool...

This Week in Security News: IIoT Threats and Malware Apps

Welcome to our weekly roundup, where we share what you need to know about the cybersecurity news and events that happened over the past few days. This week, learn about security threats directed at smart manufacturing environments. Also, learn why malware installed from the Android app store...

Cisco IOS XE Software Performance Routing Version 3 Denial of Service Vulnerability

According to its self-reported version, Cisco IOS XE Software is affected by following vulnerability - A vulnerability in Performance Routing Version 3 PfRv3 of Cisco IOS XE Software could allow an unauthenticated, remote attacker to cause the affected device to reload.The vulnerability is due to...

Cisco IOS and IOS XE Software Smart Call Home Certificate Validation Vulnerability

According to its self-reported version, Cisco IOS XE Software is affected by following vulnerability - A vulnerability in the Cisco Smart Call Home feature of Cisco IOS and IOS XE Software could allow an unauthenticated, remote attacker to gain unauthorized read access to sensitive data using an...

Prototype Pollution

smart-extend is vulnerable to prototype pollution. An attacker is able to inject arbitrary properties on Prototype objects to execute arbitrary code or cause a denial of service...

Prototype Pollution

Overview All versions of smart-extend are vulnerable to Prototype Pollution. The deep function allows attackers to modify the prototype of Object causing the addition or modification of an existing property that will exist on all objects. Recommendation No fix is currently available. Consider usi...

Binary vulnerability in Xiaomi's Xiaoxia MINI smart speaker

Xiaomi Xiao Ai MINI Smart Speaker is a smart speaker product from Xiaomi Technology Company. Xiaomi Xiao-ai MINI Smart Speaker has a binary vulnerability that can be exploited by an attacker to allow the target speaker to receive voice commands...

Zero-Day Bug Lays Open TP-Link Smart Home Router

A zero-day bug has been uncovered in the TP-Link SR20 smart hub and home router, which would allow a local adversary to execute arbitrary commands on the device without authentication and establish a persistent backdoor for remote access. The SR20 is an all-in-one router that can also work as an...