CVE-2022-30733

Sensitive information exposure in Sign-in log in Samsung Account prior to version 13.2.00.6 allows attackers to get an user email or phone number without permission...

Information disclosure

Sensitive information exposure in Sign-in log in Samsung Account prior to version 13.2.00.6 allows attackers to get an user email or phone number without permission...

CVE-2022-30733

Samsung Account Sign‑in log information disclosure vulnerability affects versions prior to 13.2.00.6, enabling an attacker to obtain a user’s email address or phone number without permission. Root cause details are not provided in the documents. Remediation is upgrading to version 13.2.00.6 or la...

Cloudflare Public Bug Bounty: Sign in with Apple generates long-life JWTs, seemingly irrevocable, that grant immediate access to accounts

The OIDC JWT token issued on a new Sign in with Apple ID to the Cloudflare Dashboard had an excessive lifetime. When intercepted by a malicious actor, it enabled impersonation of the affected user on multiple devices during the entire token validity period without the need to re-authenticate. The...

Cloudflare Public Bug Bounty: Sign in with Apple works on existing accounts, bypasses 2FA

It was possible to bypass configured Cloudflare 2FA when logging in to a Cloudflare account using Apple ID authentication flow. A malicious actor could access a Cloudflare account by setting up an Apple ID account using e-mail address matching the one used to set up the targeted account. The issu...

CVE-2022-30733: Exposure of Sensitive Information to an Unauthorized Actor

Sensitive information exposure in Sign-in log in Samsung Account prior to version 13.2.00.6 allows attackers to get an user email or phone number without permission...

Reddit: One-click account hijack for anyone using Apple sign-in with Reddit, due to response-type switch + leaking href to XSS on www.redditmedia.com

Hi, Description I've been researching new ways to steal OAuth codes and access-tokens using postMessage, and I found a way for me to steal the code and/or access-token from Apple-sign-in on reddit.com allowing a full account hijack of the account in Reddit. The way it works is this: 1. Attacker...

Android and Chrome Users Can Soon Generate Virtual Credit Cards to Protect Real Ones

Google on Wednesday took to its annual developer conference to announce a host of privacy and security updates, including support for virtual credit cards on Android and Chrome. "When you use autofill to enter your payment details at checkout, virtual cards will add an additional layer of securit...

April 25, 2022—KB5011831 (OS Builds 19042.1682, 19043.1682, and 19044.1682) Preview

None None...

March 22, 2022—KB5011551 (OS Build 17763.2746) Preview

None None...

CVE-2022-27225

Gradle Enterprise before 2021.4.3 relies on cleartext data transmission in some situations. It uses Keycloak for identity management services. During the sign-in process, Keycloak sets browser cookies that effectively provide remember-me functionality. For backwards compatibility with older Safar...

CVE-2022-25825

Improper access control vulnerability in Samsung Account prior to version 13.1.0.1 allows attackers to access to the authcode for sign-in...

CVE-2022-25825

Improper access control vulnerability in Samsung Account prior to version 13.1.0.1 allows attackers to access to the authcode for sign-in...

CVE-2022-25825

Improper access control vulnerability in Samsung Account prior to version 13.1.0.1 allows attackers to access to the authcode for sign-in...

Unusual sign-in activity mail goes phishing for Microsoft account holders

We’ve received an interesting spam email which deliberately or not could get people thinking about the current international crisis. Being on your guard will pay dividends over the coming days and weeks, as more of the below is sure to follow. Unusual sign-in activity detected? The emails subject...

The vulnerability of the Sign-In component of the Google Chrome browser allows a hacker to execute arbitrary code.

The vulnerability of the Sign-In component in Google Chrome browser involves the use of memory after it is freed. Exploiting this vulnerability could allow a remote attacker to execute arbitrary code...

DEBIAN-CVE-2022-0099

Use after free in Sign-in in Google Chrome prior to 97.0.4692.71 allowed a remote attacker who convinced a user to perform specific user gestures to potentially exploit heap corruption via specific user gesture...

UBUNTU-CVE-2022-0099

Use after free in Sign-in in Google Chrome prior to 97.0.4692.71 allowed a remote attacker who convinced a user to perform specific user gestures to potentially exploit heap corruption via specific user gesture...

CVE-2022-0099

CVE-2022-0099 — Summary (supported by connected docs): Use-after-free in Sign-in in Google Chrome prior to 97.0.4692.71 may allow a remote attacker who entices a user to perform specific gestures to potentially cause heap corruption. This vulnerability affects Chromium/Chrome components involved ...

CVE-2022-0099

Use after free in Sign-in in Google Chrome prior to 97.0.4692.71 allowed a remote attacker who convinced a user to perform specific user gestures to potentially exploit heap corruption via specific user gesture...