7067 matches found
Kleopatra: Remote code execution
Background Kleopatra is a certificate manager and a universal crypto GUI. It supports managing X.509 and OpenPGP certificates in the GpgSM keybox and retrieving certificates from LDAP servers. Description Kleopatra did not safely escape command line parameters provided by URLs, which it configure...
Facebook Hits Back At Apple’s iOS 14 Privacy Update
Facebook is lambasting an upcoming Apple mobile operating system privacy update, which requires application to ask users for permission before collecting and sharing their data. In the iOS 14 update, Apple iPhone and iPad users have an explicit option to opt out of allowing apps to collect data...
TikTok: Cross-Site-Scripting on www.tiktok.com and m.tiktok.com leading to Data Exfiltration
The researcher discovered a URL parameter reflecting its value without being properly sanitized and was able to achieve reflected XSS. In addition, researcher found an endpoint which was vulnerable to CSRF. The endpoint allowed to set a new password on accounts which had used third-party apps to...
Malicious SDK found spying & defrauding users through iOS apps
By Deeba Ahmed The malicious SDK is distributed by China-based firm Mintegral. This is a post from HackRead.com Read the original post: Malicious SDK found spying & defrauding users through iOS apps...
Popular iOS SDK Accused of Spying on Billions of Users and Committing Ad Fraud
A popular iOS software development kit SDK used by over 1,200 apps—with a total of more than a billion mobile users—is said to contain malicious code with the goal of perpetrating mobile ad-click fraud and capturing sensitive information. According to a report published by cybersecurity firm Snyk...
A week in security (August 17 – 23)
Last week on Malwarebytes Labs, we looked at the impact of COVID-19 on healthcare cybersecurity, dug into some pandemic stats in terms of how workforces coped with going remote, and served up a crash course on malware detection. Our most recent Lock and Code podcast explored the safety of parenta...
US Secret Service used ‘Locate X’ to track user location without warrant
By Zara Khan Locate X collects location data from smartphone apps. This is a post from HackRead.com Read the original post: US Secret Service used Locate X to track user location without warrant...
How Financial Apps Get You to Spend More and Question Less
You should never invest without fully understanding the risks, but tax prep and stock trading services often obfuscate the things you really need to know...
HTTP/HTTPS proxy support on NetScaler based on Traffic Policies Secure Web
This article describes how to configure NetScaler to proxy the traffic from MDX apps through a Proxy server like Squid, Bluecoat. Enterprises can proxy traffic configuring simple traffic rules on NetScaler box...
Microsoft Windows and Microsoft Windows Server Elevation of Privilege Vulnerability (CNVD-2020-48256)
Microsoft Windows and Microsoft Windows Server are both products of Microsoft Corporation.Microsoft Windows is an operating system for personal devices.Microsoft Windows Server is a server operating system. An elevation of privilege vulnerability exists in Microsoft Windows and Microsoft Windows...
Microsoft Windows Work Folder Service Elevation of Privilege Vulnerability
Microsoft Windows and Microsoft Windows Server are both products of Microsoft Corporation.Microsoft Windows is an operating system for personal devices.Microsoft Windows Server is a server operating system. An elevation of privilege vulnerability exists in Microsoft Windows Work Folder Service,...
Security Update for Microsoft Office Web Apps Server 2013 (KB4484481) farm-deployment
A security vulnerability exists in Microsoft Office Web Apps Server 2013 that could allow arbitrary code to run when a maliciously modified file is opened. This update resolves that vulnerability...
US firm accused of secretly installing location tracking SDK in mobile apps
By Zara Khan AUS government contractor 'Anomaly Six' has location tracking software hidden in more than 500 mobile apps. This is a post from HackRead.com Read the original post: US firm accused of secretly installing location tracking SDK in mobile apps...
Description of the security update for Office Web Apps Server 2013: August 11, 2020
None None...
Description of the security update for SharePoint Server 2010 Office Web Apps: August 11, 2020
Description of the security update for SharePoint Server 2010 Office Web Apps: August 11, 2020 Summary This security update resolves vulnerabilities in Microsoft Office that could allow remote code execution if a user opens a specially crafted Office file. To learn more about these vulnerabilitie...
chromium-browser: Incorrect security UI in PWAs
Incorrect security UI in PWAs in Google Chrome prior to 84.0.4147.89 allowed a remote attacker who had persuaded the user to install a PWA to spoof the contents of the Omnibox URL bar via a crafted PWA...
PT-2020-3936 · Microsoft · Graphics +1
Name of the Vulnerable Software and Affected Versions: Microsoft Graphics Component affected versions not specified Description: The issue is related to the incorrect handling of objects in memory, which can allow an attacker to gain unauthorized access to protected information using a specially...
iproute2: Denial of service
Background iproute2 is a set of tools for managing Linux network routing and advanced features. Description iproute2 was found to contain a use-after-free in getnetnsidfromname in ip/ipnetns.c. Impact A remote attacker, able to feed iproute2 crafted data, may be able to cause a Denial of Service...
Zero Trust: From security option to business imperative overnight
Not long ago when I spoke with customers about Zero Trust, our conversations focused on discussing the principles, defining scope, or sharing our own IT organization’s journey. Zero Trust was something interesting to learn about, and most organizations were very much in the exploratory phase. As...