CVE-2016-6548 Zizai Tech Nut mobile application makes requests using HTTP, which includes the users session token

The Zizai Tech Nut mobile app makes requests via HTTP instead of HTTPS. These requests contain the user's authenticated session token with the URL. An attacker can capture these requests and reuse the session token to gain full access the user's account...

CVE-2016-6547

The CVE-2016-6547 issue affects the Zizai Tech Nut mobile app, where the account password used to authenticate to the cloud API is stored in cleartext in the cache.db file. This creates a local information exposure risk, enabling a user with access to the device to retrieve sensitive credentials....

CVE-2016-6548

The CVE-2016-6548 entry concerns the Zizai Tech Nut mobile app, where HTTP requests leak the user’s authenticated session token in the URL. This exposes the session token to network-level observers, enabling potential account takeover since the token can be reused to access the user’s account. Th...

CVE-2016-6549

The CVE-2016-6549 entry concerns the Zizai Tech Nut device, where unauthenticated Bluetooth pairing enables unauthenticated connected applications to write data to the device name attribute. Affected component is the Nut device’s Bluetooth pairing/authentication logic, with impact limited to mani...

CVE-2016-6549 Zizai Tech Nut allows for unauthenticated Bluetooth pairing

The Zizai Tech Nut device allows unauthenticated Bluetooth pairing, which enables unauthenticated connected applications to write data to the device name attribute...

Akamai Welcomes Girls Who Code

Akamai employees in Cambridge have started to see some new faces around the office for the summer - 20+ high school juniors to be specific! For the fourth consecutive year, Akamai is partnering with Girls Who Code to host a seven-week long summer immersion program dedicated to closing the gender...

Spectre bug protection forcing Chrome to use 10 to 13% more RAM

By Uzair Amir The entire tech industry was shaken after the discovery of This is a post from HackRead.com Read the original post: Spectre bug protection forcing Chrome to use 10 to 13% more RAM...

CVE-2016-6547: Cleartext Storage in a File or on Disk

The Zizai Tech Nut mobile app stores the account password used to authenticate to the cloud API in cleartext in the cache.db file...

CVE-2016-6548: Exposure of Sensitive Information to an Unauthorized Actor

The Zizai Tech Nut mobile app makes requests via HTTP instead of HTTPS. These requests contain the user's authenticated session token with the URL. An attacker can capture these requests and reuse the session token to gain full access the user's account...

CVE-2016-6549: Missing Authentication for Critical Function

The Zizai Tech Nut device allows unauthenticated Bluetooth pairing, which enables unauthenticated connected applications to write data to the device name attribute...

PT-2018-4949

Name of the Vulnerable Software and Affected Versions Zizai Tech Nut mobile app affected versions not specified Description The issue concerns the Zizai Tech Nut mobile app making requests via HTTP instead of HTTPS, which includes the user's authenticated session token in the URL. This allows an...

PT-2018-4948

Name of the Vulnerable Software and Affected Versions Zizai Tech Nut mobile app affected versions not specified Description The issue concerns the storage of account passwords in cleartext within the cache.db file of the app, which is used for authentication to the cloud API. Recommendations At t...

PT-2018-4950

Name of the Vulnerable Software and Affected Versions Zizai Tech Nut device affected versions not specified Description The issue allows unauthenticated Bluetooth pairing, enabling unauthenticated connected applications to write data to the device name attribute. Recommendations At the moment,...

Free High-Tech Bridge ImmuniWeb Application Discovery service

Today I would like to talk about another service for application security analysis by High-Tech Bridge. It's called ImmuniWeb Application Discovery. This service can get information about your web and mobile applications available from the Internet. Believe me, this is not so obvious for a large...

Breaking up is hard to do… with IoT

Evidence is starting to emerge of former partners stalking their ex through the smart tech in their home. If you have a break up, what steps should you take to protect yourself? Is the very tech that is supposed to protect you actually exposing you to your ex? Smart doorbells I was contacted by a...

California Passes New Privacy Law

The California legislature unanimously passed the strongest data privacy law in the nation. This is great news, but I have a lot of reservations. The Internet tech companies pressed to get this law passed out of self-defense. A ballot initiative was already going to be voted on in November, one...

Facebook Admits Sharing Users' Data With 61 Tech Companies

Facebook has admitted that the company gave dozens of tech companies and app developers special access to its users' data after publicly saying it had restricted outside companies to access such data back in 2015. It's an unusual clear view of how the largest social networking site manages your...

A week in security (June 11 – June 17)

Last week on Malwarebytes Labs, we discussed how to protect the online privacy of children, we gave you a spring 2018 overview of exploit kits, rounded up the ongoing discussions about the VPNFilter malware, and discussed the struggles of UK law enforcement with modern-day cybercrime. Other news...

Security Bulletin: Multiple vulnerabilities in IBM Java SDK 7 affect IBM Systems Director.

Summary There are multiple vulnerabilities in IBM SDK Java Technology Edition, Version 7 that is used by IBM Systems Director. These issues were disclosed as part of the IBM Java SDK updates in July 2017. Vulnerability Details CVEID: CVE-2017-10115 DESCRIPTION: An unspecified vulnerability in...

Security Bulletin: Multiple vulnerabilities in IBM® SDK Java™ Technology Edition affect Data Studio, InfoSphere Data Architect, Optim Query Workload Tuner for Linux, UNIX and Windows, and Optim Query Workload Tuner for z/OS (CVE-2016-0466, CVE-2015-7575)

Summary There are multiple vulnerabilities in IBM® SDK Java™ Technology Edition that is used by IBM Data Studio, InfoSphere Data Architect, Optim Query Workload Tuner for Linux, UNIX and Windows, and Optim Query Workload Tuner for z/OS. These issues were disclosed as part of the IBM Java SDK...