PT-2022-10943

Name of the Vulnerable Software and Affected Versions Android SoC versions affected versions not specified Description The ismsEx service, an extension of the SMS system service in Unisoc equipment, fails to check the permissions of the caller, resulting in permission leaks. This allows third-par...

Google Android 安全漏洞

Google Android is a Linux-based open source operating system from Google, Inc. A security vulnerability exists in Google Android, which stems from allowing untrusted applications to load arbitrary URLs and local files. No details of the vulnerability are currently available...

Samsung Wear Os 安全漏洞

Samsung Wear Os is a version of the Android operating system from the South Korean company Samsung. It is designed for wearable computer devices such as smartwatches. Wear OS has a security vulnerability that stems from allowing untrusted apps to fail to disable theater mode with proper...

PT-2022-10941 · Google +1 · Android +1

Name of the Vulnerable Software and Affected Versions: Android SoC versions affected versions not specified Description: The issue concerns a vendor system service used to manage VoLTE in Unisoc devices. This service does not verify the caller's permissions, allowing normal apps without phone...

PT-2022-16984 · Samsung · Samsung Searchwidget

Name of the Vulnerable Software and Affected Versions: Samsung SearchWidget versions prior to 2.3.00.6 Description: The issue is related to improper access control in the Samsung SearchWidget, allowing untrusted applications to load arbitrary URLs and local files in a webview. Recommendations: Fo...

Remote sessions are abruptly disconnected on Endpoints for Mac

Citrix Virtual Apps and Desktops sessions get abruptly disconnected on endpoints for Mac, which use Microsoft Defender...

Microsoft takes macros out of the equation for five Office apps

Microsoft says it is going to disable macros in five Office apps by default. Besides Excel 4.0 macros, which were disabled by default last month, now VBA macros obtained from the Internet will be blocked by default as well. The change will begin rolling out in Version 2203, starting with Current...

Security Updates for Microsoft Office Web Apps (February 2022)

The Microsoft Office Web Apps installation on the remote host is missing a security update. It is, therefore, affected by the following vulnerability: - An information disclosure vulnerability. An attacker can exploit this to disclose potentially sensitive information. CVE-2022-22716 %NASLMINLEVE...

PT-2022-1669 · Microsoft · 365 Apps For Enterprise +1

Name of the Vulnerable Software and Affected Versions: Microsoft Office affected versions not specified Microsoft 365 Apps for Enterprise affected versions not specified Description: The issue is related to incorrect code generation management in the Click-to-Run C2R service for Microsoft Office...

Securitas breached, 3TB of airport employee records exposed

An unsecured AWS server, found open to the public Internet, is the root cause of a huge compromise of data of airport employees in Colombia and Peru. This server, according to a report, belongs to Securitas, a Stockholm-based multinational company that provides security services like security...

Argo CD Security Bug Opens Kubernetes Cloud Apps to Attackers

A high-severity security vulnerability in Argo CD can enable attackers to access targets’ application-development environments, paving the way for stealing passwords, API keys, tokens and other sensitive information. Argo CD is a continuous-delivery platform deployed as a Kubernetes controller in...

They Were ‘Calling to Help.’ Then They Stole Thousands

When my mom fell victim to a phone scam, we learned a painful truth: The explosion of personal finance apps makes it all too easy to target vulnerable people...

Thousands of Malicious npm Packages Threaten Web Apps

More than 1,300 malicious packages have been identified in the most oft-downloaded JavaScript package repository used by developers, npm, in the last six months — a rapid increase that showcases how npm has become a launchpad for a range of nefarious activities. New research from open-source...

Duo of Android dropper and payload target certain countries and app users

After making its first in-the-wild appearance in March 2021, Vultur—an information-stealing RAT that runs on Android—is back. And its dropper is equally nasty. Vultur Romanian for "vulture" is known to target banks, cryptocurrency wallets, social media Facebook, TikTok, and messaging services...

ASB-A-207479207

ismsEx service is a vendor service in unisoc equipment。ismsEx service is an extension of sms system service，but it does not check the permissions of the caller，resulting in permission leaks。Third-party apps can use this service to arbitrarily modify and set system properties。...

OpenJDK: Incorrect access checks in XMLEntityManager (JAXP, 8270498)

Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE component: JAXP. Supported versions that are affected are Oracle Java SE: 7u321, 8u311, 11.0.13, 17.0.1; Oracle GraalVM Enterprise Edition: 20.3.4 and 21.3.0. Easily exploitable vulnerability allows...

Widespread FluBot and TeaBot Malware Campaigns Targeting Android Devices

Researchers from the Bitdefender Mobile Threats team said they have intercepted more than 100,000 malicious SMS messages attempting to distribute Flubot malware since the beginning of December. "Findings indicate attackers are modifying their subject lines and using older yet proven scams to enti...

Microsoft warns of phishy OAuth apps

Microsoft is warning Office 365 users to watch out for a phishy emails asking you to install an app called Upgrade. The app requests multiple permissions which could cause problems on a network if granted: Creating inbox rules Read and write emails and calendar items Read contacts This is only th...

OpenJDK: Incorrect access checks in XMLEntityManager (JAXP, 8270498)

Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE component: JAXP. Supported versions that are affected are Oracle Java SE: 7u321, 8u311, 11.0.13, 17.0.1; Oracle GraalVM Enterprise Edition: 20.3.4 and 21.3.0. Easily exploitable vulnerability allows...

OpenJDK: Insufficient URI checks in the XSLT TransformerImpl (JAXP, 8270492)

Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE component: JAXP. Supported versions that are affected are Oracle Java SE: 7u321, 8u311, 11.0.13, 17.0.1; Oracle GraalVM Enterprise Edition: 20.3.4 and 21.3.0. Easily exploitable vulnerability allows...