What's the point of habitual cookie consent? Analytics?

Last week I read an online post about schoolchildren who are taught in their IT lessons to just accept cookie consent pop-ups when they see them on the screen! That really is the definition of habitual consent. If we think about the intent of consent, it should be informed, unambiguous, and...

Cisco IOS XE Software Consent Token Bypass (cisco-sa-iosxe-ctbypass-7QHAfHkK)

According to its self-reported version, Cisco IOS XE Software is affected by a consent token bypass vulnerability. An authenticated, local attacker can exploit this via gaining shell access on an affected device and executing commands on the underlying operating system OS with root privileges...

Office 365 OAuth Attack Targets Coinbase Users

Office 365 users are receiving emails purporting to come from cryptocurrency platform Coinbase, which ask them to download updated Terms of Service via an OAuth consent app. But when they agree to do so, users are unknowingly giving attackers full access to their email. OAuth is an open standard...

Cross-Site Scripting (XSS)

matrixsynapse is vulnerable to cross-site scripting XSS. A attacker is able to inject and execute arbitrary Javascript in a user's browser via the reCAPTCHA, consent terms of service, or single sign-on functions...

wuebken.de Cross Site Scripting vulnerability OBB-1410588

Following coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: &nbsp&nbsp&nbsp&nbsp&nbsp&nbspa. verified the vulnerability and confirmed its existence; &nbsp&nbsp&nbsp&nbsp&nbsp&nbspb. notified the website operator about its existence...

Microsoft Office 2007/2010 Download and Execute Vulnerability

This vulnerability allows to download and execute a file note: the vulnerability is triggered only when Includes macros or user consents to the inclusion...

You Are Here: Giving Your Users the Local Experience They Deserve

Locality matters for most things in life: weather, health care, shopping, product reviews, dinner reservations, social networking, data privacy, news, sports ... the list goes on and on in our ever more connected lives. From direct user interaction on your flagship website or app to IoT device da...

3 ways Microsoft helps build cyber safety awareness for all

This tumultuous year has brought paradigm shifts across every facet of daily life. A global pandemic has pushed much of our lives online—work, school, entertainment, shopping, and socializing. But one thing remains unchanged: people everywhere share a common need for safety. Today, our need for...

OAuth Consent Phishing Ramps Up with Microsoft Office 365 Attacks

An APT known as TA2552 has been spotted using OAuth2 or other token-based authorization methods to access Office 365 accounts, in order to steal users’ contacts and mail. OAuth is an open standard for access delegation, commonly used as a way for people to sign into services without entering a...

Cisco IOS XE Consent Token Bypass Vulnerability (CNVD-2020-57581)

Cisco IOS XE is a set of modular operating system based on Linux kernel developed by Cisco for its network equipment. A consent token bypass vulnerability exists in the persistent Telnet/Secure Shell SSH CLI of Cisco IOS XE. The vulnerability stems from insufficient enforcement of consent tokens ...

CVE-2020-3404

A vulnerability in the persistent Telnet/Secure Shell SSH CLI of Cisco IOS XE Software could allow an authenticated, local attacker to gain shell access on an affected device and execute commands on the underlying operating system OS with root privileges. The vulnerability is due to insufficient...

CVE-2020-3404 Cisco IOS XE Software Consent Token Bypass Vulnerability

A vulnerability in the persistent Telnet/Secure Shell SSH CLI of Cisco IOS XE Software could allow an authenticated, local attacker to gain shell access on an affected device and execute commands on the underlying operating system OS with root privileges. The vulnerability is due to insufficient...

CVE-2020-3404 Cisco IOS XE Software Consent Token Bypass Vulnerability

A vulnerability in the persistent Telnet/Secure Shell SSH CLI of Cisco IOS XE Software could allow an authenticated, local attacker to gain shell access on an affected device and execute commands on the underlying operating system OS with root privileges. The vulnerability is due to insufficient...

Cisco IOS XE Software Consent Token Bypass Vulnerability

A vulnerability in the persistent Telnet/Secure Shell SSH CLI of Cisco IOS XE Software could allow an authenticated, local attacker to gain shell access on an affected device and execute commands on the underlying operating system OS with root privileges. The vulnerability is due to insufficient...

PT-2020-4426 · Cisco · Cisco Ios Xe

Name of the Vulnerable Software and Affected Versions: Cisco IOS XE Software affected versions not specified Description: The issue is related to errors in access control for the Telnet/Secure Shell SSH command-line interface of Cisco IOS XE Software. This could allow an authenticated, local...

CVE-2020-0360

In Notification Access Confirmation, there is a possible permissions bypass due to uninformed consent. This could lead to local escalation of privilege with User execution privileges needed. User interaction is needed for exploitation.Product: AndroidVersions: Android-11Android ID: A-145129456...

Design/Logic Flaw

In Notification Access Confirmation, there is a possible permissions bypass due to uninformed consent. This could lead to local escalation of privilege with User execution privileges needed. User interaction is needed for exploitation.Product: AndroidVersions: Android-11Android ID: A-145129456...

Google Play Bans Stalkerware and 'Misrepresentation'

Google is taking the step of prohibiting “stalkerware” in Google Play, along with apps that could be used in political-influence campaigns. Effective October 1, apps that would allow someone to surreptitiously track the location or online activity of another person will be removed from the intern...

CVE-2020-0382

In RunInternal of dumpstate.cpp, there is a possible user consent bypass due to an uncaught exception. This could lead to local information disclosure of bug report data with System execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-11...

CVE-2020-0382

CVE-2020-0382 affects Android 10/11. In RunInternal of dumpstate.cpp, an uncaught exception enables a possible user-consent bypass, allowing local disclosure of bug report data with System privileges. No user interaction is required for exploitation, and the impact is limited to information discl...