CVE-2020-16267

CVE-2020-16267 affects Zoho ManageEngine Applications Manager up to version 14740. The vulnerability is an authenticated SQL Injection in the RCA module triggered by a crafted JSP request, allowing an attacker with valid credentials to influence database queries. The NVD CVSS data shows a high im...

@amazingcat/amazing-iohook (>=8.2.3, <=8.3.3), @donmahallem/trapeze-client-desktop (5.1.1) +15 more potentially affected by CVE-2020-15215 via electron (>=8.0.0, <=8.5.1)

electron NPM version =8.0.0, =8.2.3, =8.0.0-beta.1, =0.1.0, =4.0.0-beta.1, =1.0.1, =1.7.0, =1.0.3, =1.0.5, =0.0.1, =1.1.35, =1.1.51 and more Source cves: CVE-2020-15215 Source advisory: OSV:GHSA-56PC-6JQP-XQJ8...

GHSA-56PC-6JQP-XQJ8 Context isolation bypass in Electron

Impact Apps using both contextIsolation and sandbox: true are affected. Apps using both contextIsolation and nativeWindowOpen: true are affected. This is a context isolation bypass, meaning that code running in the main world context in the renderer can reach into the isolated Electron context an...

@amazingcat/amazing-iohook (>=8.2.3, <=8.3.3), @donmahallem/trapeze-client-desktop (5.1.1) +15 more potentially affected by CVE-2020-15174 via electron (>=8.0.0, <=8.5.0)

electron NPM version =8.0.0, =8.2.3, =8.0.0-beta.1, =0.1.0, =4.0.0-beta.1, =1.0.1, =1.7.0, =1.0.3, =1.0.5, =0.0.1, =1.1.35, =1.1.51 and more Source cves: CVE-2020-15174 Source advisory: OSV:GHSA-2Q4G-W47C-4674...

Android WebView Universal Cross-site Scripting

A universal cross-site scripting UXSS vulnerability, CVE-2020-6506 https://crbug.com/1083819, has been identified in the Android WebView system component, which allows cross-origin iframes to execute arbitrary JavaScript in the top-level document. This vulnerability affects React Native apps whic...

GHSA-36J3-XXF7-4PQG Android WebView Universal Cross-site Scripting

A universal cross-site scripting UXSS vulnerability, CVE-2020-6506 https://crbug.com/1083819, has been identified in the Android WebView system component, which allows cross-origin iframes to execute arbitrary JavaScript in the top-level document. This vulnerability affects React Native apps whic...

QR Codes: A Sneaky Security Threat

If it seems like QR codes have popped up everywhere these days, you’re right. Ever since they were first used by the Japanese auto industry to streamline manufacturing processes, companies everywhere have capitalized on the benefits of QR codes. They’re cheap to deploy and can be applied to almos...

Beware: New Android Spyware Found Posing as Telegram and Threema Apps

A hacking group known for its attacks in the Middle East, at least since 2017, has recently been found impersonating legitimate messaging apps such as Telegram and Threema to infect Android devices with a new, previously undocumented malware. "Compared to the versions documented in 2017,...

ASB-A-142125338

In generateInfo of PackageInstallerSession.java, there is a possible leak of cross-profile URI data during app installation due to a missing permission check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for...

OAuth Consent Phishing Ramps Up with Microsoft Office 365 Attacks

An APT known as TA2552 has been spotted using OAuth2 or other token-based authorization methods to access Office 365 accounts, in order to steal users’ contacts and mail. OAuth is an open standard for access delegation, commonly used as a way for people to sign into services without entering a...

Code injection

An issue was discovered in the GAEN aka Google/Apple Exposure Notifications protocol through 2020-09-29, as used in COVID-19 applications on Android and iOS. It allows a user to be put in a position where he or she can be coerced into proving or disproving an exposure notification, because of the...

Identity Fraud: How to Protect Your Identity Data, Accounts and Money During the Coronavirus Crisis

We’ve all been spending more of our time online since the crisis hit. Whether it’s ordering food for delivery, livestreaming concerts, holding virtual parties, or engaging in a little retail therapy, the digital interactions of many Americans are on the rise. This means we’re also sharing more of...

CVE-2020-25144

An issue was discovered in Observium Professional, Enterprise & Community 20.8.10631. It is vulnerable to directory traversal and local file inclusion due to the fact that there is an unrestricted possibility of loading any file with an inc.php extension. Inclusion of other files even though...

A Tip From a Kid Helped Uncover a Slew of Scam Apps

After a girl reported a suspicious TikTok profile, researchers detected aggressive adware in apps that had been downloaded 2.4 million times...

Unable to add published apps icons in the endpoint’s Desktop

The customer is installing CWA1912 in multiple endpoint machines running Windows 7 for one of his clients He is using a 3rd party tool to install CWA via CLI massively. He is pushing the StoreFront Store via GPO and not through the installation command. He already installed CWA in some machines a...

TikTokers promoted adware apps; earned half a million dollars in profit

By Sudais Asif According to researchers, some prominent TikTokers earned up to $500,000 by promoting adware apps. This is a post from HackRead.com Read the original post: TikTokers promoted adware apps; earned half a million dollars in profit...

Identity at Microsoft Ignite: Rising to the challenges of secure remote access and employee productivity

These past months have changed the way we work in so many ways. When businesses and schools went remote overnight, many of you had to adapt quickly to ensure your users could stay productive while working from home. Bad actors are trying to exploit these seismic shifts, making it more important...

Enable secure remote work, address regulations and uncover new risks with Microsoft Compliance

As we talk with a broad range of customers in the current environment, we hear some consistent challenges businesses are facing. With so many remote workers, people are creating, sharing, and storing data in new ways, which fosters productivity, but can also introduce new risks. A recent Microsof...

Android 11 — 5 New Security and Privacy Features You Need to Know

After a long wait and months of beta testing, Google last week finally released Android 11, the latest version of the Android mobile operating system—with features offering billions of its users more control over their data security and privacy. Android security is always a hot topic and almost...

CVE-2020-5629

UNIQLO App for Android versions 7.3.3 and earlier allows remote attackers to lead a user to access an arbitrary website via a malicious App created by the third party. As a result, if the access destination is a malicious website, the user may fall victim to the social engineering attack...