Zanubis in motion: Tracing the active evolution of the Android banking malware

Introduction Zanubis is a banking Trojan for Android that emerged in mid-2022. Since its inception, it has targeted banks and financial entities in Peru, before expanding its objectives to virtual cards and crypto wallets. The main infection vector of Zanubis is impersonating legitimate Peruvian...

The vulnerability of the web_sys_infoContact_post() function in PLANET Technology’s microcontroller software allows a intruder to compromise the confidentiality, integrity, and accessibility of the protected information.

The vulnerability of the websysinfoContactpost function in PLANET Technology’s microcontroller software stems from the operation of the function beyond the buffer boundaries in memory when processing the contact parameter. Exploiting this vulnerability could allow an attacker to compromise the...

CVE-2024-43087

In getInstalledAccessibilityPreferences of AccessibilitySettings.java, there is a possible way to hide an enabled accessibility service in the accessibility service settings due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges...

CVE-2024-24705

Cross-Site Request Forgery CSRF vulnerability in Octa Code Accessibility.This issue affects Accessibility: from n/a through 1.0.6...

CVE-2024-33327

A cross-site scripting XSS vulnerability in the component UrlAccessibilityEvaluation.jsp of Lumisxp v15.0.x to v16.1.x allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the contentHtml parameter...

CVE-2024-28024

A vulnerability exists in the FOXMAN-UN/UNEM in which sensitive information is stored in cleartext within a resource that might be accessible to another control sphere...

CVE-2024-31423

Missing Authorization vulnerability in Alex Volkov WP Accessibility Helper WAH.This issue affects WP Accessibility Helper WAH: from n/a through 0.6.2.5...

CVE-2024-54488

A logic issue was addressed with improved file handling. This issue is fixed in iOS 18.2 and iPadOS 18.2, iPadOS 17.7.3, macOS Sequoia 15.2, macOS Sonoma 14.7.2, macOS Ventura 13.7.2. Photos in the Hidden Photos Album may be viewed without authentication...

CVE-2024-32831

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Lorna Timbah webgrrrl Accessibility Widget allows Stored XSS.This issue affects Accessibility Widget: from n/a through 2.2...

CVE-2024-44171

This issue was addressed through improved state management. This issue is fixed in iOS 17.7 and iPadOS 17.7, iOS 18 and iPadOS 18, watchOS 11. An attacker with physical access to a locked device may be able to Control Nearby Devices via accessibility features...

CVE-2024-37926

Missing Authorization vulnerability in Alex Volkov WP Accessibility Helper WAH allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects WP Accessibility Helper WAH: from n/a through 0.6.2.9...

CVE-2024-31322

In updateServicesLocked of AccessibilityManagerService.java, there is a possible way for an app to be hidden from the Setting while retaining Accessibility Service due to improper input validation. This could lead to local escalation of privilege with no additional execution privileges needed. Us...

CVE-2023-30484

Cross-Site Request Forgery CSRF vulnerability in uPress Enable Accessibility plugin = 1.4 versions...

CVE-2023-28933

Auth. admin+ Stored Cross-Site Scripting XSS vulnerability in StPeteDesign Call Now Accessibility Button plugin = 1.1 versions...

CVE-2023-4328

Broadcom RAID Controller web interface is vulnerable to exposure of sensitive data and the keys used for encryption are accessible to any local user on Windows...

CVE-2023-42874

This issue was addressed with improved state management. This issue is fixed in macOS Sonoma 14.2. Secure text fields may be displayed via the Accessibility Keyboard when using a physical keyboard...

CVE-2023-46181

IBM Sterling Secure Proxy 6.0.3 and 6.1.0 allows web pages to be stored locally which can be read by another user on the system. IBM X-Force ID: 269686...

CVE-2023-32417

This issue was addressed by restricting options offered on a locked device. This issue is fixed in watchOS 9.5. An attacker with physical access to a locked Apple Watch may be able to view user photos or contacts via accessibility features...

CVE-2023-2635

The Call Now Accessibility Button WordPress plugin before 1.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...

CVE-2023-21109

In multiple places of AccessibilityService, there is a possible way to hide the app from the user due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product:...