KLA65129 Multiple vulnerabilities in Microsoft Apps

Multiple vulnerabilities were found in Microsoft Apps. Malicious users can exploit these vulnerabilities to execute arbitrary code, gain privileges, obtain sensitive information. Below is a complete list of vulnerabilities: 1. A remote code execution vulnerability in Skype for Consumer can be...

CVE-2024-27207

Exported broadcast receivers allowing malicious apps to bypass broadcast protection...

CVE-2024-27207

Exported broadcast receivers allowing malicious apps to bypass broadcast protection...

CVE-2024-27207

Exported broadcast receivers allowing malicious apps to bypass broadcast protection...

PT-2024-22111 · Apple · Apple Macos

Name of the Vulnerable Software and Affected Versions: macOS versions prior to 14.4 Description: A logic issue was addressed with improved restrictions, allowing an unprivileged app to potentially log keystrokes in other apps, including those using secure input mode. Recommendations: For versions...

PT-2024-19785 · Apple · Macos Sonoma +5

Name of the Vulnerable Software and Affected Versions: tvOS versions prior to 17.4 iOS versions prior to 17.4 iPadOS versions prior to 17.4 macOS Sonoma versions prior to 14.4 watchOS versions prior to 10.4 Description: A privacy issue was addressed with improved private data redaction for log...

New Linux Malware Alert: ‘Spinning YARN’ Hits Docker, Other Key Apps

By Deeba Ahmed Another day, another Linux malware! This is a post from HackRead.com Read the original post: New Linux Malware Alert: Spinning YARN Hits Docker, Other Key Apps...

CVE-2023-49602 Arkui has a type confusion vulnerability

in OpenHarmony v3.2.4 and prior versions allow a local attacker cause apps crash through type confusion...

CVE-2023-46708 Wlan has a use after free vulnerability

in OpenHarmony v3.2.4 and prior versions allow a local attacker arbitrary code execution in any apps through use after free...

The Privacy Danger Lurking in Push Notifications

Plus: Apple warns about sideloading apps, a court orders NSO group to turn over the code of its Pegasus spyware, and an investigation finds widely available security cams are wildly insecure...

Malicious code in @apics/apps-ppp-web (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis a11545fc54b4d0cdd2e0e8de4ab835b254677aff86d325e9bec6a0a6b5e090a8 The OpenSSF Package Analysis project identified '@apics/apps-ppp-web' @ 9.39.1 npm as malicious. It is considered malicious because: - The packa...

The mobile malware threat landscape in 2023

The figures above are based on detection statistics received from Kaspersky users who consented to sharing usage data with Kaspersky Security Network. The data for years preceding 2023 may differ from that published previously, as the calculation methodology was refined, and the data was...

Denial of Service (DoS)

Overview rack is a minimal, modular and adaptable interface for developing web applications in Ruby. By wrapping HTTP requests and responses in the simplest way possible, it unifies and distills the API for web servers, web frameworks, and software in between the so-called middleware into a singl...

Gradio apps vulnerable to timing attacks to guess password

Impact This security policy is with regards to a timing attack that allows users of Gradio apps to potentially guess the password of password-protected Gradio apps. This relies on the fact that string comparisons in Python terminate early, as soon as there is a string mismatch. Because Gradio app...

Apple iOS and iPadOS Security Vulnerabilities

Apple iOS and Apple iPadOS are products of Apple Inc. Apple iOS is an operating system developed for mobile devices, and Apple iPadOS is an operating system for iPad tablets. A security vulnerability exists in Apple iOS version 16.7.2 and iPadOS version 16.7.2, which originates from an applicatio...

Anatsa Android Trojan Bypasses Google Play Security, Expands Reach to New Countries

The Android banking trojan known as Anatsa has expanded its focus to include Slovakia, Slovenia, and Czechia as part of a new campaign observed in November 2023. "Some of the droppers in the campaign successfully exploited the accessibility service, despite Google Play's enhanced detection and...

SISQUALWFM 7.1.319.103 - Host Header Injection Vulnerability

Exploit Title: SISQUALWFM 7.1.319.103 Host Header Injection Discovered Date: 17/03/2023 Reported Date: 17/03/2023 Resolved Date: 13/10/2023 Exploit Author: Omer Shaik unknownexploit Vendor Homepage: https://www.sisqualwfm.com Version: 7.1.319.103 Tested on: SISQUAL WFM 7.1.319.103 Affected Versio...

Android App "Mopria Print Service" vulnerable to improper intent handling

Overview Android app "Mopria Print Service" provided by Mopria Alliance is vulnerable to improper intent handling CWE-668. Johan Francsics reported this vulnerability to JPCERT/CC. JPCERT/CC coordinated with the developer. Impact When a malicious app is installed on the victim user's Android...

PT-2024-20011 · Unknown · Online-Ausweis-Funktion Eid

Name of the Vulnerable Software and Affected Versions: Online-Ausweis-Funktion eID scheme in the German National Identity card through 2024-02-15 Description: The issue allows authentication bypass by spoofing, enabling a man-in-the-middle attacker to assume a victim's identity and access...

dotnet: Denial of Service in SignalR server

A denial of service vulnerability is present in the .NET applications utilizing SignalR, which a malicious client can exploit. The issue arises from inadequate validation of user-supplied input in .NET. This flaw allows a remote attacker to trigger a denial of service DoS attack by providing...