Kids’ Apps on Google Play Rife with Privacy Violations

About 20 percent of the Top 500 kids’ mobile apps in the Google Play store are collecting data on users in a way that likely violates the Children’s Online Privacy Protection Act COPPA. These have been downloaded by a collective 492 million users, researchers said. That’s according to an analysis...

Apollos Apps licensing issue vulnerability

Apollos Apps is an open source platform for distributing church-related applications. Apollos Apps suffers from an authorization issue vulnerability that stems from the fact that new user registrations only need to know basic personal information about anyone name, birthday, gender, etc. in order...

CVE-2021-32691

Apollos Apps is an open source platform for launching church-related apps. In Apollos Apps versions prior to 2.20.0, new user registrations are able to access anyone's account by only knowing their basic profile information name, birthday, gender, etc. This includes all app functionality within t...

CVE-2021-32691

Apollos Apps is an open source platform for launching church-related apps. In Apollos Apps versions prior to 2.20.0, new user registrations are able to access anyone's account by only knowing their basic profile information name, birthday, gender, etc. This includes all app functionality within t...

Information disclosure

Apollos Apps is an open source platform for launching church-related apps. In Apollos Apps versions prior to 2.20.0, new user registrations are able to access anyone's account by only knowing their basic profile information name, birthday, gender, etc. This includes all app functionality within t...

CVE-2021-32691

CVE-2021-32691 affects Apollos Apps prior to v2.20.0, where new user registrations can access anyone’s account using only basic profile information (name, birthday, gender, etc.). This grants access to all app functionality and Rock-based links (e.g., giving, events). A patch exists in v2.20.0. A...

Improper Authentication in Atlassian Connect Spring Boot

Broken Authentication in Atlassian Connect Spring Boot ACSB in version 1.1.0 before 2.1.3 and from version 2.1.4 before 2.1.5: Atlassian Connect Spring Boot is a Java Spring Boot package for building Atlassian Connect apps. Authentication between Atlassian products and the Atlassian Connect Sprin...

Citrix Virtual Apps and Desktops multiple vulnerabilities (CTX285059)

The version of Citrix Virtual Apps and Desktops installed on the remote Windows host is prior to 7 2006 or prior to 1912 LTSR CU1. It is, therefore, affected by multiple vulnerabilities: - An authenticated user on a multi-session VDA can perform arbitrary command execution as SYSTEM. CVE-2020-826...

Microsoft Teams: Very Bad Tabs Could Have Led to BEC

Attackers could have stepped through a yawning security hole in Microsoft Teams chat service that would have let them masquerade as a targeted company’s employee by reading and sending email on their behalf. On Monday, Tenable’s Evan Grant explained in a post that he found the bug in Microsoft...

Microsoft Teams: Very Bad Tabs Could Have Led to BEC

Attackers could have stepped through a yawning security hole in the Microsoft Teams chat service that would have let them masquerade as a targeted company’s employee, by reading and sending email on their behalf. On Monday, Tenable’s Evan Grant explained in a post that he found the bug in Microso...

CVE-2021-25405

An improper access control vulnerability in ScreenOffActivity in Samsung Notes prior to version 4.2.04.27 allows untrusted applications to access local files...

CVE-2021-25389

Improper running task check in S Secure prior to SMR MAY-2021 Release 1 allows attackers to use locked app without authentication...

CVE-2021-25412

An improper access control vulnerability in genericssoservice prior to SMR JUN-2021 Release 1 allows local attackers to execute protected activity with system privilege via untrusted applications...

Hackers Can Exploit Samsung Pre-Installed Apps to Spy On Users

Multiple critical security flaws have been disclosed in Samsung's pre-installed Android apps, which, if successfully exploited, could have allowed adversaries access to personal data without users' consent and take control of the devices. "The impact of these bugs could have allowed an attacker t...

Bbscope - Scope Gathering Tool For HackerOne, Bugcrowd, And Intigriti!

The ultimate scope gathering tool for HackerOne, Bugcrowd, and Intigriti by sw33tLie. Need to grep all the large scope domains that you've got on your bug bounty platforms? This is the right tool for the job. What about getting a list of android apps that you are allowed to test? We've got you...

CVE-2020-11178

Trusted APPS to overwrite the CPZ memory of another use-case as TZ only checks the physical address not overlapping with its memory and its RoT memory in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon...

CVE-2020-11178

CVE-2020-11178 affects Qualcomm Snapdragon automotive/IoT platforms (Snapdragon Auto, Compute, Connectivity, Consumer IoT, Industrial IoT, Mobile, Voice & Music, Wired Infrastructure & Networking). The issue arises when trusted apps overwrite CPZ memory because the TrustZone (TZ) logic only check...

Description of the security update for Office Web Apps Server 2013: June 8, 2021 (KB5001956)

None None...

Microsoft Office Excel 代码注入漏洞

Microsoft Excel is a spreadsheet processing software in the Office suite of Microsoft Corporation USA. A security vulnerability exists in Microsoft Office Excel. The following products and editions are affected:Microsoft Office 2013 Service Pack 1 64-bit editions,Microsoft Office Web Apps Server...

HDX Adaptive Transport Configuration for Gateway Service

If you have users that use Workspace app for Linux or Android to access virtual apps or desktops through Gateway Service, they may be unable to launch sessions after Enlightened Data Transport EDT is enabled in Gateway Service...