2736 matches found
CVE-2020-25203
The Framer Preview application 12 for Android exposes com.framer.viewer.FramerViewActivity to other applications. By calling the intent with the action set to android.intent.action.VIEW, any other application is able to load any website/web content into the application's context, which is shown a...
CISA: LokiBot Stealer Storms Into a Resurgence
The U.S. Cybersecurity and Infrastructure Security Agency CISA is warning that the LokiBot info-stealing trojan is seeing a surge across the enterprise landscape. The uptick started in July, according to the agency, and activity has remained “persistent” ever since. LokiBot targets Windows and...
Firefox for Android Bug Allows 'Epic Rick-Rolling'
A vulnerability in Firefox for Android paves the way for an attackers to launch websites on a victim’s phone, with no user interaction. The attack manifests in the form of a Firefox browser window on the target device suddenly launching, without the users’ permission. This can be used for various...
CVE-2020-5629
UNIQLO App for Android versions 7.3.3 and earlier allows remote attackers to lead a user to access an arbitrary website via a malicious App created by the third party. As a result, if the access destination is a malicious website, the user may fall victim to the social engineering attack...
CVE-2020-5628
UNIQLO App for Android versions 7.3.3 and earlier allows remote attackers to lead a user to access an arbitrary website via the vulnerable App. As a result, if the access destination is a malicious website, the user may fall victim to the social engineering attack...
CVE-2020-5628
UNIQLO App for Android versions 7.3.3 and earlier allows remote attackers to lead a user to access an arbitrary website via the vulnerable App. As a result, if the access destination is a malicious website, the user may fall victim to the social engineering attack...
CVE-2020-5628
The CVE-2020-5628 issue affects UNIQLO App for Android (versions up to 7.3.3). It is a remote-access vulnerability described as multiple access restriction bypass flaws that can let an attacker lure a user to an arbitrary website via the vulnerable app, potentially enabling social engineering. Th...
Charities and the advertising industry: data ecosystems and privacy risks
Data makes the world go round, more often than not via advertising and its tracking mechanisms. Whether you think making money from large volumes of PII to keep the web ticking over is a good thing, or a sleazy data-grab often encouraging terrible ad practices, it’s not going to go away anytime...
DoJ Indicts Two Hackers for Defacing Websites with Pro-Iran Messages
The Department of Justice DoJ has indicted two hackers – including one teenager – for allegedly vandalizing more than 50 websites hosted in the U.S. with pro-Iran messages. The indictment, unsealed on Tuesday, indicts Behzad Mohammadzadeh, a national of the Islamic Republic of Iran who is believe...
2 Hackers Charged for Defacing Sites after U.S. Airstrike Killed Iranian General
The US Department of Justice DoJ on Tuesday indicted two hackers for their alleged involvement in defacing several websites in the country following the assassination of Iranian major general Qasem Soleimani earlier this January. Behzad Mohammadzadeh aka Mrb3hz4d, 19, and Marwan Abusrour aka...
About the security content of Safari 14.0
About the security content of Safari 14.0 This document describes the security content of Safari 14.0. About Apple security updates For our customers' protection, Apple doesn't disclose, discuss, or confirm security issues until an investigation has occurred and patches or releases are available...
Rethinking Defensive Strategy at the Edge, Part 1: A Changing Landscape for Securing Users
In recent years, new enterprise remote access architectures and frameworks have been introduced, such as Zero Trust Access ZTA. Those concepts have driven changes in the way the network perimeter has been defined -- specifically, from the outside in, not the inside out. Access to applications and...
Remote code execution
A remote code execution vulnerability exists when the Windows Text Service Module improperly handles memory. An attacker who successfully exploited the vulnerability could gain execution on a victim system. An attacker could host a specially crafted website that is designed to exploit the...
CVE-2020-5627
Yodobashi App for Android versions 1.8.7 and earlier allows remote attackers to lead a user to access an arbitrary website via the vulnerable App. As a result, the user may become a victim of a phishing attack...
Roundtable video: Disinformation and election security
By Jon Munshaw. In our continued coverage of election security, we decided to sit down with four Talos and Cisco researchers to discuss disinformation. As we outlined in our recent research paper, disinformation is one of the cornerstones of threat actors' efforts to disrupt the American election...
The vulnerability of the Windows Media Foundation component of the Windows operating system allows attackers to gain privileges to install programs, view, modify, or delete data, as well as create new user accounts with full user rights.
The vulnerability of the Windows Media Foundation component in the Windows operating system arises from an operation that goes beyond the buffer boundaries in memory. Exploiting this vulnerability can allow attackers to gain privileges to install programs, view, modify, or delete data, and create...
apps.telkom.co.za Improper Access Control vulnerability OBB-1315560
Following coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has:       a. verified the vulnerability and confirmed its existence;       b. notified the website operator about its existence...
Windows Text Service Module Remote Code Execution Vulnerability
A remote code execution vulnerability exists when the Windows Text Service Module improperly handles memory. An attacker who successfully exploited the vulnerability could gain execution on a victim system. An attacker could host a specially crafted website that is designed to exploit the...
PT-2020-4083 · Microsoft · Windows Gdi +1
Name of the Vulnerable Software and Affected Versions: Windows GDI affected versions not specified Description: The issue is related to errors in handling objects in memory by the Windows Graphics Device Interface GDI. This can allow a remote attacker to execute arbitrary code, potentially giving...
Hackers breach e-commerce websites operated by Warner Music Group
By Zara Khan WMG hasn’t disclosed the number of websites compromised or how the hackers accessed such critical information. This is a post from HackRead.com Read the original post: Hackers breach e-commerce websites operated by Warner Music Group...