CVE-2021-21732

A mobile phone of ZTE is impacted by improper access control vulnerability. Due to improper permission settings, third-party applications can read some files in the proc file system without authorization. Attackers could exploit this vulnerability to obtain sensitive information. This affects Axo...

Wrong TimeLockERC20 event emitted

Handle cmichel Vulnerability details Vulnerability Details The Visor.timeLockERC721 function emits the TimeLockERC20 event but should emit TimeLockERC721 instead. Impact It allows tricking the backend into registering ERC20 token transfers that never happened which could lead to serious issues wh...

Debian DSA-4918-1 : ruby-rack-cors - security update

Improper pathname handling in ruby-rack-cors, a middleware that makes Rack-based apps CORS compatible, may result in access to private resources. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from Debian Security Advisor...

CVE-2021-31318

Telegram Android 7.1.0 2090, Telegram iOS 7.1, and Telegram macOS 7.1 are affected by a Type Confusion in the LOTCompLayerItem::LOTCompLayerItem function of their custom fork of the rlottie library. A remote attacker might be able to access heap memory out-of-bounds on a victim device via a...

CVE-2021-31321

Telegram Android 7.1.0 2090, Telegram iOS 7.1, and Telegram macOS 7.1 are affected by a Stack Based Overflow in the graysplitcubic function of their custom fork of the rlottie library. A remote attacker might be able to overwrite Telegram's stack memory out-of-bounds on a victim device via a...

UBUNTU-CVE-2021-31321

Telegram Android 7.1.0 2090, Telegram iOS 7.1, and Telegram macOS 7.1 are affected by a Stack Based Overflow in the graysplitcubic function of their custom fork of the rlottie library. A remote attacker might be able to overwrite Telegram's stack memory out-of-bounds on a victim device via a...

iPhone calendar spam attacks on the rise

Recently, we have seen an increasing number of reports from iPhone users about their calendars filling up with junk events. These events are most often either pornographic in nature, or claim that the device has been infected or hacked, and in all cases they contain malicious links. This phenomen...

How to secure your hybrid work world with a Zero Trust approach

We are operating in the most complex cybersecurity landscape we’ve ever seen. Sophisticated and determined attackers are the norm. And we all are preparing for the next great disruption—hybrid work. Security has never been more important, and as I shared in another Security blog today, it’s clear...

Citrix Workspace App - Duplicate published app icons showing up in the endpoints

The customer recently deployed CWA through all company’s workstations and created a GPO to push the Store to CWA in the machines He noticed after the deployment that the endpoints and CWA show a duplicate of each published app Also, CWA shows two stores of the same name...

Description of the security update for Office Web Apps Server 2013: May 11, 2021 (KB5001928)

None None...

Microsoft Office Word 代码注入漏洞

Microsoft Word is a word processing software in the Office suite from Microsoft Corporation USA. A code injection vulnerability exists in Microsoft Office Word. The following products and editions are affected: Microsoft Word 2016 32-bit edition,Microsoft Word 2016 64-bit edition,Microsoft Office...

Microsoft Office 资源管理错误漏洞

Microsoft Office is an office software suite of products from the U.S. company Microsoft Microsoft. Commonly used components of this product include Word, Excel, Access, Powerpoint, FrontPage, and others. A resource management error vulnerability exists in Microsoft Office. The following products...

Microsoft Excel 缓冲区错误漏洞

Microsoft Excel is a spreadsheet processing software in the Office suite from Microsoft Corporation USA. A buffer error vulnerability exists in Microsoft Office Excel. The following products and editions are affected:Microsoft Office 2019 for 32-bit editions,Microsoft Office 2019 for 64-bit...

Microsoft Office 资源管理错误漏洞

Microsoft Office is an office software suite of products from the U.S. company Microsoft Microsoft. Commonly used components of this product include Word, Excel, Access, Powerpoint, FrontPage, and others. A resource management error vulnerability exists in Microsoft Office. The following products...

PT-2021-3143 · Microsoft · 365 Apps For Enterprise +3

Name of the Vulnerable Software and Affected Versions: Microsoft Office Graphics affected versions not specified Microsoft 365 Apps for Enterprise affected versions not specified Microsoft Word affected versions not specified Description: The issue is related to incorrect code generation manageme...

Microsoft Excel 数字错误漏洞

Microsoft Excel is a spreadsheet processing software in the Office suite from Microsoft Corporation USA. A numeric error vulnerability exists in Microsoft Office Excel. The following products and editions are affected:Microsoft Office 2019 for 32-bit editions,Microsoft Office Web Apps Server 2013...

Security Updates for Microsoft Office Web Apps (May 2021)

The Microsoft Office Web Apps installation on the remote host is missing security updates. It is, therefore, affected by multiple vulnerabilities: - A remote code execution vulnerability. An attacker can exploit this to bypass authentication and execute unauthorized arbitrary commands...

CVE-2021-27571

An issue was discovered in Emote Remote Mouse through 4.0.0.0. Attackers can retrieve recently used and running applications, their icons, and their file paths. This information is sent in cleartext and is not protected by any authentication logic...

CVE-2021-27571

An issue was discovered in Emote Remote Mouse through 4.0.0.0. Attackers can retrieve recently used and running applications, their icons, and their file paths. This information is sent in cleartext and is not protected by any authentication logic...

Malicious Office 365 Apps Are the Ultimate Insiders

Phishers targeting Microsoft Office 365 users increasingly are turning to specialized links that take users to their organizations own email login page. After a user logs in, the link prompts them to install a malicious but innocuously-named app that gives the attacker persistent, password-free...