CVE-2018-21235

CVE-2018-21235 affects Foxit E-mail advertising system versions prior to September 2018, with the issue described as an authentication bypass and information disclosure related to Interspire Email Marketer. Data from connected sources confirms a network-accessible vulnerability with partial confi...

PT-2020-8879

Name of the Vulnerable Software and Affected Versions Foxit E-mail advertising system versions prior to September 2018 Description An issue in the Foxit E-mail advertising system allows authentication bypass and information disclosure, related to Interspire Email Marketer. Recommendations For...

CVE-2018-21235: Improper Authentication

An issue was discovered in Foxit E-mail advertising system before September 2018. It allows authentication bypass and information disclosure, related to Interspire Email Marketer...

Cisco Wireless LAN Controllers Frame Processing Buffer Overflow DoS

The vulnerability of the Generic Advertising Service GAS frame processing function in Cisco Wireless LAN Controllers based on the 802.11 protocol is related to the execution of operations outside the buffer in memory. Exploiting this vulnerability can allow an attacker to cause a service failure ...

Google Location Tracking Lambasted in Arizona Lawsuit

Google has been hit by a lawsuit alleging that it violates user privacy by collecting location data via various means – and claiming that Google makes it nearly “impossible” for users to opt out of such data tracking. The lawsuit, filed by Arizona Attorney General Mark Brnovich, alleges that Goog...

Aggressive in-app advertising in Android

Recently, we've been noticing ever more dubious advertising libraries in popular apps on Google Play. The monetization methods used in such SDKs can pose a threat to users, yet they pull in more revenue for developers than whitelisted ad modules due to the greater number of views. In this post we...

CVE-2020-12858

Non-reinitialisation of random data in the advertising payload in COVIDSafe v1.0.15 and v1.0.16 allows a remote attacker to re-identify Android devices running COVIDSafe by scanning for their advertising beacons...

Code injection

Non-reinitialisation of random data in the advertising payload in COVIDSafe v1.0.15 and v1.0.16 allows a remote attacker to re-identify Android devices running COVIDSafe by scanning for their advertising beacons...

CVE-2020-12858

The CVE-2020-12858 entry concerns the COVIDSafe Android app, where non-reinitialisation of random data in the advertising payload in versions v1.0.15 and v1.0.16 allows a remote attacker to re-identify devices by scanning advertising beacons. Affected component: COVIDSafe app’s advertising beacon...

CVE-2020-12858: Use of Insufficiently Random Values

Non-reinitialisation of random data in the advertising payload in COVIDSafe v1.0.15 and v1.0.16 allows a remote attacker to re-identify Android devices running COVIDSafe by scanning for their advertising beacons...

PT-2020-13303

Name of the Vulnerable Software and Affected Versions COVIDSafe versions 1.0.15 through 1.0.16 Description The issue concerns non-reinitialisation of random data in the advertising payload, allowing a remote attacker to re-identify Android devices running COVIDSafe by scanning for their advertisi...

Logic flaw vulnerability in YCCMS Ad***.cl***.php file

YCCMS is a version of PHP5 + MYSQL as the technical basis for the development of lightweight CMS station-building system. A logic flaw exists in the YCCMS Ad.cl.php file. An attacker can use the vulnerability to change any user name and password without authorization...

'ICEBUCKET" Streaming TV Fraudsters Steal Millions of Ad Dollars in 'ICEBUCKET' Attack

A massive television ad fraud campaign that abuses the programmatic advertising ecosystem for connected TV CTV has successfully impersonated more than 2 million people in over 30 countries so far during its run, defrauding more than 300 different brands out of their ad dollars. The recently...

Apple App Store Riddled With Money-Sucking Fleeceware Apps

Researchers are warning iPhone users of fleeceware apps after finding more than 30 examples of them on Apple’s App Store. Fleeceware is jargon for apps that trick users into paying excessive fees for basic applications and functionality that is available free elsewhere. Many of these fleeceware...

Security and Privacy Implications of Zoom

Over the past few weeks, Zoom's use has exploded since it became the video conferencing platform of choice in today's COVID-19 world. My own university, Harvard, uses it for all of its classes. Boris Johnson had a cabinet meeting over Zoom. Over that same period, the company has been exposed for...

Dozens of Android Apps for Kids on Google Play Store Caught in Ad Fraud Scheme

More than 50 Android apps on the Google Play Store—most of which were designed for kids and had racked up almost 1 million downloads between them—have been caught using a new trick to secretly click on ads without the knowledge of smartphone users. Dubbed "Tekya," the malware in the apps imitated...

SQL Injection Vulnerability in Shanghai Enterprise Torch Advertising Media Co.

Ltd. is committed to providing all kinds of enterprises and institutions with network domain name registration, web hosting rental, website construction and maintenance, website promotion and publicity, website revision and translation, enterprise post office, network payment, system integration,...

Bring your own privacy: VPNs for consumers and orgs

VPNs virtual private networks have been popular for quite some time now, and they’re worth a huge amount of money for the companies working in this area. They’re also at the forefront of combating potential repression and censorship around the world. It might all sound a bit esoteric and unrelate...

The Case for Limiting Your Browser Extensions

Last week, KrebsOnSecurity reported to health insurance provider Blue Shield of California that its Web site was flagged by multiple security products as serving malicious content. Blue Shield quickly removed the unauthorized code. An investigation determined it was injected by a browser extensio...

Nord Security: NordVPN Android Application privacy violation due to Google Advertising Identifier misuse

The researcher reported an issue regarding somewhat incorrect GAID usage integration in our application. The concerns were valid and properly addressed by our team...