Apple Lawsuit Amps Up Pressure on Pegasus Spyware-Maker

In the wake of a zero-click zero-day exploit that was deployed against iPhone users, Apple has filed a lawsuit against NSO Group. The complaint alleges that the maker of the infamous Pegasus mobile spyware is responsible for the illegal surveillance of Apple users. The computing giant is looking...

CVE-2021-38004

Insufficient policy enforcement in Autofill in Google Chrome prior to 95.0.4638.69 allowed a remote attacker to leak cross-origin data via a crafted HTML page...

CVE-2021-38004

Insufficient policy enforcement in Autofill in Google Chrome prior to 95.0.4638.69 allowed a remote attacker to leak cross-origin data via a crafted HTML page...

UBUNTU-CVE-2021-38004

Insufficient policy enforcement in Autofill in Google Chrome prior to 95.0.4638.69 allowed a remote attacker to leak cross-origin data via a crafted HTML page...

CVE-2021-38004

Insufficient policy enforcement in Autofill in Google Chrome prior to 95.0.4638.69 allowed a remote attacker to leak cross-origin data via a crafted HTML page...

CVE-2021-38004

Insufficient policy enforcement in Autofill in Google Chrome prior to 95.0.4638.69 allowed a remote attacker to leak cross-origin data via a crafted HTML page...

CVE-2021-38004

CVE-2021-38004 affects Chromium-based Google Chrome Autofill: insufficient policy enforcement allows a remote attacker to leak cross-origin data via a crafted HTML page, prior to version 95.0.4638.69. Affected component: Autofill in Chromium/Chrome; root cause is policy enforcement gaps. Impact: ...

Facebook Postpones Plans for E2E Encryption in Messenger, Instagram Until 2023

Meta, the parent company of Facebook, Instagram, and WhatsApp, disclosed that it doesn't intend to roll out default end-to-end encryption E2EE across all its messaging services until 2023, pushing its original plans by at least a year. "We're taking our time to get this right and we don't plan to...

Microsoft Edge (Chromium) < 96.0.1052.29 Multiple Vulnerabilities

The version of Microsoft Edge installed on the remote Windows host is prior to 96.0.1052.29. It is, therefore, affected by multiple vulnerabilities as referenced in the November 19, 2021 advisory. - Insufficient policy enforcement in iframe sandbox in Google Chrome prior to 96.0.4664.45 allowed a...

Chromium: CVE-2021-38020 Insufficient policy enforcement in contacts picker

This CVE was assigned by Chrome. Microsoft Edge Chromium-based ingests Chromium, which addresses this vulnerability. Please see Google Chrome Releases for more information...

Chromium: CVE-2021-38017 Insufficient policy enforcement in iframe sandbox

This CVE was assigned by Chrome. Microsoft Edge Chromium-based ingests Chromium, which addresses this vulnerability. Please see Google Chrome Releases for more information...

CVE-2021-35534 Insufficient Security Control Vulnerability

Insufficient security control vulnerability in internal database access mechanism of Hitachi Energy Relion 670/650/SAM600-IO, Relion 650, GMS600, PWC600 allows attacker who successfully exploited this vulnerability, of which the product does not sufficiently restrict access to an internal databas...

Microsoft Edge (Chromium) < 93.0.961.38 Multiple Vulnerabilities

The version of Microsoft Edge installed on the remote Windows host is prior to 93.0.961.38. It is, therefore, affected by multiple vulnerabilities as referenced in the September 2, 2021 advisory. - Microsoft Edge Chromium-based Elevation of Privilege Vulnerability This CVE ID is unique from...

Google Chrome contacts picker security bypass vulnerability

Google Chrome is a web browser from Google, Inc. A security vulnerability exists in Google Chrome due to an error in policy enforcement in the product contact selector. An attacker could use this vulnerability to bypass security restrictions...

Google Chrome CORS security bypass vulnerability

Google Chrome is a web browser from Google, Inc. A security vulnerability exists in Google Chrome due to inadequate enforcement of cross-domain resource sharing policies in the software. An attacker could use this vulnerability to bypass security restrictions...

Google Chrome background fetch security bypass vulnerability

Google Chrome is a web browser from Google, Inc. A security vulnerability exists in Google Chrome due to improper enforcement of policies obtained from the product's backend. A remote attacker could exploit the vulnerability to bypass security restrictions...

Google Chrome iframe sandbox security bypass vulnerability

Google Chrome is a web browser from Google, an American company. A security bypass vulnerability exists in Google Chrome iframe sandbox that stems from improper policy enforcement in the product's iframe sandbox. An attacker can exploit the vulnerability to bypass security restrictions...

Notorious Emotet Botnet Makes a Comeback with the Help of TrickBot Malware

The notorious Emotet malware is staging a comeback of sorts nearly 10 months after a coordinated law enforcement operation dismantled its command-and-control infrastructure in late January 2021. According to a new report from security researcher Luca Ebach, the infamous TrickBot malware is being...

FBI server hijacked to send up to 100,000 bogus attack mails

If you received a scary missive from what appears to be from the FBI over the last few days, youre not alone. The emails, which may have reached as many as 100,000 people, blamed a fictitious cyberattack on an innocent party. The mail read as follows: Our intelligence monitoring indicates...

[SECURITY] Fedora 35 Update: libsepol-3.3-2.fc35

Security-enhanced Linux is a feature of the Linux=EF=BF=BD=EF=BF=BD kernel an d a number of utilities with enhanced security functionality designed to add mandatory access controls to Linux. The Security-enhanced Linux kernel contains new architectural components originally developed to improve t...