CVE-2018-14666

An improper authorization flaw was found in the Smart Class feature of Foreman. An attacker can use it to change configuration of any host registered in Satellite, independent of the organization the host belongs to. This flaw affects all Satellite 6 versions...

This Week in Security News: Spyware and Data Breaches

Welcome to our weekly roundup, where we share what you need to know about the cybersecurity news and events that happened over the past few days. This week, learn about a spyware that disguised itself as an Android application to gather information from users. Also, find out the biggest global da...

smart-pda.net XSS vulnerability

Open Bug Bounty ID: OBB-719514 Description| Value ---|--- Affected Website:| smart-pda.net Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| hidden until disclosure Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| hidden...

Thousands of Google Chromecast Devices Hijacked to Promote PewDiePie

A group of hackers has hijacked tens of thousands of Google's Chromecast streaming dongles, Google Home smart speakers and smart TVs with built-in Chromecast technology in recent weeks by exploiting a bug that's allegedly been ignored by Google for almost five years. The attackers, who go by...

Hackers Hijack Smart TVs to Promote PewDiePie

UPDATE Hackers are taking advantage of vulnerable Chromecast and Google Home devices to display messages on consumer TVs promoting well-known YouTube star PewDiePie. Click to Expand Once hacked, the TVs display a message saying: “Public Service Announcement PewDiePie, the number 1 subscribed...

Fedora 28 : libgit2 (2018-3e021c6c2e)

This is a security release fixing out-of-bounds reads when processing smart-protocol 'ng' packets. When parsing an 'ng' packet, we keep track of both the current position as well as the remaining length of the packet itself. But instead of taking care not to exceed the length, we pass the current...

Hacking the Echo echo echo

Smart home assistant. Not-so-smart TV Amazon Echo is considered pretty secure in the security community. Remote exploitation is a pipe dream, requiring months of research to stand any chance. But what about using other devices in the home to exploit it instead? Working on a smart Samsung TV and a...

SUSE SLED15 / SLES15 Security Update : libgit2 (SUSE-SU-2018:2469-1)

This update for libgit2 to version 0.26.5 fixes the following issues: The following security vulnerabilities were addressed : - CVE-2018-10887: Fixed an integer overflow which in turn leads to an out of bound read, allowing to read the base object, which could be exploited by an attacker to cause...

CVE-2018-18602

The Cloud API on Guardzilla smart cameras allows user enumeration, with resultant arbitrary camera access and monitoring...

Code injection

The Cloud API on Guardzilla smart cameras allows user enumeration, with resultant arbitrary camera access and monitoring...

CVE-2018-18602

The Cloud API on Guardzilla smart cameras allows user enumeration, with resultant arbitrary camera access and monitoring...

CVE-2018-18602

The CVE-2018-18602 issue pertains to Guardzilla smart cameras where the Cloud API allows user enumeration, enabling arbitrary camera access and monitoring. Affected software appears to be the Guardzilla Cloud API and associated Guardzilla cameras. The root cause described across sources is user e...

CVE-2018-18602

The Cloud API on Guardzilla smart cameras allows user enumeration, with resultant arbitrary camera access and monitoring...

PT-2018-14539 · Guardzilla · Guardzilla

Name of the Vulnerable Software and Affected Versions: Guardzilla smart cameras affected versions not specified Description: The issue allows user enumeration, which can result in arbitrary camera access and monitoring. Recommendations: At the moment, there is no information about a newer version...

Code injection

The determineWinner function of a smart contract implementation for HashHeroes Tiles, an Ethereum game, uses a certain blockhash value in an attempt to generate a random number for the case where NUMTILES equals the number of people who purchased a tile, which allows an attacker to control the...

CVE-2018-17987

The determineWinner function of a smart contract implementation for HashHeroes Tiles, an Ethereum game, uses a certain blockhash value in an attempt to generate a random number for the case where NUMTILES equals the number of people who purchased a tile, which allows an attacker to control the...

CVE-2018-17987

The determineWinner function of a smart contract implementation for HashHeroes Tiles, an Ethereum game, uses a certain blockhash value in an attempt to generate a random number for the case where NUMTILES equals the number of people who purchased a tile, which allows an attacker to control the...

CVE-2018-17987

HashHeroes Tiles is affected by CVE-2018-17987 in the determineWinner function of its Ethereum smart contract. The vulnerability arises from using a blockhash value to generate a random number when NUM_TILES equals the number of tile Purchases, enabling an attacker to influence the prize by being...

A week in security (December 17 – 23)

Last week on Labs we looked at Fuchsia OS as a possible alternative for Android, explained all the reasons why cybercriminals want to hack your phone, discussed a flaw in Twitter form that may have been abused by nation states, gave you a Christmas tech scams roundup, revealed why many online...

Stored Cross-Site Scripting Vulnerability in Cloud Platform for Smart Government Construction

River network is a key news website in Henan Province, is agreed by the Henan Provincial Party Committee and Provincial Government, approved by the State Council Information Office, in the integration of the province's news and information resources based on the Henan newspaper network, the...