Microsoft Office 安全漏洞

Microsoft Office is an office software suite of products from the U.S. company Microsoft Microsoft. Commonly used components of this product include Word, Excel, Access, Powerpoint, FrontPage, and so on. A security vulnerability exists in Microsoft Office. The following products and editions are...

Microsoft Office 安全漏洞

Microsoft Office is an office software suite of products from the U.S. company Microsoft Microsoft. Commonly used components of this product include Word, Excel, Access, Powerpoint, FrontPage, and so on. A security vulnerability exists in Microsoft Office Word. The following products and editions...

The vulnerability of Microsoft Visio graphic editors, Microsoft Office programs, and 365 Apps for Enterprise, which stems from insufficient validation of input data, allows attackers to execute arbitrary code.

The vulnerability of Microsoft Visio graphical editors, Microsoft Office programs, and 365 Apps for Enterprise is related to insufficient validation of input data. Exploiting this vulnerability can allow an attacker to execute arbitrary code by opening a specially created file...

The vulnerability of Microsoft Office and 365 Apps for Enterprise packages relates to the execution of operations beyond the buffer in memory, allowing an attacker to execute arbitrary code.

The vulnerability of Microsoft Office and 365 Apps for Enterprise packages is related to the execution of operations outside the buffer in memory. Exploiting this vulnerability allows an attacker to execute arbitrary code by opening a specially created file...

Facebook Detects 400 Android and iOS Apps Stealing Users Log-in Credentials

Meta Platforms on Friday disclosed that it had identified over 400 malicious apps on Android and iOS that it said targeted online users with the goal of stealing their Facebook login information. "These apps were listed on the Google Play Store and Apple's App Store and disguised as photo editors...

Meta Says It Has Busted More Than 400 Login-Stealing Apps This Year

The company plans to alert 1 million Facebook users that their account credentials may have been compromised by malicious software...

Threat Source newsletter (Oct. 6, 2022) — Continuing down the Privacy Policy rabbit hole

By Jon Munshaw. Welcome to this week’s edition of the Threat Source newsletter. As I wrote about last week, I’ve been diving a lot into apps’ privacy policies recently. And I was recently made aware of a new type of app I never knew existed — family trackers. There are countless mobile apps for...

ASB-A-238377411

In getBackgroundRestrictionExemptionReason of AppRestrictionController.java, there is a possible way to bypass device policy restrictions due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not need...

Threat Source newsletter (Sept. 29, 2022) — Personal health apps are currently under a spotlight, but their warning signs have always been there

By Jon Munshaw. Welcome to this week’s edition of the Threat Source newsletter. I’ve spent the past few months with my colleague Ashlee Benge looking at personal health apps’ privacy policies. We found several instances of apps that carry sensitive information stating they would share certain...

CVE-2022-39255

Summary (CVE-2022-39255): The Matrix iOS SDK (prior to 0.23.19) is vulnerable to protocol confusion between Megolm and Olm for to-device messages. An attacker collaborating with a malicious homeserver can craft messages that appear to come from another user, enabling impersonation and targeted at...

Scylla Ad Fraud Attack on iOS and Android Users Halted by Apple and Google

By Waqas Before being removed, the Scylla ad fraud campaign used over 90 malicious apps to carry out its operation against Android and iOS users. This is a post from HackRead.com Read the original post: Scylla Ad Fraud Attack on iOS and Android Users Halted by Apple and Google...

[Security Nation] Taki Uchiyama of Panasonic on Product Security and Incident Response

!\Security Nation\ Taki Uchiyama of Panasonic on Product Security and Incident Responsehttps://blog.rapid7.com/content/images/2022/09/securitynationlogo-1.jpg In this episode of Security Nation, Jen and Tod chat with Taki Uchiyama about his work on Panasonic’s Product Security Incident Response...

Exchange servers abused for spam through malicious OAuth applications

Microsoft has published a security blog about an investigation into an attack in which threat actors used malicious OAuth applications to abuse Exchange servers for their spam campaign. The threat actor behind this attack has been active for many years, and has been running spam campaigns using...

GitHub: Github Apps can use Scoped-User-To-Server Tokens to Obtain Full Access to User's Projects in Project V2 GraphQL api

An incorrect authorization vulnerability was found in GitHub Enterprise Server that allowed GitHub Apps to gain access to and modify most organization-level resources that are not tied to a repository, regardless of granted permissions. This vulnerability affected all versions of GitHub Enterpris...

New Spam Attack Abusing OAuth Apps to Target Microsoft Exchange Servers

By Deeba Ahmed According to Microsoft 365 Defender Research Team, in an incident they analyzed, malicious OAuth applications were deployed on compromised cloud tenants, and eventually, attackers took over Exchange servers to carry out spam campaigns. This is a post from HackRead.com Read the...

My SpringOne 2022

It has taken me an embarrassingly long time to appreciate and understand that the devil is in the details regarding software development. Writing happy-path business logic isnt the hard part! Its the failure cases, observability, resilience, and process. Its security and other so-called...

Hackers Using Malicious OAuth Apps to Take Over Email Servers

Microsoft on Thursday warned of a consumer-facing attack that made use of rogue OAuth applications deployed on compromised cloud tenants to ultimately seize control of Exchange servers and spread spam. "The threat actor launched credential stuffing attacks against high-risk accounts that didn't...

Fake Banking Rewards Apps Install Info-stealing RAT on Android Phones

By Deeba Ahmed The malware campaign is ongoing and one of its targets was ICICI bank in India. This is a post from HackRead.com Read the original post: Fake Banking Rewards Apps Install Info-stealing RAT on Android Phones...

PT-2022-23690 · Whatsapp · Whatsapp

Name of the Vulnerable Software and Affected Versions: WhatsApp affected versions not specified Description: An integer overflow in WhatsApp could result in remote code execution in an established video call. The issue affects WhatsApp mobile apps. Recommendations: At the moment, there is no...

Mozilla Thunderbird 安全漏洞

Mozilla Thunderbird is the United States Mozilla Foundation's set of independent from the Mozilla Application Suite e-mail client software. The program supports IMAP and POP mail protocols as well as the HTML mail format. A security vulnerability exists in Mozilla Thunderbird that stems from an...