Samsung Galaxy Apps Elevation of Privilege Vulnerability

Samsung Galaxy Apps is an application store program from Samsung South Korea that is used in Samsung cell phones. An elevation of privilege vulnerability exists in the handling of URLs in Samsung Galaxy Apps, which stems from the program failing to properly validate user-submitted data. A local...

Samsung Galaxy Apps Privilege Access Control Vulnerability

Samsung Galaxy Apps is an application store program from Samsung South Korea that is used in Samsung cell phones. A privilege access control vulnerability exists in the handling of staging mode in Samsung Galaxy Apps. A local attacker can exploit this vulnerability by obtaining execute permission...

Android OS API-Breaking Flaw Offers Useful WiFi Data to Bad Actors

An “API-breaking” vulnerability has been uncovered that potentially exposes Android device systems data to rogue apps — information that could be very useful to bad actors. Researchers from Nightwatch Cybersecurity System said that certain all-points-bulletins sent out by the Android OS expose...

Samsung Galaxy Apps Privilege Access Control Vulnerability

Samsung Galaxy Apps is an application store program from Samsung South Korea that is used in Samsung cell phones. A privilege access control vulnerability exists in the handling of push messages in Samsung Galaxy Apps. A local attacker could exploit this vulnerability by obtaining execute...

Design/Logic Flaw

An issue was discovered on Orbic Wonder Orbic/RC555L/RC555L:7.1.2/N2G47H/329100b:user/release-keys devices. Any app co-located on the device can send an intent to factory reset the device programmatically because of com.android.server.MasterClearReceiver. This does not require any user interactio...

BusyGasper – the unfriendly spy

In early 2018 our mobile intruder-detection technology was triggered by a suspicious Android sample that, as it turned out, belonged to an unknown spyware family. Further investigation showed that the malware, which we named BusyGasper, is not all that sophisticated, but demonstrates some unusual...

Instagram Adds 3 New Security Tools to Make its Platform More Secure

Instagram is growing quickly—and with the second most popular social media network in the world behind just Facebook, the photo-sharing network absolutely dominates when it comes to user interactions. And with great success comes great responsibility—responsibility to keep users' accounts safe,...

Crashing Mobile Apps Capture Screens, Leak Private Data

Several mobile software developer kits SDKs can capture sensitive user data when a mobile app crashes, exposing private data to an outside third party. Researchers at Appthority singled out SDKs offered by AppSee and TestFairy in a report published Monday. They warned that mobile users whose apps...

Countly Cross Site Scripting

Exploit Title: Countly-server StoredPersistent XSS Vulnerability Date: Monday - 2018 13 August Author: 10:10AM Team Discovered By: Sleepy Software Link: https://github.com/Countly/countly-server Version: All Version Category: Web-apps Security Risk: Critical Tested on: GNU/Linux Ubuntu 16.04 - wi...

CVE-2018-15491

A vulnerability in the permission and encryption implementation of Zemana Anti-Logger 1.9.3.527 and prior fixed in 1.9.3.602 allows an attacker to take control of the whitelisting feature MyRules2.ini under %LOCALAPPDATA%\Zemana\ZALSDK to permit execution of unauthorized applications such as ones...

Security Update for Microsoft Office Web Apps Server 2013 (KB4022238) farm-deployment

A security vulnerability exists in Microsoft Office Web Apps Server 2013 that could allow arbitrary code to run when a maliciously modified file is opened. This update resolves that vulnerability...

Security Update for Microsoft Office Web Apps Server 2013 (KB4022238)

A security vulnerability exists in Microsoft Office Web Apps Server 2013 that could allow arbitrary code to run when a maliciously modified file is opened. This update resolves that vulnerability...

Description of the security update for SharePoint Server 2010 Office Web Apps: August 14, 2018

Description of the security update for SharePoint Server 2010 Office Web Apps: August 14, 2018 Summary This security update resolves vulnerabilities in Microsoft Office that could allow information disclosure if a user opens a specially crafted Office file. To learn more about these...

Description of the security update for Office Web Apps Server 2013: August 14, 2018

None None...

Security Updates for Microsoft Office Web Apps (August 2018)

The Microsoft Office Web Apps installation on the remote host is missing a security update. It is, therefore, affected by the following vulnerability : - An information disclosure vulnerability exists when Microsoft Office software reads out of bound memory due to an uninitialized variable, which...

Doorkeeper subject to Incorrect Permission Assignment

Doorkeeper version 4.2.0 and later contains a Incorrect Access Control vulnerability in Token revocation API's authorized method that can result in Access tokens are not revoked for public OAuth apps, leaking access until expiry...

GHSA-694M-JHR9-PF77 Doorkeeper subject to Incorrect Permission Assignment

Doorkeeper version 4.2.0 and later contains a Incorrect Access Control vulnerability in Token revocation API's authorized method that can result in Access tokens are not revoked for public OAuth apps, leaking access until expiry...

Google Tracks Android, iPhone Users Even With 'Location History' Turned Off

Google tracks you everywhere, even if you explicitly tell it not to. Every time a service like Google Maps wants to use your location, Google asks your permission to allow access to your location if you want to use it for navigating, but a new investigation shows that the company does track you...

Black Hat Video Exclusive: Mobile APTs Redefining Phishing Attacks

LAS VEGAS: Mike Murray, vice president of security intelligence at Lookout, talks with Threatpost’s Tom Spring to discuss the latest trends in mobile advanced persistence threats APTs. He said mobile is redefining traditional inbox phishing. On smartphones, phishing includes dangerous links insid...

Flaws in Pre-Installed Apps Expose Millions of Android Devices to Hackers

Bought a new Android phone? What if I say your brand new smartphone can be hacked remotely? Nearly all Android phones come with useless applications pre-installed by manufacturers or carriers, usually called bloatware, and there's nothing you can do if any of them has a backdoor built-in—even if...