FBI, U.S. Treasury and CISA Warn of North Korean Hackers Targeting Blockchain Companies

The U.S. Cybersecurity and Infrastructure Security Agency CISA, along with the Federal Bureau of Investigation FBI and the Treasury Department, warned of a new set of ongoing cyber attacks carried out by the Lazarus Group targeting blockchain companies. Calling the activity cluster TraderTraitor,...

GitHub Says Hackers Breached Dozens of Organizations Using Stolen OAuth Access Tokens

Cloud-based repository hosting service GitHub on Friday revealed that it discovered evidence of an unnamed adversary capitalizing on stolen OAuth user tokens to unauthorizedly download private data from several organizations. "An attacker abused stolen OAuth user tokens issued to two third-party...

Stalkerware-type detections hit record high in 2021, but fell in second half

After having tracked stalkerware for years, Malwarebytes can reveal that in 2021, detections for apps that can non-consensually monitor another persons activity reached their highest peak ever, but that, amidst the record-setting numbers, the volume of detections actually began to significantly...

PT-2022-2299 · Cisco · Cisco Iox +1

Name of the Vulnerable Software and Affected Versions: Cisco IOx affected versions not specified Description: The issue exists due to incorrect restriction of the directory path name with limited access. An attacker could inject arbitrary commands into the underlying host operating system, execut...

Cybersecurity Basics: Authentication and Authorization

With most security incidents caused by exposed secrets in DevOps pipelines and tools, proper authentication and authorization is essential. Explore the basics of strong identity management to build more resilient apps...

GHSA-V2WF-C3J6-WPVW Session fixation

Impact The use of Plug.Session in Pow.Plug.Session is susceptible to session fixation attacks if a persistent session store is used for Plug.Session, such as Redis or a database. Cookie store, which is used in most Phoenix apps, doesn't have this vulnerability. Workarounds Call...

CVE-2021-39797

In several functions of of LauncherApps.java, there is a possible escalation of privilege due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions:...

CVE-2021-0694

In setServiceForegroundInnerLocked of ActiveServices.java, there is a possible way for a background application to regain foreground permissions due to insufficient background restrictions. This could lead to local escalation of privilege with no additional execution privileges needed. User...

Apps removed from Google Play for harvesting user data

Dozens of apps were removed from the Google Play Store after they were found to be harvesting the data of device owners. The code in question—a software development kit SDK—was used inside apps which were downloaded over 10 million times. What happened? A wide range of Android apps were found to...

PT-2022-2528 · Microsoft · Windows Push Notifications Apps +1

Name of the Vulnerable Software and Affected Versions: Windows Push Notifications Apps affected versions not specified Description: The issue is related to an elevation-of-privilege vulnerability in Windows Push Notifications Apps, which is caused by synchronization errors when using a shared...

Samsung Galaxy S21 输入验证错误漏洞

SAMSUNG Galaxy Apps is a pre-installed application store program for Samsung mobile devices from Samsung South Korea. An input validation error vulnerability exists in Samsung Galaxy S21 versions prior to 4.5.40.5. An attacker can exploit the vulnerability to execute arbitrary code...

PT-2022-2908

Name of the Vulnerable Software and Affected Versions Microsoft Office versions affected versions not specified Microsoft 365 Apps for Enterprise versions affected versions not specified Description The issue is related to insufficient input validation in Microsoft Office and Microsoft 365 Apps f...

PT-2022-2909 · Microsoft · Office Web Apps Server +1

Name of the Vulnerable Software and Affected Versions: Microsoft Excel affected versions not specified Microsoft Office Web Apps Server affected versions not specified Description: The issue is related to insufficient input validation in Microsoft Excel and Microsoft Office Web Apps Server, which...

KLA12511 Remote code execution vulnerability in Windows Apps

Remote code execution vulnerability was found in Microsoft Apps. Malicious users can exploit this vulnerability to execute arbitrary code. Original advisories CVE-2022-26903 Related products Microsoft-Excel Microsoft-Word CVE list CVE-2022-26903 critical KB list Solution Install necessary updates...

CVE-2022-22258

The Wi-Fi module has an event notification vulnerability.Successful exploitation of this vulnerability may allow third-party applications to intercept event notifications and add information and result in elevation-of-privilege...

Citrix StoreFront Security Bulletin for CVE-2022-27503

A reflected cross-site scripting XSS issue has been discovered in Citrix StoreFront when it is configured to use SAML authentication. If exploited, this issue would allow an attacker to execute client-side JavaScript in the same context as a legitimate user. This issue has the following identifie...

The vulnerability of the Sample apps component of the Oracle WebLogic Server application server allows attackers to compromise the confidentiality and integrity of the protected information.

The vulnerability of the Sample apps component of the Oracle WebLogic Server application server exists due to insufficient validation of input data. Exploiting this vulnerability allows a malicious actor to compromise the confidentiality and integrity of the protected information...

Hamas-linked Hackers Targeting High-Ranking Israelis Using 'Catfish' Lures

A threat actor with affiliations to the cyber warfare division of Hamas has been linked to an "elaborate campaign" targeting high-profile Israeli individuals employed in sensitive defense, law enforcement, and emergency services organizations. "The campaign operators use sophisticated social...

SharkBot Banking Trojan Resurfaces On Google Play Store Hidden Behind 7 New Apps

As many as seven malicious Android apps discovered on the Google Play Store masqueraded as antivirus solutions to deploy a banking trojan called SharkBot. "SharkBot steals credentials and banking information," Check Point researchers Alex Shamshur and Raman Ladutska said in a report shared with T...

Hackers Distributing Fake Shopping Apps to Steal Banking Data of Malaysian Users

Threat actors have been distributing malicious applications under the guise of seemingly harmless shopping apps to target customers of eight Malaysian banks since at least November 2021. The attacks involved setting up fraudulent but legitimate-looking websites to trick users into downloading the...