Members of Google’s Android team discovered that some of Honeywell’s Android-based handheld computers are affected by a high severity privilege escalation vulnerability. The vendor has released software updates that should address the flaw.
http://feedproxy.google.com/~r/Securityweek/~3/sIs-VqS–E8/googles-android-team-finds-serious-flaw-honeywell-devices
One year after researchers disclosed the Bluetooth vulnerabilities dubbed BlueBorne, more than 2 billion devices are believed to still be vulnerable to attacks, either because their owners have failed to install patches or due to the fact that no patches are available.
http://feedproxy.google.com/~r/Securityweek/~3/Qurrgzj3950/one-year-later-over-2-billion-devices-still-exposed-blueborne-attacks
Researchers discovered that the firmware running on nearly all modern computers is vulnerable to cold boot attacks that can allow hackers to recover highly sensitive data from the device’s memory.
http://feedproxy.google.com/~r/Securityweek/~3/LrbyWII0nAg/new-firmware-flaws-resurrect-cold-boot-attacks
Several vulnerabilities rated “high severity” have been discovered by researchers in Fuji Electric V-Server. The vendor has released updates that should address the flaws.
The existence of the security holes, all of which could allow a remote attacker to execute arbitrary code, was made public this week when ICS-CERT published two advisories.
http://feedproxy.google.com/~r/Securityweek/~3/zrMZICJkImQ/flaws-found-fuji-electric-tool-links-corporate-pcs-ics
A researcher has discovered an address bar spoofing vulnerability in the Microsoft Edge and Apple Safari web browsers, but a patch is currently only available for the former.
http://feedproxy.google.com/~r/Securityweek/~3/jDjkPE1BT40/address-bar-spoofing-flaw-found-edge-safari
Microsoft’s Patch Tuesday updates for September 2018 address over 60 vulnerabilities, including a zero-day disclosed by a researcher and exploited shortly after by a threat actor.
http://feedproxy.google.com/~r/Securityweek/~3/UHhEU_ILpns/microsoft-patches-windows-zero-day-disclosed-twitter
SAP today released its September 2018 set of patches to address a total of 14 vulnerabilities in its products, including a critical bug in SAP Business Client.
http://feedproxy.google.com/~r/Securityweek/~3/LWqzIar7avI/sap-patches-critical-vulnerability-business-client
Adobe’s Patch Tuesday updates for September 2018 address a total of 10 vulnerabilities in Flash Player and ColdFusion, but none of the flaws appear too serious.
http://feedproxy.google.com/~r/Securityweek/~3/sxzQK90wer0/adobe-patches-vulnerabilities-flash-player-coldfusion
Researchers claim to have discovered a new attack method that can be used to quickly clone the wireless key fob of Tesla Model S and possibly other vehicles.
http://feedproxy.google.com/~r/Securityweek/~3/fTmpNIR46qw/hackers-can-clone-tesla-key-fobs-seconds
Exploit acquisition firm Zerodium has disclosed a NoScript vulnerability that can be exploited to execute arbitrary JavaScript code in the Tor Browser even if the maximum security level is used.
http://feedproxy.google.com/~r/Securityweek/~3/tQyk5M9iQqA/zerodium-discloses-flaw-allows-code-execution-tor-browser