Experts Shed Light on BlackGuard Infostealer Malware Sold on Russian Hacking Forums

A previously undocumented "sophisticated" information-stealing malware named BlackGuard is being advertised for sale on Russian underground forums for a monthly subscription of $200. "BlackGuard has the capability to steal all types of information related to Crypto wallets, VPN, Messengers, FTP...

URI spoofing flaw could phish WhatsApp, Signal, Instagram, and iMessage users

Update: We were informed by Sick Codes that, although Signal already has a fix for this URI flaw here, it hasnt been pushed out to market yet. Well further update this post once there is new development. Theres a flaw in the way many of the worlds most popular messaging and email platforms—such a...

CVE-2021-39791

In WallpaperManagerService, there is a possible way to determine whether an app is installed, without query permissions, due to side channel information disclosure. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for...

CVE-2021-39791

In WallpaperManagerService, there is a possible way to determine whether an app is installed, without query permissions, due to side channel information disclosure. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for...

CVE-2021-39769

In Device Policy, there is a possible way to determine whether an app is installed, without query permissions, due to a missing permission check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.Product...

CVE-2021-39754

In ContextImpl, there is a possible way to determine whether an app is installed, without query permissions, due to side channel information disclosure. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for...

Forcing WhatsApp and iMessage to Work Together Is Doomed to Fail

Europe’s Digital Markets Act requires interoperability between popular messaging apps. But experts warn encryption could be compromised...

Stop Tracking Your Loved Ones

Tracking apps hijack your psyche. Here's how to regain control...

CVE-2021-45490

The client applications in 3CX on Windows, the 3CX app for iOS, and the 3CX application for Android through 2022-03-17 lack SSL certificate validation...

Unable to launch published apps through the Gateway, no errors

-The customer cannot launch apps when logging in to the NetScaler gateway -The applications enumerate but won't launch, the progress popup comes up and disappears with no errors...

The vulnerability of Microsoft Office packages, Microsoft Word, and Microsoft 365 Apps for Enterprise arises from insufficient validation of input data. This allows attackers to disclose sensitive information and circumvent existing security restrictions.

The vulnerability of Microsoft Office, Microsoft Word, and Microsoft 365 Apps for Enterprise packages is related to insufficient validation of input data. Exploiting this vulnerability can allow attackers to disclose sensitive information and circumvent existing security restrictions...

The vulnerability of Microsoft Office and Microsoft 365 Apps for Enterprise applications relates to writing beyond the buffer in memory, allowing an attacker to execute arbitrary code.

The vulnerability of Microsoft Office and Microsoft 365 Apps for Enterprise applications relates to writing beyond buffer boundaries in memory during the execution of the EMRCOMMENTEMFPLUS command in EMF files. Exploiting this vulnerability can allow attackers to execute arbitrary code using a...

The vulnerability of Microsoft Office and Microsoft 365 Apps for Enterprise packages is related to security configuration errors, allowing attackers to bypass security measures.

The vulnerability of Microsoft Office and Microsoft 365 Apps for Enterprise packages is related to security configuration errors. Exploiting this vulnerability can allow attackers to bypass security measures...

Experts Uncover Campaign Stealing Cryptocurrency from Android and iPhone Users

Researchers have blown the lid off a sophisticated malicious scheme primarily targeting Chinese users via copycat apps on Android and iOS that mimic legitimate digital wallet services to siphon cryptocurrency funds. "These malicious apps were able to steal victims' secret seed phrases by...

CVE-2020-20094

Instagram iOS 106.0 and prior and Android 107.0.0.11 and prior user interface does not properly represent URI messages to the user, which results in URI spoofing via specially crafted messages...

DEBIAN-CVE-2021-4156

An out-of-bounds read flaw was found in libsndfile's FLAC codec functionality. An attacker who is able to submit a specially crafted file via tricking a user to open or otherwise to an application linked with libsndfile and using the FLAC codec, could trigger an out-of-bounds read that would most...

Authentication Bypass in Jira Seraph - CVE-2022-0540

i Updates 2022/05/05 11:30 AM PDT Updated the List of affected Atlassian Marketplace Apps section to note the following apps have non-vulnerable updates available: Secure Code Warrior® for Jira Simple Tasklists Simple Team Pages for Jira UiPath Test Manager for Jira Xporter - Export issues from...

The vulnerability of Microsoft Office and Microsoft 365 Apps for Enterprise packages, related to data type conversion errors, allows attackers to execute arbitrary code.

The vulnerability of Microsoft Office and Microsoft 365 Apps for Enterprise packages is related to errors in data type conversion during the writing of the EMRCOMMENTEMFPLUS file in EMF format. Exploiting this vulnerability can allow an attacker to execute arbitrary code by opening a malicious pa...

The vulnerability of Microsoft Office and Microsoft 365 Apps for Enterprise packages, related to pointer swapping errors, allows a perpetrator to execute arbitrary code.

The vulnerability of Microsoft Office and Microsoft 365 Apps for Enterprise packages is related to errors in pointer assignment during the execution of the EMRCOMMENTEMFPLUS field in EMF files. Exploiting this vulnerability can allow an attacker to execute arbitrary code by opening a malicious pa...

'CryptoRom' Crypto Scam Abusing iPhone Features to Target Mobile Users

Social engineering attacks leveraging a combination of romantic lures and cryptocurrency fraud have been deceiving unsuspecting victims into installing fake apps by taking advantage of legitimate iOS features like TestFlight and Web Clips. Cybersecurity company Sophos, which has named the organiz...