Fake 'Placebo Apps' Booted From Google Play, Amazon

A handful of apps purporting to specialize in virus detection and malware scanning were recently removed from Google’s Play marketplace and Amazon after being deemed fake. Security researchers at FireEye discovered five apps in particular that accounted for up to 50,000 downloads and essentially...

PT-2014-2449

Name of the Vulnerable Software and Affected Versions ownCloud Server versions prior to 4.5.7 Description The issue allows remote authenticated users to read arbitrary calendars due to improper ownership checking of calendars. This can be achieved via the calid parameter to the...

CVE-2012-5056

Multiple cross-site scripting XSS vulnerabilities in ownCloud Server before 4.0.8 allow remote attackers to inject arbitrary web script or HTML via the 1 readyCallback parameter to apps/filesodfviewer/src/webodf/webodf/flashput/PUT.swf, the 2 root parameter to apps/gallery/templates/index.php, or...

D-Bus, GLib: Privilege escalation

Background D-Bus is a daemon providing a framework for applications to communicate with one another. GLib is a library providing a number of GNOME’s core objects and functions. Description When libdbus is used in a setuid program, a user can gain escalated privileges by leveraging the...

Microsoft Outlook App for Android Devices Stores Emails Unencrypted on File System

If you have an account with Microsoft's popular free email service Outlook.com, and using Outlook app for Android, then there is a bad news for you. Microsoft's Android app for Outlook.com, provides users to access their Outlook emails on their Android devices, fails to provide security and...

Cross site scripting

Cross-site scripting XSS vulnerability in Microsoft SharePoint Server 2013 Gold and SP1, SharePoint Foundation 2013 Gold and SP1, Office Web Apps Server 2013 Gold and SP1, and SharePoint Server 2013 Client Components SDK allows remote attackers to inject arbitrary web script or HTML via a crafted...

CVE-2014-1754

CVE-2014-1754 is a cross-site scripting (XSS) vulnerability affecting Microsoft SharePoint Server 2013 (Gold/SP1), SharePoint Foundation 2013 (Gold/SP1), Office Web Apps Server 2013 (Gold/SP1), and SharePoint Server 2013 Client Components SDK. The issue allows remote attackers to inject arbitrary...

Microsoft Office Web Apps Multiple Vulnerabilities (2952166)

This host is missing a critical security update according to Microsoft Bulletin MS14-022. SPDX-FileCopyrightText: 2014 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

CVE-2014-1754: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in Microsoft SharePoint Server 2013 Gold and SP1, SharePoint Foundation 2013 Gold and SP1, Office Web Apps Server 2013 Gold and SP1, and SharePoint Server 2013 Client Components SDK allows remote attackers to inject arbitrary web script or HTML via a crafted...

MS14-022: Vulnerabilities in Microsoft SharePoint Server Could Allow Remote Code Execution (2952166)

The versions of Office SharePoint Server, Office Web Apps, SharePoint Client Components SDK, or SharePoint Designer installed on the remote host are affected by multiple vulnerabilities : - A code execution vulnerability exists in Microsoft SharePoint Server. CVE-2014-0251 - A cross-site scriptin...

PT-2014-1679

Name of the Vulnerable Software and Affected Versions Microsoft SharePoint Server 2013 versions Gold and SP1 Microsoft SharePoint Foundation 2013 versions Gold and SP1 Microsoft Office Web Apps Server 2013 versions Gold and SP1 Microsoft SharePoint Server 2013 Client Components SDK affected...

MS14-022: Description of the security update for Office Web Apps Server 2013: May 13, 2014

Resolves vulnerabilities in Office Web Apps Server 2013 that could allow remote code execution if an authenticated attacker sends specially crafted page content to a target SharePoint Server.IntroductionThis update resolves vulnerabilities in Microsoft Office Web Apps Server 2013 that could allow...

Microsoft Office Web Apps CVE-2014-1813 Remote Code Execution Vulnerability

Description Microsoft Office Web Apps is prone to a remote code-execution vulnerability. An attacker can exploit this issue to execute arbitrary code in the context of the W3WP service account user. Technologies Affected Microsoft Office Web Apps 2010 SP1 Microsoft Office Web Apps 2010 SP2...

Health and Fitness Apps Poor at Protecting Privacy FTC Says

A recent study conducted by the Federal Trade Commission examined 12 mobile health and fitness apps and found them sending users’ personal information to 76 different third parties. Jah-Juin Ho, an attorney in the FTC’s Mobile Technology Unit shared the research yesterday during a seminar regardi...

FTC Discusses Regulating User-Generated Health Information

The proliferation of wearable devices coupled with smartphone apps that monitor heart rates and other health metrics raises an important question: How exactly should the information generated by these devices be regulated? If there’s a fist fight in a bar can a person’s Fitbit accelerator be...

Police Ransomware Malware Targeting Android Smartphones

After hacking PCs, Cyber criminals have now begun targeting Smartphones with a special piece of malicious software that locks up the devices until the victims pay a ransom to get the keys to unlock the phone, called Ransomware. Ransomware typically targets users' personal computers and has become...

ownCloud 'calendar_id' Parameter privilege Escalation Vulnerability

ownCloud is prone to a privilege escalation vulnerability. SPDX-FileCopyrightText: 2014 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:owncloud:owncloud"; if...

Google to Stop Scanning Student Accounts

Google yesterday announced it will no longer scan the contents of Gmail accounts associated with the company’s Apps for Education service for the purpose of generating advertisements. It is unclear if Google will continue to scan those accounts for other purposes. This decision is one of two...

Facebook Enhances Privacy Settings with Anonymous Login

Anonymous is the new black for Facebook. The social network announced a number of changes to how users interact with third-party apps via Facebook logins, the most interesting being a service called Anonymous Login. Facebook chief executive officer Mark Zuckerberg told developers at the company’s...

Facebook Introduces Anonymous Login to Limit Third-party App Permissions

We're comfortable in sharing information with our Facebook friends, but it is quite sneaky for Facebook users to offer their Identities and credentials when logging in to third-party apps, they don’t trust. To deal with this issue, the social network giant has plans to improve the way users login...