Fake 'Placebo Apps' Booted From Google Play, Amazon

A handful of apps purporting to specialize in virus detection and malware scanning were recently removed from Google’s Play marketplace and Amazon after being deemed fake. Security researchers at FireEye discovered five apps in particular that accounted for up to 50,000 downloads and essentially...

D-Bus, GLib: Privilege escalation

Background D-Bus is a daemon providing a framework for applications to communicate with one another. GLib is a library providing a number of GNOME’s core objects and functions. Description When libdbus is used in a setuid program, a user can gain escalated privileges by leveraging the...

Microsoft Outlook App for Android Devices Stores Emails Unencrypted on File System

If you have an account with Microsoft's popular free email service Outlook.com, and using Outlook app for Android, then there is a bad news for you. Microsoft's Android app for Outlook.com, provides users to access their Outlook emails on their Android devices, fails to provide security and...

Cross site scripting

Cross-site scripting XSS vulnerability in Microsoft SharePoint Server 2013 Gold and SP1, SharePoint Foundation 2013 Gold and SP1, Office Web Apps Server 2013 Gold and SP1, and SharePoint Server 2013 Client Components SDK allows remote attackers to inject arbitrary web script or HTML via a crafted...

CVE-2014-1754

CVE-2014-1754 is a cross-site scripting (XSS) vulnerability affecting Microsoft SharePoint Server 2013 (Gold/SP1), SharePoint Foundation 2013 (Gold/SP1), Office Web Apps Server 2013 (Gold/SP1), and SharePoint Server 2013 Client Components SDK. The issue allows remote attackers to inject arbitrary...

MS14-022: Vulnerabilities in Microsoft SharePoint Server Could Allow Remote Code Execution (2952166)

The versions of Office SharePoint Server, Office Web Apps, SharePoint Client Components SDK, or SharePoint Designer installed on the remote host are affected by multiple vulnerabilities : - A code execution vulnerability exists in Microsoft SharePoint Server. CVE-2014-0251 - A cross-site scriptin...

Microsoft Office Web Apps Multiple Vulnerabilities (2952166)

This host is missing a critical security update according to Microsoft Bulletin MS14-022. SPDX-FileCopyrightText: 2014 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

MS14-022: Description of the security update for Office Web Apps Server 2013: May 13, 2014

Resolves vulnerabilities in Office Web Apps Server 2013 that could allow remote code execution if an authenticated attacker sends specially crafted page content to a target SharePoint Server.IntroductionThis update resolves vulnerabilities in Microsoft Office Web Apps Server 2013 that could allow...

Microsoft Office Web Apps CVE-2014-1813 Remote Code Execution Vulnerability

Description Microsoft Office Web Apps is prone to a remote code-execution vulnerability. An attacker can exploit this issue to execute arbitrary code in the context of the W3WP service account user. Technologies Affected Microsoft Office Web Apps 2010 SP1 Microsoft Office Web Apps 2010 SP2...

Health and Fitness Apps Poor at Protecting Privacy FTC Says

A recent study conducted by the Federal Trade Commission examined 12 mobile health and fitness apps and found them sending users’ personal information to 76 different third parties. Jah-Juin Ho, an attorney in the FTC’s Mobile Technology Unit shared the research yesterday during a seminar regardi...

FTC Discusses Regulating User-Generated Health Information

The proliferation of wearable devices coupled with smartphone apps that monitor heart rates and other health metrics raises an important question: How exactly should the information generated by these devices be regulated? If there’s a fist fight in a bar can a person’s Fitbit accelerator be...

Police Ransomware Malware Targeting Android Smartphones

After hacking PCs, Cyber criminals have now begun targeting Smartphones with a special piece of malicious software that locks up the devices until the victims pay a ransom to get the keys to unlock the phone, called Ransomware. Ransomware typically targets users' personal computers and has become...

ownCloud 'calendar_id' Parameter privilege Escalation Vulnerability

ownCloud is prone to a privilege escalation vulnerability. SPDX-FileCopyrightText: 2014 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:owncloud:owncloud"; if...

Google to Stop Scanning Student Accounts

Google yesterday announced it will no longer scan the contents of Gmail accounts associated with the company’s Apps for Education service for the purpose of generating advertisements. It is unclear if Google will continue to scan those accounts for other purposes. This decision is one of two...

Facebook Enhances Privacy Settings with Anonymous Login

Anonymous is the new black for Facebook. The social network announced a number of changes to how users interact with third-party apps via Facebook logins, the most interesting being a service called Anonymous Login. Facebook chief executive officer Mark Zuckerberg told developers at the company’s...

Facebook Introduces Anonymous Login to Limit Third-party App Permissions

We're comfortable in sharing information with our Facebook friends, but it is quite sneaky for Facebook users to offer their Identities and credentials when logging in to third-party apps, they don’t trust. To deal with this issue, the social network giant has plans to improve the way users login...

Google Removes Bitcoin Mining Android Malware from Play

Google recently removed five bogus wallpaper apps from its Play marketplace after they were deemed malicious and found sneakily mining Bitcoins. The malware, dubbed BadLepricon, was spotted funneling Bitcoin into wallets and allowed the attacker to change mining pools easily to maximize the minin...

Android Bitcoin-Mining Malware found on Google Play Store

Google always bound to face trouble over the wide and open nature of its app checking policies on Google Play Store, and despite so many security measures, the search engine giant mostly fails to recognize the Android malware that are lurking around its Google Play store in vast numbers. Recently...

New NIST AppVet Aims to Streamline Application Security

Apple and Google put developers’ apps through a relatively vigorous screening process before they make their way into their respective app stores. Now developers who produce apps intended for use on internal networks at government agencies can get a vetting process of their own. The National...

Content Provider in CamiApp for Android fails to restrict access permissions

Overview The Content Provider in CamiApp for Android provided by KOKUYO S Co.,Ltd. contains an issue where access permissions are not restricted. Hiroshi Kumagai reported this vulnerability to IPA. JPCERT/CC coordinated with the developer under Information Security Early Warning Partnership. Impa...