Read Time:2 Second
Researchers discover database exposed through misconfiguration
Monthly Archives: April 2022
US Action Disrupts Russian Botnet Cyclops Blink
USN-5366-1: FriBidi vulnerabilities
Read Time:38 Second
It was discovered that FriBidi incorrectly handled processing of input strings
resulting in memory corruption. An attacker could use this issue to cause
FriBidi to crash, resulting in a denial of service, or potentially execute
arbitrary code.
(CVE-2022-25308)
It was discovered that FriBidi incorrectly validated input data to its CapRTL
unicode encoder, resulting in memory corruption. An attacker could use this
issue to cause FriBidi to crash, resulting in a denial of service, or
potentially execute arbitrary code.
(CVE-2022-25309)
It was discovered that FriBidi incorrectly handled empty input when removing
marks from unicode strings, resulting in a crash. An attacker could use this
to cause FriBidi to crash, resulting in a denial of service, or potentially
execute arbitrary code.
(CVE-2022-25310)
CVE-2020-27376
Read Time:6 Second
Dr Trust USA iCheck Connect BP Monitor BP Testing 118 version 1.2.1 is vulnerable to Missing Authentication.
CVE-2020-27375
Read Time:7 Second
Dr Trust USA iCheck Connect BP Monitor BP Testing 118 version 1.2.1 is vulnerable to Transmitting Write Requests and Chars.
CVE-2020-27374
Read Time:7 Second
Dr Trust USA iCheck Connect BP Monitor BP Testing 118 1.2.1 is vulnerable to a Replay Attack to BP Monitoring.
CVE-2020-27373
Read Time:6 Second
Dr Trust USA iCheck Connect BP Monitor BP Testing 118 1.2.1 is vulnerable to Plain text command over BLE.
DSA-5114 chromium – security update
Read Time:7 Second
Sergei Glazunov discovered a security issue in Chromium, which
could result in the execution of arbitrary code if a malicious
website is visited.
CVE-2020-22253
Read Time:14 Second
Xiongmai Technology Co devices AHB7008T-MH-V2, AHB7804R-ELS, AHB7804R-MH-V2, AHB7808R-MS-V2, AHB7808R-MS, AHB7808T-MS-V2, AHB7804R-LMS, and HI3518E_50H10L_S39 were all discovered to have port 9530 open which allows unauthenticated attackers to make arbitrary Telnet connections with the victim device.
Smashing Security podcast #269: Trezor Deep Throat, a CCTV stalker, and Amazon’s list of banned words
Read Time:18 Second
There’s monkey business involving cryptocurrency thieves and MailChimp, a stalker exploits his ex-partner’s CCTV cameras, and what are the naughty words Amazon doesn’t want its staff using?
All this and much more is discussed in the latest edition of the award-winning “Smashing Security” podcast by computer security veterans Graham Cluley and Carole Theriault, joined this week by Zoë Rose.