How to make decentralized apps: Modern subtleties of development process management

By Owais Sultan Technology is moving towards modernized solutions and is constantly changing. Back in the day, there were web applications.… This is a post from HackRead.com Read the original post: How to make decentralized apps: Modern subtleties of development process management...

CVE-2022-28762

Zoom Client for Meetings for macOS Standard and for IT Admin starting with 5.10.6 and prior to 5.12.0 contains a debugging port misconfiguration. When camera mode rendering context is enabled as part of the Zoom App Layers API by running certain Zoom Apps, a local debugging port is opened by the...

Design/Logic Flaw

Zoom Client for Meetings for macOS Standard and for IT Admin starting with 5.10.6 and prior to 5.12.0 contains a debugging port misconfiguration. When camera mode rendering context is enabled as part of the Zoom App Layers API by running certain Zoom Apps, a local debugging port is opened by the...

CVE-2022-28762 Debugging port misconfiguration in Zoom Apps in the Zoom Client for Meetings for macOS

Zoom Client for Meetings for macOS Standard and for IT Admin starting with 5.10.6 and prior to 5.12.0 contains a debugging port misconfiguration. When camera mode rendering context is enabled as part of the Zoom App Layers API by running certain Zoom Apps, a local debugging port is opened by the...

CVE-2022-28762 Debugging port misconfiguration in Zoom Apps in the Zoom Client for Meetings for macOS

Zoom Client for Meetings for macOS Standard and for IT Admin starting with 5.10.6 and prior to 5.12.0 contains a debugging port misconfiguration. When camera mode rendering context is enabled as part of the Zoom App Layers API by running certain Zoom Apps, a local debugging port is opened by the...

CVE-2022-28762: Undefined Security Weakness

Zoom Client for Meetings for macOS Standard and for IT Admin starting with 5.10.6 and prior to 5.12.0 contains a debugging port misconfiguration. When camera mode rendering context is enabled as part of the Zoom App Layers API by running certain Zoom Apps, a local debugging port is opened by the...

Microsoft Office security vulnerabilities

Microsoft Office is an office software suite of products from the U.S. company Microsoft Microsoft. Commonly used components of this product include Word, Excel, Access, Powerpoint, FrontPage, and so on. A security vulnerability exists in Microsoft Office. The following products and editions are...

Microsoft Office security vulnerabilities

Microsoft Office is an office software suite of products from the U.S. company Microsoft Microsoft. Commonly used components of this product include Word, Excel, Access, Powerpoint, FrontPage, and so on. A security vulnerability exists in Microsoft Office Word. The following products and editions...

Microsoft Office 365 Apps for Enterprise Buffer Overflow

The vulnerability of Microsoft Office and 365 Apps for Enterprise packages is related to the execution of operations outside the buffer in memory. Exploiting this vulnerability allows an attacker to execute arbitrary code by opening a specially created file...

Microsoft Visio graphic editors Code Execution

The vulnerability of Microsoft Visio graphical editors, Microsoft Office programs, and 365 Apps for Enterprise is related to insufficient validation of input data. Exploiting this vulnerability can allow an attacker to execute arbitrary code by opening a specially created file...

Facebook Detects 400 Android and iOS Apps Stealing Users Log-in Credentials

Meta Platforms on Friday disclosed that it had identified over 400 malicious apps on Android and iOS that it said targeted online users with the goal of stealing their Facebook login information. "These apps were listed on the Google Play Store and Apple's App Store and disguised as photo editors...

Meta Says It Has Busted More Than 400 Login-Stealing Apps This Year

The company plans to alert 1 million Facebook users that their account credentials may have been compromised by malicious software...

Threat Source newsletter (Oct. 6, 2022) — Continuing down the Privacy Policy rabbit hole

By Jon Munshaw. Welcome to this week’s edition of the Threat Source newsletter. As I wrote about last week, I’ve been diving a lot into apps’ privacy policies recently. And I was recently made aware of a new type of app I never knew existed — family trackers. There are countless mobile apps for...

ASB-A-238377411

In getBackgroundRestrictionExemptionReason of AppRestrictionController.java, there is a possible way to bypass device policy restrictions due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not need...

Threat Source newsletter (Sept. 29, 2022) — Personal health apps are currently under a spotlight, but their warning signs have always been there

By Jon Munshaw. Welcome to this week’s edition of the Threat Source newsletter. I’ve spent the past few months with my colleague Ashlee Benge looking at personal health apps’ privacy policies. We found several instances of apps that carry sensitive information stating they would share certain...

CVE-2022-39255

Summary (CVE-2022-39255): The Matrix iOS SDK (prior to 0.23.19) is vulnerable to protocol confusion between Megolm and Olm for to-device messages. An attacker collaborating with a malicious homeserver can craft messages that appear to come from another user, enabling impersonation and targeted at...

Scylla Ad Fraud Attack on iOS and Android Users Halted by Apple and Google

By Waqas Before being removed, the Scylla ad fraud campaign used over 90 malicious apps to carry out its operation against Android and iOS users. This is a post from HackRead.com Read the original post: Scylla Ad Fraud Attack on iOS and Android Users Halted by Apple and Google...

[Security Nation] Taki Uchiyama of Panasonic on Product Security and Incident Response

!\Security Nation\ Taki Uchiyama of Panasonic on Product Security and Incident Responsehttps://blog.rapid7.com/content/images/2022/09/securitynationlogo-1.jpg In this episode of Security Nation, Jen and Tod chat with Taki Uchiyama about his work on Panasonic’s Product Security Incident Response...

Exchange servers abused for spam through malicious OAuth applications

Microsoft has published a security blog about an investigation into an attack in which threat actors used malicious OAuth applications to abuse Exchange servers for their spam campaign. The threat actor behind this attack has been active for many years, and has been running spam campaigns using...

GitHub: Github Apps can use Scoped-User-To-Server Tokens to Obtain Full Access to User's Projects in Project V2 GraphQL api

An incorrect authorization vulnerability was found in GitHub Enterprise Server that allowed GitHub Apps to gain access to and modify most organization-level resources that are not tied to a repository, regardless of granted permissions. This vulnerability affected all versions of GitHub Enterpris...