7035 matches found
CVE-2021-0694
In setServiceForegroundInnerLocked of ActiveServices.java, there is a possible way for a background application to regain foreground permissions due to insufficient background restrictions. This could lead to local escalation of privilege with no additional execution privileges needed. User...
Apps removed from Google Play for harvesting user data
Dozens of apps were removed from the Google Play Store after they were found to be harvesting the data of device owners. The code in question—a software development kit SDK—was used inside apps which were downloaded over 10 million times. What happened? A wide range of Android apps were found to...
PT-2022-2528 · Microsoft · Windows Push Notifications Apps +1
Name of the Vulnerable Software and Affected Versions: Windows Push Notifications Apps affected versions not specified Description: The issue is related to an elevation-of-privilege vulnerability in Windows Push Notifications Apps, which is caused by synchronization errors when using a shared...
PT-2022-2908
Name of the Vulnerable Software and Affected Versions Microsoft Office versions affected versions not specified Microsoft 365 Apps for Enterprise versions affected versions not specified Description The issue is related to insufficient input validation in Microsoft Office and Microsoft 365 Apps f...
PT-2022-2909 · Microsoft · Office Web Apps Server +1
Name of the Vulnerable Software and Affected Versions: Microsoft Excel affected versions not specified Microsoft Office Web Apps Server affected versions not specified Description: The issue is related to insufficient input validation in Microsoft Excel and Microsoft Office Web Apps Server, which...
KLA12511 Remote code execution vulnerability in Windows Apps
Remote code execution vulnerability was found in Microsoft Apps. Malicious users can exploit this vulnerability to execute arbitrary code. Original advisories CVE-2022-26903 Related products Microsoft-Excel Microsoft-Word CVE list CVE-2022-26903 critical KB list Solution Install necessary updates...
Samsung Galaxy S21 输入验证错误漏洞
SAMSUNG Galaxy Apps is a pre-installed application store program for Samsung mobile devices from Samsung South Korea. An input validation error vulnerability exists in Samsung Galaxy S21 versions prior to 4.5.40.5. An attacker can exploit the vulnerability to execute arbitrary code...
CVE-2022-22258
The Wi-Fi module has an event notification vulnerability.Successful exploitation of this vulnerability may allow third-party applications to intercept event notifications and add information and result in elevation-of-privilege...
Citrix StoreFront Security Bulletin for CVE-2022-27503
A reflected cross-site scripting XSS issue has been discovered in Citrix StoreFront when it is configured to use SAML authentication. If exploited, this issue would allow an attacker to execute client-side JavaScript in the same context as a legitimate user. This issue has the following identifie...
The vulnerability of the Sample apps component of the Oracle WebLogic Server application server allows attackers to compromise the confidentiality and integrity of the protected information.
The vulnerability of the Sample apps component of the Oracle WebLogic Server application server exists due to insufficient validation of input data. Exploiting this vulnerability allows a malicious actor to compromise the confidentiality and integrity of the protected information...
Hamas-linked Hackers Targeting High-Ranking Israelis Using 'Catfish' Lures
A threat actor with affiliations to the cyber warfare division of Hamas has been linked to an "elaborate campaign" targeting high-profile Israeli individuals employed in sensitive defense, law enforcement, and emergency services organizations. "The campaign operators use sophisticated social...
SharkBot Banking Trojan Resurfaces On Google Play Store Hidden Behind 7 New Apps
As many as seven malicious Android apps discovered on the Google Play Store masqueraded as antivirus solutions to deploy a banking trojan called SharkBot. "SharkBot steals credentials and banking information," Check Point researchers Alex Shamshur and Raman Ladutska said in a report shared with T...
Hackers Distributing Fake Shopping Apps to Steal Banking Data of Malaysian Users
Threat actors have been distributing malicious applications under the guise of seemingly harmless shopping apps to target customers of eight Malaysian banks since at least November 2021. The attacks involved setting up fraudulent but legitimate-looking websites to trick users into downloading the...
Experts Shed Light on BlackGuard Infostealer Malware Sold on Russian Hacking Forums
A previously undocumented "sophisticated" information-stealing malware named BlackGuard is being advertised for sale on Russian underground forums for a monthly subscription of $200. "BlackGuard has the capability to steal all types of information related to Crypto wallets, VPN, Messengers, FTP...
URI spoofing flaw could phish WhatsApp, Signal, Instagram, and iMessage users
Update: We were informed by Sick Codes that, although Signal already has a fix for this URI flaw here, it hasnt been pushed out to market yet. Well further update this post once there is new development. Theres a flaw in the way many of the worlds most popular messaging and email platforms—such a...
CVE-2021-39791
In WallpaperManagerService, there is a possible way to determine whether an app is installed, without query permissions, due to side channel information disclosure. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for...
CVE-2021-39791
In WallpaperManagerService, there is a possible way to determine whether an app is installed, without query permissions, due to side channel information disclosure. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for...
CVE-2021-39769
In Device Policy, there is a possible way to determine whether an app is installed, without query permissions, due to a missing permission check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.Product...
CVE-2021-39754
In ContextImpl, there is a possible way to determine whether an app is installed, without query permissions, due to side channel information disclosure. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for...
