14018 matches found
CVE-2021-39619
In updatePackageMappingsData of UsageStatsService.java, there is a possible way to bypass security and privacy settings of app usage due to an unusual root cause. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for...
Design/Logic Flaw
In updatePackageMappingsData of UsageStatsService.java, there is a possible way to bypass security and privacy settings of app usage due to an unusual root cause. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for...
CVE-2021-39631
CVE-2021-39631 affects Android (Android-10 to Android-12). The issue lies in clear_data_dlg_text in strings.xml, where the messaging around the lear storage unctionality can mislead about security/privacy, enabling local information disclosure. Exploitation is local, requires no user interaction...
CVE-2021-39619
In updatePackageMappingsData of UsageStatsService.java, there is a possible way to bypass security and privacy settings of app usage due to an unusual root cause. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for...
Samsung KnoxPrivacyNoticeReceiver 输入验证错误漏洞
Samsung SettingsReceiver is a component in Samsung Samsung mobile devices. Samsung SettingsReceiver suffers from a PendingIntent hijacking vulnerability that originates from unauthorized access in SettingsReceiver, which can be exploited by a local attacker to gain unauthorized access to media...
Evolving How We Share Rapid7 Research Data
In the spring of 2018, we launched the Open Data initiative to provide security teams and researchers with access to research data generated from Project Sonar and Project Heisenberg. Our goal for those projects is to understand how the attack surface is evolving, what exposures are most common o...
CISA Adds 15 Known Exploited Vulnerabilities to Catalog
CISA has added 15 new vulnerabilities to its Known Exploited Vulnerabilities Catalog, based on evidence that threat actors are actively exploiting the vulnerabilities listed in the table below. These types of vulnerabilities are a frequent attack vector for malicious cyber actors of all types and...
Cross-site scripting in Crafter CMS Crafter Studio
Crafter CMS Crafter Studio 3.0.1 is affected by: Cross Site Scripting XSS, which allows remote attackers to steal users’ cookies...
Apple accidentally kept some Siri recordings from iPhones, even for opted-out users
Apple’s release of iOS 15.4 beta 2 completes the fix for a bug that may have recorded interactions with Siri without permission on some devices. Apple has fixed this bug that was introduced in iOS 15 and accidentally kept some recordings, regardless of whether you opted out or not. The bug was...
Meta blows safety bubble around users after reports of sexual harassment
There’s trouble brewing in the Metaverse, but the trouble isnt a particularly new problem. In fact, it’s been an issue for years - and so have many of the solutions. Strangely, Meta is having to play catch-up where some basic security and safety settings are concerned in the virtual realm. At...
Myanmar’s Fight for Democracy Is Now a Scrap Over Phone Records
Norwegian telecoms giant Telenor wants to leave Myanmar. Activists say its exit risks putting their data— and their freedom—at risk...
Mozilla Releases Security Updates for Firefox, Firefox ESR, and Thunderbird
Mozilla has released security updates to address vulnerabilities in Firefox, Firefox ESR, and Thunderbird. An attacker could exploit some of these vulnerabilities to take control of an affected system. CISA encourages users and administrators to review the Mozilla security advisories for Firefox...
Microsoft Releases February 2022 Security Updates
Microsoft has released updates to address multiple vulnerabilities in Microsoft software. A remote attacker could exploit some of these vulnerabilities to take control of an affected system. CISA encourages users and administrators to review Microsoft’s February 2022 Security Update Summary and...
Mozilla Releases Security Updates for Firefox and Firefox ESR
Mozilla has released security updates to address vulnerabilities in Firefox and Firefox ESR. An attacker could exploit some of these vulnerabilities to take control of an affected system. CISA encourages users and administrators to review the Mozilla security advisories for Firefox 97 and Firefox...
Critical Vulnerabilities Affecting SAP Applications Employing Internet Communication Manager (ICM)
On February 8, 2022, SAP released security updates to address vulnerabilities affecting multiple products, including critical vulnerabilities affecting SAP applications using SAP Internet Communication Manager ICM. SAP applications help organizations manage critical business processes—such as...
Citrix Releases Security Updates for Hypervisor
Citrix has released security updates to address vulnerabilities in Hypervisor. An attacker could exploit these vulnerabilities to cause a denial-of-service condition. CISA encourages users and administrators to review Citrix Security Update CTX337526 and apply the necessary updates. This product ...
Adobe Releases Security Updates for Multiple Products
Adobe has released security updates to address vulnerabilities in multiple Adobe products. An attacker could exploit some of these vulnerabilities to take control of an affected system. CISA encourages users and administrators to review the following Adobe Security Bulletins and apply the necessa...
IRS To Ditch Biometric Requirement for Online Access
The Internal Revenue Service IRS said today it will be transitioning away from requiring biometric data from taxpayers who wish to access their records at the agencys website. The reversal comes as privacy experts and lawmakers have been pushing the IRS and other federal agencies to find less...
CVE-2021-25106
The Privacy Policy Generator, Terms & Conditions Generator WordPress Plugin : WPLegalPages WordPress plugin before 2.7.1 does not check for authorisation and has a flawed CSRF logic when saving its settings, allowing any authenticated users, such as subscriber, to update them. Furthermore, due to...
CVE-2021-25106
The Privacy Policy Generator, Terms & Conditions Generator WordPress Plugin : WPLegalPages WordPress plugin before 2.7.1 does not check for authorisation and has a flawed CSRF logic when saving its settings, allowing any authenticated users, such as subscriber, to update them. Furthermore, due to...