Input validation

An improper validation vulnerability in IBM InfoSphere Information Server 11.7 Pack for SAP Apps and BW Packs may lead to creation of directories and files on the server file system that may contain non-sensitive debugging information like stack traces. IBM X-Force ID: 221323...

CVE-2022-22373

CVE-2022-22373 affects IBM InfoSphere Information Server Pack for SAP Apps and BW Packs (11.7). The vulnerability is an improper validation that may allow creation of directories/files on the server filesystem containing non‑sensitive debugging info (e.g., stack traces). Impact per sources includ...

Amazon Quietly Patches 'High Severity' Vulnerability in Android Photos App

Amazon, in December 2021, patched a high severity vulnerability affecting its Photos app for Android that could have been exploited to steal a user's access tokens. "The Amazon access token is used to authenticate the user across multiple Amazon APIs, some of which contain personal data such as...

CVE-2022-22373: Undefined Security Weakness

An improper validation vulnerability in IBM InfoSphere Information Server 11.7 Pack for SAP Apps and BW Packs may lead to creation of directories and files on the server file system that may contain non-sensitive debugging information like stack traces. IBM X-Force ID: 221323...

Security Updates for Microsoft Office Web Apps (April 2022)

The Microsoft Office Web Apps installation on the remote host is missing a security update. It is, therefore, affected by a remote code execution vulnerability. An attacker can exploit this to bypass authentication and execute unauthorized arbitrary commands. C Tenable Network Security, Inc...

Security Bulletin: IBM InfoSphere Information Server Pack for SAP Apps and BW Packs is affected by an improper validation vulnerability

Summary An improper validation vulnerability in IBM InfoSphere Information Server Pack for SAP Apps and BW Packs was addressed. Vulnerability Details CVEID:CVE-2022-22373 DESCRIPTION: An improper validation vulnerability in IBM InfoSphere Information Server Pack for SAP Apps and BW Packs may lead...

Microsoft 365 Apps for Enterprise Code Execution

The vulnerability of Microsoft 365 Apps for Enterprise and Microsoft Office lies in insufficient validation of input data. Exploiting this vulnerability allows an attacker to execute arbitrary code by loading a specially created file...

LGBTQ+ community targeted by extortionists who threaten to publish nudes

The FTC Federal Trade Commission has warned the LGBTQ+ community about extortionists posing as potential romantic partners on Grindr and Feeld. The scammers send their targets explicit photos and then ask for them to reciprocate. If they do, targets are then blackmailed into paying a ransom,...

Overview of Top Mobile Security Threats in 2022

Your smartphone is your daily companion. The chances are that most of our activities rely on them, from ordering food to booking medical appointments. However, the threat landscape always reminds us how vulnerable smartphones can be. Consider the recent discovery by Oversecured, a security startu...

Pea pod app has janus vulnerability

PeaPod is a download marketplace that provides green and safe apps and games. A janus vulnerability exists in the Pea Pod app, which can be exploited by an attacker to gain control of the server...

Microsoft SharePoint Server Operational Data Access

The vulnerability of Microsoft SharePoint Server, Microsoft SharePoint Enterprise Server, Microsoft Office Web Apps Server, and Microsoft Office Online Server relates to insufficient protection of operational data. Exploitation of this vulnerability can allow attackers to gain unauthorized access...

CVE-2022-1740

The tested version of Dominion Voting Systems ImageCast X’s on-screen application hash display feature, audit log export, and application export functionality rely on self-attestation mechanisms. An attacker could leverage this vulnerability to disguise malicious applications on a device...

Google Warns Spyware Being Deployed Against Android, iOS Users

Google is warning victims in Kazakhstan and Italy that they are being targeted by Hermit, a sophisticated and modular spyware from Italian vendor RCS Labs that not only can steal data but also record and make calls. Researchers from Google Threat Analysis Group TAG revealed details in a blog post...

Malicious Package

Overview @tide-web-apps/global-environments is a malicious package. The package's name is based on existing repositories, namespaces, or components used by popular companies in an effort to trick employees into downloading it, also known as 'dependency confusion'. Therefore, you're only vulnerabl...

CVE-2021-26637

CVE-2021-26637 affects SiHAS SGW-300, ACM-300, and GCM-300 firmware/apps, due to missing account authentication and permission checks. This enables unauthorized users to remotely control the device over the network; no specific exploit details are provided in the documents. PT-2022-9785 reiterate...

MAL-2022-746 Malicious code in @xvideos/apps (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 1dc1d32a11b195ccd2b9793e68f33bccf46835e1b15a5d8c26b4bd8aac4c00c4 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malware in @xvideos/apps

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

MAL-2022-6949 Malicious code in vk-apps-contacts (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware b58fcc6f00c1b0623c2788c26e2df81d24da0288671c83ac3dee63c9ca9affb0 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in vk-apps-contacts (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware b58fcc6f00c1b0623c2788c26e2df81d24da0288671c83ac3dee63c9ca9affb0 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malware in vk-apps-contacts

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...