CVE-2019-11742

A same-origin policy violation occurs allowing the theft of cross-origin images through a combination of SVG filters and a canvas element due to an error in how same-origin policy is applied to cached image content. The resulting same-origin policy violation could allow for data theft. This...

CVE-2019-11742

A same-origin policy violation occurs allowing the theft of cross-origin images through a combination of SVG filters and a element due to an error in how same-origin policy is applied to cached image content. The resulting same-origin policy violation could allow for data theft. This vulnerabilit...

CVE-2019-11742

A same-origin policy violation occurs allowing the theft of cross-origin images through a combination of SVG filters and a canvas element due to an error in how same-origin policy is applied to cached image content. The resulting same-origin policy violation could allow for data theft. This...

CVE-2019-11742: Inclusion of Functionality from Untrusted Control Sphere

A same-origin policy violation occurs allowing the theft of cross-origin images through a combination of SVG filters and a element due to an error in how same-origin policy is applied to cached image content. The resulting same-origin policy violation could allow for data theft. This vulnerabilit...

Top Play Store Weather app steals user data & sends to Chinese server

By Sudais The weather app called Weather Forecast: World Weather Accurate Radar on two of Alcatel's Android smartphone models, namely the Pixi 4 and A3 Max. This is a post from HackRead.com Read the original post: Top Play Store Weather app steals user data & sends to Chinese server...

Dtrack RAT is Behind Virulent ATM-Espionage Campaign

An espionage malware called Dtrack – and a related variant, ATMDtrack – has been traced back to the notorious North Korea-linked Lazarus Group APT. Both have been identified this month targeting victims in India. According to researcher Konstantin Zykov of Kaspersky, researchers first uncovered...

Zebrocy Retools for New Political Attacks

The APT known as the Sednit threat group also known as Sofacy, APT28 and Fancy Bear has kicked off a fresh spearphishing campaign, that was spotted targeting government entities with the Zebrocy backdoor. The malware features a rewritten and newly-improved backdoor and downloader, indicating an...

CB TAU Threat Intelligence Notification: Formbook Harvests Data By Intercepting Clients

Formbook is an information stealer which has been around for the past few years. Formbook acts as a form grabber which harvests credentials, passwords, banking details, key strokes and network requests, by intercepting web browser and other clients such as email and IM. The particular sample...

PT-2019-7348

Name of the Vulnerable Software and Affected Versions mtouch-quiz plugin versions prior to 3.1.3 for WordPress Description The issue is related to a Cross-Site Scripting XSS flaw, which occurs via a quiz name. This allows an attacker to inject malicious scripts into the website, potentially leadi...

In-depth exploration found in the wild iOS exploit chain VII-vulnerability warning-the black bar safety net

In a previous article, we studied how could an attacker on the iPhone as root for a sandbox escape code execution. In each chain at the end you can see the attacker calls posixspawn, the path passed to the/ tmp directory, the malicious binary file. Implanted code in the background to run as root,...

NetCAT: New Attack Lets Hackers Remotely Steal Data From Intel CPUs

Unlike previous side-channel vulnerabilities disclosed in Intel CPUs, researchers have discovered a new flaw that can be exploited remotely over the network without requiring an attacker to have physical access or any malware installed on a targeted computer. Dubbed NetCAT, short for Network Cach...

Same-origin Policy Violation

Mozilla Firefox is vulnerable to same-origin policy violation. The vulnerability exists due to an error in how same-origin policy which allows an attacker to data theft...

PT-2019-5517 · Openwrt · Openwrt

Name of the Vulnerable Software and Affected Versions: OpenWrt versions 15.05.1 through 18.06.4 Description: The issue is related to errors in the certificate authentication procedure of the Ustream-SSL library in OpenWrt. This can be exploited by a remote attacker to perform a man-in-the-middle...

CVE-2019-11742

A same-origin policy violation occurs allowing the theft of cross-origin images through a combination of SVG filters and a canvas element due to an error in how same-origin policy is applied to cached image content. The resulting same-origin policy violation could allow for data theft. This...

PT-2019-4812

Name of the Vulnerable Software and Affected Versions Firefox versions prior to 69 Thunderbird versions prior to 68.1 Thunderbird versions prior to 60.9 Firefox ESR versions prior to 60.9 Firefox ESR versions prior to 68.1 Description A same-origin policy violation occurs, allowing the theft of...

iPhone Zero-Days Anchored Watering-Hole Attacks

A total of 14 iPhone vulnerabilities – including two that were zero-days when discovered — have been targeted by five exploit chains in a watering hole attack that has lasted years. The watering holes deliver a spyware implant that can steal private data like iMessages, photos and GPS location in...

WARNING — Malware Found in CamScanner Android App With 100+ Million Users

Beware! Attackers can remotely hijack your Android device and steal data stored on it, if you are using free version of CamScanner , a highly-popular Phone PDF creator app with more than 100 million downloads on Google Play Store. So, to be safe, just uninstall the CamScanner app from your Androi...

PT-2019-8502

Name of the Vulnerable Software and Affected Versions my-wp-translate plugin versions prior to 1.0.4 Description The issue allows for cross-site scripting XSS, which is a type of attack that can be used to steal user data or take control of user sessions. Recommendations For versions prior to...

PT-2019-12353

Name of the Vulnerable Software and Affected Versions OX App Suite versions 7.10.0 through 7.10.2 Description The issue allows for cross-site scripting XSS, which is a type of attack where an attacker can inject malicious scripts into a website, potentially allowing them to steal user data or tak...

New malware records screen activity as victim watches porn

By Uzair Amir The IT security researchers at ESET have discovered a nasty new malware that not only steals users' private and financial data but also keeps an eye on their browsing activities including recording their screen whenever they watch pornographic videos. This is a post from HackRead.co...