SUSE CVE-2023-29491

ncurses before 6.4 20230408, when used by a setuid application, allows local users to trigger security-relevant memory corruption via malformed data in a terminfo database file that is found in $HOME/.terminfo or reached via the TERMINFO or TERM environment variable...

AZL-26241 CVE-2023-29491 affecting package ncurses for versions less than 6.4-1

ncurses before 6.4 20230408, when used by a setuid application, allows local users to trigger security-relevant memory corruption via malformed data in a terminfo database file that is found in $HOME/.terminfo or reached via the TERMINFO or TERM environment variable...

CVE-2022-47027

CVE-2022-47027 affects Timmystudios Fast Typing Keyboard v1.275.1.162. A dictionary traversal vulnerability in the app’s internal storage allows unauthorized apps to overwrite arbitrary files, enabling arbitrary code execution. Connected sources corroborate the same description and surface no pub...

PT-2023-15136 · Timmystudios · Timmystudios Fast Typing Keyboard

Name of the Vulnerable Software and Affected Versions: Timmystudios Fast Typing Keyboard version 1.275.1.162 Description: The issue allows unauthorized apps to overwrite arbitrary files in the internal storage of Timmystudios Fast Typing Keyboard via a dictionary traversal vulnerability, which ca...

CVE-2022-47027

Timmystudios Fast Typing Keyboard v1.275.1.162 allows unauthorized apps to overwrite arbitrary files in its internal storage via a dictionary traversal vulnerability and achieve arbitrary code execution...

Input validation

KYOCERA Mobile Print' v3.2.0.230119 and earlier, 'UTAX/TA MobilePrint' v3.2.0.230119 and earlier, and 'Olivetti Mobile Print' v3.2.0.230119 and earlier are vulnerable to improper intent handling. When a malicious app is installed on the victim user's Android device, the app may send an intent and...

Multiple mobile printing apps for Android vulnerable to improper intent handling

Overview Multiple mobile printing apps for Android are vulnerable to improper intent handling CWE-668. Johan Francsics reported this vulnerability to JPCERT/CC. JPCERT/CC coordinated with the developer. Impact When a malicious app is installed on the victim user's Android device, the app may send...

CVE-2023-25954

KYOCERA Mobile Print' v3.2.0.230119 and earlier, 'UTAX/TA MobilePrint' v3.2.0.230119 and earlier, and 'Olivetti Mobile Print' v3.2.0.230119 and earlier are vulnerable to improper intent handling. When a malicious app is installed on the victim user's Android device, the app may send an intent and...

WLAN Module Interference

The vulnerability of the WLAN layer of the Android EMUI operating system and the HarmonyOS platform is related to deficiencies in authentication procedures. Exploiting this vulnerability allows a malicious actor to influence WLAN services through third-party applications...

Cybercriminals Turn to Android Loaders on Dark Web to Evade Google Play Security

Malicious loader programs capable of trojanizing Android applications are being traded on the criminal underground for up to $20,000 as a way to evade Google Play Store defenses. "The most popular application categories to hide malware and unwanted software include cryptocurrency trackers,...

Cybercriminals Turn to Android Loaders on Dark Web to Evade Google Play Security

Malicious loader programs capable of trojanizing Android applications are being traded on the criminal underground for up to $20,000 as a way to evade Google Play Store defenses. "The most popular application categories to hide malware and unwanted software include cryptocurrency trackers,...

January 10, 2023—KB5022303 (OS Build 22621.1105)

January 10, 2023—KB5022303 OS Build 22621.1105 Applies To Windows 11 version 22H2, all editions Important For Windows Recovery Environment WinRE devices, see the updated 1/20/23 Special instructions for Windows Recovery Environment WinRE devices in the How to get this update section to address...

This Week in Spring - April 11th, 2023

Hi, Spring fans! Welcome to another installment of This Week in Spring! As I write this I am in Amsterdam, Netherlands, preparing to speak at the Utrecht JUG tonight along with fellow Java Champion Trisha Gee. We're not speaking together, but instead it's a double header: she'll speak first, then...

Microsoft Publisher security vulnerabilities

Microsoft Publisher is an entry-level desktop publishing application from Microsoft USA that provides more control over page elements than Microsoft Word. A security vulnerability exists in Microsoft Office Publisher. The following products and editions are affected:Microsoft Office 2019 for 64-b...

Microsoft Publisher security vulnerabilities

Microsoft Publisher is an entry-level desktop publishing application from Microsoft USA that provides more control over page elements than Microsoft Word. A security vulnerability exists in Microsoft Office Publisher. The following products and editions are affected: Microsoft Publisher 2016 32-b...

Microsoft Office security vulnerabilities

Microsoft Office is an office software suite of products from the U.S. company Microsoft Microsoft. Commonly used components of this product include Word, Excel, Access, Powerpoint, FrontPage, and so on. A security vulnerability exists in Microsoft Office. The following products and versions are...

Overview of Google Play threats sold on the dark web

In 2022, Kaspersky security solutions detected 1,661,743 malware or unwanted software installers, targeting mobile users. Although the most common way of distributing such installers is through third-party websites and dubious app stores, their authors every now and then manage to upload them to...

Google Mandates Android Apps to Offer Easy Account Deletion In-App and Online

Google is enacting a new data deletion policy for Android apps that allow account creation to also offer users with a setting to delete their accounts in an attempt to provide more transparency and control over their data. "For apps that enable app account creation, developers will soon need to...

Malicious Package

Overview stripe-apps-deep is a malicious package. The package's name is based on existing repositories, namespaces, or components used by popular companies in an effort to trick employees into downloading it, also known as 'dependency confusion'. Therefore, you're only vulnerable if this package...

Microsoft Fixes New Azure AD Vulnerability Impacting Bing Search and Major Apps

Microsoft has patched a misconfiguration issue impacting the Azure Active Directory AAD identity and access management service that exposed several "high-impact" applications to unauthorized access. "One of these apps is a content management system CMS that powers Bing.com and allowed us to not...