CVE-2023-21278

In multiple locations, there is a possible way to obscure the microphone privacy indicator due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation...

CVE-2023-21278

CVE-2023-21278 affects Google Android, appearing in the Android 2023-08-01/08-01 bulletin under the Framework/EoP category. The issue is a logic error in multiple locations that can obscure the microphone privacy indicator, enabling local elevation of privilege without additional execution privil...

India Passes New Digital Personal Data Protection Bill (DPDPB), Putting Users' Privacy First

The Indian President Droupadi Murmu on Friday granted assent to the Digital Personal Data Protection Bill DPDPB after it was unanimously passed by both houses of the parliament last week, marking a significant step towards securing people's information. "The Bill provides for the processing of...

PT-2023-18057 · Google · Android

Name of the Vulnerable Software and Affected Versions: No specific software or versions are mentioned in the provided descriptions. Description: The issue is related to a logic error in the code that allows the microphone privacy indicator to be obscured in multiple locations. This could lead to...

Google Android Security Vulnerability

Google Android is a Linux-based open source operating system from the American company Google. Google Android suffers from a security vulnerability that stems from the existence of logic errors in the code at multiple locations, with a possible way to mask the microphone privacy indicator...

A week in security (August 7 - August 13)

Last week on Malwarebytes Labs: Zoom clarifies user consent requirement when training its AI Several hospitals still counting the cost of widespread ransomware attack Old exploit kits still kicking around in 2023 YouTube makes sweeping changes to tackle spam on Shorts videos Googles "browse...

Lolek Bulletproof Hosting Servers Seized, 5 Key Operators Arrested

European and U.S. law enforcement agencies have announced the dismantling of a bulletproof hosting service provider called Lolek Hosted, which cybercriminals have used to launch cyber-attacks across the globe. "Five of its administrators were arrested, and all of its servers seized, rendering...

Private Mobile Connectivity: More Visibility, Security, and Control

...

The Inability to Simultaneously Verify Sentience, Location, and Identity

Really interesting "systematization of knowledge" paper: "SoK: The Ghost Trilemma" Abstract: Trolls, bots, and sybils distort online discourse and compromise the security of networked platforms. User identity is central to the vectors of attack and manipulation employed in these contexts. However...

Zoom clarifies user consent requirement when training its AI

Changes in the terms of service TOS of the Zoom video-conferencing software have caused some turmoil. Since the pandemic, Zoom Video Conferencing has become a household name. Zoom came up as the big winner in the video conferencing struggle that enabled us to work from home. Now that things are...

Google’s “browse privately” is nothing more than a word play, lawyers say

Google will have to appear in court after a judge denied their request for summary judgment in a lawsuit filed by users alleging the company illegally invaded the privacy of millions of people. Lawsuits against big tech over privacy issues are not much of a surprise these days, unfortunate as tha...

CVE-2023-38599

A flaw was found in WebKitGTK, which exists due to a logic issue in WebKit related to a user's privacy. A remote attacker may be able to track sensitive user information...

CVE-2023-37513

CVE-2023-37513 affects HCL Traveler To Do. When the app is backgrounded and the iOS task switcher is used, the app snapshot is not blurred, potentially allowing disclosure of sensitive information. The root cause is the insufficient blur on the background snapshot. Public details in the provided ...

Leaked Yandex Code Breaks Open the Creepy Black Box of Online Advertising

As the international tech giant moves toward Russian ownership, the leak raises concerns about the volume of data it has on its users...

CVE-2023-4276

The Absolute Privacy plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.1. This is due to missing nonce validation on the 'abprprofileShortcode' function. This makes it possible for unauthenticated attackers to change user email and password via a...

CVE-2023-4276

CVE-2023-4276 affects the Absolute Privacy WordPress plugin (versions ≤ 2.1). Root cause: missing nonce validation in abpr_profileShortcode enabling Cross-Site Request Forgery. This allows unauthenticated attackers to change a site user’s email and password if a site admin clicks a crafted link. ...

CVE-2023-4276 Absolute Privacy <= 2.1 - Cross-Site Request Forgery to User Email/Password Change

The Absolute Privacy plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.1. This is due to missing nonce validation on the 'abprprofileShortcode' function. This makes it possible for unauthenticated attackers to change user email and password via a...

WordPress Plugin Absolute Privacy Cross-Site Request Forgery Vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A cross-site request forgery vulnerability...

PT-2023-28577 · WordPress · Absolute Privacy

Name of the Vulnerable Software and Affected Versions: Absolute Privacy plugin for WordPress versions up to, and including, 2.1 Description: The issue is due to missing nonce validation on the abpr profileShortcode function, making it possible for unauthenticated attackers to change user email an...

WordPress Absolute Privacy Plugin <= 2.1 is vulnerable to Cross Site Request Forgery (CSRF)

Software Absolute Privacy Type Plugin Vulnerable versions = 2.1 Fixed in N/A OWASP Top 10 A5: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2023-4276 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID 920232a8a942 Credits Lana Codes Required...