Start from zero and scale to zero – Azure Spring Apps consumption plan

We are launching a new way to pay for Azure Spring Apps -- the consumption pricing plan. This plan is now in public preview so you can start creating and deploying apps today. This new plan is super-efficient because you can start from zero and scale to zero vCPU. You get more straightforward...

Amazon Linux 2023 : xmlrpc-c, xmlrpc-c-apps, xmlrpc-c-c++ (ALAS2023-2023-068)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2023-068 advisory. A flaw was found in expat. Passing malformed 2- and 3-byte UTF-8 sequences for example, from start tag names to the XML processing application on top of expat can lead to arbitrary code execution. This...

FakeCalls Vishing Malware Targets South Korean Users via Popular Financial Apps

An Android voice phishing aka vishing malware campaign known as FakeCalls has reared its head once again to target South Korean users under the guise of over 20 popular financial apps. "FakeCalls malware possesses the functionality of a Swiss army knife, able not only to conduct its primary aim b...

Lookalike Telegram and WhatsApp Websites Distributing Cryptocurrency Stealing Malware

Copycat websites for instant messaging apps like Telegram and WhatApp are being used to distribute trojanized versions and infect Android and Windows users with cryptocurrency clipper malware. "All of them are after victims' cryptocurrency funds, with several targeting cryptocurrency wallets," ES...

CVE-2023-21465

Improper access control vulnerability in BixbyTouch prior to version 3.2.02.5 in China models allows untrusted applications access local files...

PYSEC-2023-50

Streamlit, software for turning data scripts into web applications, had a cross-site scripting XSS vulnerability in versions 0.63.0 through 0.80.0. Users of hosted Streamlit apps were vulnerable to a reflected XSS vulnerability. An attacker could craft a malicious URL with Javascript payloads to ...

PT-2023-21169 · Streamlit · Streamlit

Name of the Vulnerable Software and Affected Versions: Streamlit versions 0.63.0 through 0.80.0 Description: The issue is a cross-site scripting XSS vulnerability that affects users of hosted Streamlit apps. An attacker could craft a malicious URL with Javascript payloads to a Streamlit app,...

Security Updates for Microsoft Excel Products C2R (March 2023)

The Microsoft Excel Products are missing a security update. It is, therefore, affected by the following vulnerabilities: - A spoofing vulnerability. CVE-2023-23398 - A remote code execution vulnerability. CVE-2023-23399 Note that Nessus has not tested for these issues but has instead relied only ...

SUSE CVE-2023-25749

Android applications with unpatched vulnerabilities can be launched from a browser using Intents, exposing users to these vulnerabilities. Firefox will now confirm with users that they want to launch an external application before doing so. This bug only affects Firefox for Android. Other version...

Security Updates for Microsoft Office Web Apps (March 2023)

The Microsoft Office Web Apps installation on the remote host is missing security updates. It is, therefore, affected by multiple vulnerabilities: - A denial of service DoS vulnerability. An attacker can exploit this issue to cause the affected component to deny system or application services...

Microsoft Outlook security vulnerabilities

Microsoft Outlook is a suite of e-mail applications from Microsoft Corporation USA. A security vulnerability exists in Microsoft Outlook. The following products and editions are affected:Microsoft Office LTSC 2021 for 32-bit editions,Microsoft Outlook 2016 32-bit edition,Microsoft Office LTSC 202...

KLA48558 SB vulnerability in Microsoft Apps

A security feature bypass vulnerability was found in Microsoft Apps. Malicious users can exploit this vulnerability to bypass security restrictions. Original advisories CVE-2023-24890 Exploitation Related products OneDrive-for-iOS CVE list CVE-2023-24890 high KB list Solution Install necessary...

Fake ChatGPT Chrome Extension Hijacking Facebook Accounts for Malicious Advertising

A fake ChatGPT-branded Chrome browser extension has been found to come with capabilities to hijack Facebook accounts and create rogue admin accounts, highlighting one of the different methods cyber criminals are using to distribute malware. "By hijacking high-profile Facebook business accounts, t...

Denial Of Service (DoS)

Google Chrome is vulnerable to Denial Of Service DoS. The vulnerability exists due to the heap buffer overflow in the Platform Apps, which allows an attacker to convince a user to install a malicious extension to potentially exploit heap corruption via a crafted HTML page, leading to an applicati...

Transparent Tribe Hackers Distribute CapraRAT via Trojanized Messaging Apps

A suspected Pakistan-aligned advanced persistent threat APT group known as Transparent Tribe has been linked to an ongoing cyber espionage campaign targeting Indian and Pakistani Android users with a backdoor called CapraRAT. "Transparent Tribe distributed the Android CapraRAT backdoor via...

Transparent Tribe Hackers Distribute CapraRAT via Trojanized Messaging Apps

A suspected Pakistan-aligned advanced persistent threat APT group known as Transparent Tribe has been linked to an ongoing cyber espionage campaign targeting Indian and Pakistani Android users with a backdoor called CapraRAT. "Transparent Tribe distributed the Android CapraRAT backdoor via...

Microsoft Office Memory Read DoS

The vulnerability of Microsoft Office and Microsoft 365 Apps packages is related to reading data beyond the buffer in memory. Exploiting this vulnerability can allow an attacker to disclose sensitive information using a specially crafted file...

CVE-2023-26055 XWiki Commons may allow privilege escalation to programming rights via user's first name

XWiki Commons are technical libraries common to several other top level XWiki projects. Starting in version 3.1-milestone-1, any user can edit their own profile and inject code, which is going to be executed with programming right. The same vulnerability can also be exploited in all other places...

Provide a report that can display all applications installed on a device

Customer looking for a way to get a list or inventory of all apps from a device. The app inventory policy is not sufficient or detailed enough. Or is there a way to get the list of all apps installed on all devices, so the customer can filter out the apps. Reporting Devices and apps section only...

CVE-2023-25931

Medtronic identified that the Pelvic Health clinician apps, which are installed on the Smart Programmer mobile device, have a password vulnerability that requires a security update to fix. Not updating could potentially result in unauthorized control of the clinician therapy application, which ha...