Google Play Bans Stalkerware and 'Misrepresentation'

Google is taking the step of prohibiting “stalkerware” in Google Play, along with apps that could be used in political-influence campaigns. Effective October 1, apps that would allow someone to surreptitiously track the location or online activity of another person will be removed from the intern...

After Upgrading to iOS 14 And Opening MDX Wrapped Apps Prompt Displays - "Compliance Error - Your device is out of compliance...MDX Encryption is not supported"

After Upgrading to iOS14 and opening MDX Wrapped Apps or Citrix Secure Mail/Hub/Web Displays - "Compliance Error - Your device is out of compliance. Please contact your administrator. MDX Encryption is not supported beyond iOS 13. Please reinstall the app."...

Rapid7 and Snyk Are on the Run(time) with Expanded SCA Capabilities

Earlier this year, Rapid7 and Snyk partnered together with the goal of securing cloud-native apps across the software development lifecycle SDLC. As modern development teams continue to adopt new technology that helps them accelerate their efforts, security teams are tasked with making sure they...

Security Update for Microsoft Office Web Apps Server 2013 (KB4484518)

A security vulnerability exists in Microsoft Office Web Apps Server 2013 that could allow arbitrary code to run when a maliciously modified file is opened. This update resolves that vulnerability...

Security Update for Microsoft Office Web Apps Server 2013 (KB4484518) farm-deployment

A security vulnerability exists in Microsoft Office Web Apps Server 2013 that could allow arbitrary code to run when a maliciously modified file is opened. This update resolves that vulnerability...

Cryptobugs Found in Numerous Google Play Store Apps

Researchers have discovered more than 300 apps on the Google Play Store breaking basic cryptography code using a new tool they developed to dynamically analyze it. Academics from Columbia University developed a custom tool, CRYLOGGER, that analyzes Android applications for unsafe use of...

Description of the security update for SharePoint Server 2010 Office Web Apps: September 8, 2020

Description of the security update for SharePoint Server 2010 Office Web Apps: September 8, 2020 Summary This security update resolves a remote code execution vulnerability that exists in Microsoft Word software if the software does not correctly handle objects in memory. To learn more about the...

Description of the security update for Office Web Apps Server 2013: September 8, 2020

None None...

About the security content of macOS Catalina 10.15.3, Security Update 2020-001 Mojave, Security Update 2020-001 High Sierra - Apple Support

About Apple security updates For our customers' protection, Apple doesn't disclose, discuss, or confirm security issues until an investigation has occurred and patches or releases are available. Recent releases are listed on the Apple security updates page. Apple security documents reference...

Security Updates for Microsoft Office Web Apps (September 2020)

The Microsoft Office Web Apps installation on the remote host is missing security updates. It is, therefore, affected by multiple vulnerabilities : - An information disclosure vulnerability exists when Microsoft Excel improperly discloses the contents of its memory. An attacker who exploited the...

Pocsuite

This is an offensive tool for vulnerability exploitation. It is a Python-based framework for developing and executing proof-of-concept PoC exploits, primarily targeting web applications. The framework, known as Pocsuite, is designed to simplify the process of creating and executing exploits, maki...

Kleopatra: Remote code execution

Background Kleopatra is a certificate manager and a universal crypto GUI. It supports managing X.509 and OpenPGP certificates in the GpgSM keybox and retrieving certificates from LDAP servers. Description Kleopatra did not safely escape command line parameters provided by URLs, which it configure...

Facebook Hits Back At Apple’s iOS 14 Privacy Update

Facebook is lambasting an upcoming Apple mobile operating system privacy update, which requires application to ask users for permission before collecting and sharing their data. In the iOS 14 update, Apple iPhone and iPad users have an explicit option to opt out of allowing apps to collect data...

TikTok: Cross-Site-Scripting on www.tiktok.com and m.tiktok.com leading to Data Exfiltration

The researcher discovered a URL parameter reflecting its value without being properly sanitized and was able to achieve reflected XSS. In addition, researcher found an endpoint which was vulnerable to CSRF. The endpoint allowed to set a new password on accounts which had used third-party apps to...

Malicious SDK found spying & defrauding users through iOS apps

By Deeba Ahmed The malicious SDK is distributed by China-based firm Mintegral. This is a post from HackRead.com Read the original post: Malicious SDK found spying & defrauding users through iOS apps...

Popular iOS SDK Accused of Spying on Billions of Users and Committing Ad Fraud

A popular iOS software development kit SDK used by over 1,200 apps—with a total of more than a billion mobile users—is said to contain malicious code with the goal of perpetrating mobile ad-click fraud and capturing sensitive information. According to a report published by cybersecurity firm Snyk...

A week in security (August 17 – 23)

Last week on Malwarebytes Labs, we looked at the impact of COVID-19 on healthcare cybersecurity, dug into some pandemic stats in terms of how workforces coped with going remote, and served up a crash course on malware detection. Our most recent Lock and Code podcast explored the safety of parenta...

US Secret Service used ‘Locate X’ to track user location without warrant

By Zara Khan Locate X collects location data from smartphone apps. This is a post from HackRead.com Read the original post: US Secret Service used Locate X to track user location without warrant...

How Financial Apps Get You to Spend More and Question Less

You should never invest without fully understanding the risks, but tax prep and stock trading services often obfuscate the things you really need to know...

HTTP/HTTPS proxy support on NetScaler based on Traffic Policies Secure Web

This article describes how to configure NetScaler to proxy the traffic from MDX apps through a Proxy server like Squid, Bluecoat. Enterprises can proxy traffic configuring simple traffic rules on NetScaler box...