986 matches found
When a sextortion victim fights back
When Katie Yates suddenly started receiving nude photos of her friend, Natalie Claus, over on Snapchat, she instantly recognized that Claus had just become a victim of a sextortion attack. She also knew how Claus should respond. This happened in December 2019 when Claus was a sophomore. Both were...
A week in security (June 27 – July 3)
Last week on Malwarebytes Labs: Ransomware review: June 2022 AstraLocker 2.0 ransomware isn’t going to give you your files back YTStealer targets YouTube content creators ZuoRAT is a sophisticated malware that mainly targets SOHO routers Amazon Photos vulnerability could have given attackers acce...
Amazon Quietly Patches 'High Severity' Vulnerability in Android Photos App
Amazon, in December 2021, patched a high severity vulnerability affecting its Photos app for Android that could have been exploited to steal a user's access tokens. "The Amazon access token is used to authenticate the user across multiple Amazon APIs, some of which contain personal data such as...
Amazon Photos vulnerability could have given attackers access to user files and data
Amazon has patched a flaw in the Amazon Photos app which could have allowed an attacker to steal and use a users unique access token that verifies their identity across multiple Amazon APIs. That would give attackers access to a trove of information, since many of these APIs contain personal data...
Leaky Access Tokens Exposed Amazon Photos of Users
The Amazon Photos app for Android insufficiently protected user access tokens, according to a blog post published on Wednesday. Theoretically, with exposed tokens, an attacker could’ve accessed users’ personal data from a number of different Amazon apps – not just Photos but also, for example,...
Wire Cross-Site Scripting Vulnerability (CNVD-2022-65920)
Wire is a chat software from the German company Wire. The software supports Web, WindowsiOS, Android, and OS X platforms, has group functionality, can make voice calls, send photos, and its original greeting method, PING. Wire has a cross-site scripting vulnerability that stems from insufficient...
The vulnerability of Microsoft Photos’ image viewing tool, related to insufficient validation of input data, allows a hacker to execute arbitrary code.
The vulnerability of the Microsoft Photos image viewing tool is related to insufficient validation of input data. Exploiting this vulnerability could allow an attacker to execute arbitrary code...
9 Years Jail for iCloud Phishing Scam Hacker Who Stole Nude Photos
By Deeba Ahmed The hacker was arrested in 2021 for breaching Apple iCloud accounts and stealing more than 620,000 private images… This is a post from HackRead.com Read the original post: 9 Years Jail for iCloud Phishing Scam Hacker Who Stole Nude Photos...
CVE-2022-30168
Microsoft Photos App Remote Code Execution Vulnerability...
CVE-2022-30168
Microsoft Photos App Remote Code Execution Vulnerability...
CVE-2022-30168
Microsoft Photos App Remote Code Execution Vulnerability...
Remote code execution
Microsoft Photos App Remote Code Execution Vulnerability...
CVE-2022-30168
CVE-2022-30168 affects Microsoft Photos App. The vulnerability is a remote code execution (RCE) weakness in Microsoft Photos caused by insufficient input validation in the app. Public sources list CVSS v3.1 vector CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H and CVSS v2 base score 6.8. Downstream...
CVE-2022-30168 Microsoft Photos App Remote Code Execution Vulnerability
...
CVE-2022-20196
In gallery3d and photos, there is a possible permission bypass due to a confused deputy. This could lead to local information disclosure with no additional execution privileges needed. User interaction is needed for exploitation.Product: AndroidVersions: Android-12LAndroid ID: A-201535148...
CVE-2022-20196
In gallery3d and photos, there is a possible permission bypass due to a confused deputy. This could lead to local information disclosure with no additional execution privileges needed. User interaction is needed for exploitation.Product: AndroidVersions: Android-12LAndroid ID: A-201535148...
Design/Logic Flaw
In gallery3d and photos, there is a possible permission bypass due to a confused deputy. This could lead to local information disclosure with no additional execution privileges needed. User interaction is needed for exploitation.Product: AndroidVersions: Android-12LAndroid ID: A-201535148...
CVE-2022-20196
The CVE-2022-20196 issue affects Android 12L’s gallery3d and Photos. It describes a permission bypass due to a confused deputy, enabling local information disclosure without extra execution privileges. Exploitation is reported to require user interaction. The Pixel update bulletin lists CVE-2022-...
CVE-2022-20196
In gallery3d and photos, there is a possible permission bypass due to a confused deputy. This could lead to local information disclosure with no additional execution privileges needed. User interaction is needed for exploitation.Product: AndroidVersions: Android-12LAndroid ID: A-201535148...
