Security Update for Microsoft Office Web Apps Server 2013 (KB4011247) farm-deployment

A security vulnerability exists in Microsoft Office Web Apps Server 2013 that could allow arbitrary code to run when a maliciously modified file is opened. This update resolves that vulnerability...

Implementing the CIS 20 Critical Security Controls: Slash Risk of Cyber Attacks by 85%

If a CISO needed to cut cyber attack risk by 85%, how would this security chief go about accomplishing that? Would the CISO even know where to begin? It’s safe to say that such a mandate would be considered daunting, and maybe even overwhelming. CISOs are scrambling to protect IT infrastructures...

Description of the security update for SharePoint Server 2010 Office Web Apps: November 14, 2017

Description of the security update for SharePoint Server 2010 Office Web Apps: November 14, 2017 Summary This security update resolves vulnerabilities in Microsoft Office that could allow remote code execution if a user opens a specially crafted Office file. To learn more about these...

Description of the security update for Project Server 2013: November 14, 2017

Description of the security update for Project Server 2013: November 14, 2017 Summary This security update resolves vulnerabilities in Microsoft Office that could allow remote code execution if a user opens a specially crafted Office file. To learn more about these vulnerabilities, see Microsoft...

Security Updates for Microsoft Office Web Apps (November 2017)

The Microsoft Office Web Apps installation on the remote host is missing security updates. It is, therefore, affected by multiple vulnerabilities : This security update resolves vulnerabilities in Microsoft Office that could allow remote code execution if a user opens a specially crafted Office...

Design/Logic Flaw

An issue was discovered in certain Apple products. iOS before 11.1 is affected. macOS before 10.13.1 is affected. tvOS before 11.1 is affected. watchOS before 4.1 is affected. The issue involves the "Kernel" component. It allows attackers to monitor arbitrary apps via a crafted app that accesses...

IRCCloud: [IRCCloud Android] Theft of arbitrary files leading to token leakage

Bug description Hi, I'd like to report a vulnerability which allows to theft arbitrary protected files and as a result takeover account, because all tokens will be leaked, similar to my bug reported to Harvest https://hackerone.com/reports/161710 This one is really tricky, passed two days to...

Eavesdropper Vulnerability Exposes Mobile Call, Text Data

UPDATE Mobile app developers who code using the Twilio cloud-based platform and are forgetful about removing their hardcoded credentials have put businesses messaging data at risk for exposure. The so-called Eavesdropper vulnerability, disclosed today by Appthority, has been around since 2011 and...

XenMobile: How to Block apps on iOS device

How to Block already/going to be installed apps on iOS devices using restriction policy...

1M Downloads Later, Google Pulls Phony WhatsApp From Google Play

Google has removed a phony WhatsApp download from Google Play and suspended the developer’s account, but not before the ad-spewing app was downloaded more than one million times. The unwanted app, called Update WhatsApp Messenger, was disclosed by a handful of Redditors over the weekend who said...

wig - WebApp Information Gatherer

wig is a web application information gathering tool, which can identify numerous Content Management Systems and other administrative applications. The application fingerprinting is based on checksums and string matching of known files for different versions of CMSes. This results in a score being...

Fake WhatsApp On Google Play Store Downloaded By Over 1 Million Android Users

Cybercriminals are known to take advantage of everything that's popular among people in order to spread malware, and Google's official Play Store has always proved no less than an excellent place for hackers to get their job done. Yesterday some users spotted a fake version of the most popular...

Fraud Detection in Pokémon Go

I play Pokémon Go. There, I've admitted it. One of the interesting aspects of the game I've been watching is how the game's publisher, Niantic, deals with cheaters. There are three basic types of cheating in Pokémon Go. The first is botting, where a computer plays the game instead of a person. Th...

Samsung GALAXY Apps Privilege Access Control Vulnerability

Samsung GALAXY Apps also known as Samsung Apps, Samsung Updates or com.sec.android.app.samsungapps is a suite of app store applications from Samsung South Korea. A security vulnerability exists in versions of Samsung GALAXY Apps prior to 14120405.03.012. An attacker can exploit this vulnerability...

How to Publish XenMobile App Store apps using iOS Volume Purchase Program (VPP)

The Apple iOS Volume Purchase Program VPP solution allows the customer to manage iOS app licensing, therefore simplifying the process to find, buy, and distribute apps and other data in bulk for an organization. With VPP, you can use XenMobile to distribute public app store apps. VPP is not...

snapfish.com XSS vulnerability

Vulnerable URL: https://www.snapfish.com/photo-gift/mobile-apps?cid=tbm...

A week in security (October 23 – October 29)

Welcome back to "A week in security." Last week, we took a look at how deleted files can be recovered, explored the BadRabbit ransomware plague attacking Eastern Europe including a deep dive into the code, and talked about what it takes to work in security. One of our researchers, who is a PhD...

CVE-2017-5074

A use after free in Chrome Apps in Google Chrome prior to 59.0.3071.86 for Windows allowed a remote attacker to perform an out of bounds memory read via a crafted HTML page, related to Bluetooth...

CVE-2017-5100

A use after free in Apps in Google Chrome prior to 60.0.3112.78 for Windows allowed a remote attacker to perform an out of bounds memory read via a crafted HTML page...

CVE-2017-5062

A use after free in Chrome Apps in Google Chrome prior to 58.0.3029.81 for Mac, Windows, and Linux, and 58.0.3029.83 for Android, allowed a remote attacker to potentially perform out of bounds memory access via a crafted Chrome extension...