8528 matches found
Microsoft Office security vulnerabilities
Microsoft Office is an office software suite of products from the U.S. company Microsoft Microsoft. Commonly used components of this product include Word, Excel, Access, Powerpoint, FrontPage, and so on. A security vulnerability exists in Microsoft Office Word. The following products and editions...
Microsoft Visio graphic editors Code Execution
The vulnerability of Microsoft Visio graphical editors, Microsoft Office programs, and 365 Apps for Enterprise is related to insufficient validation of input data. Exploiting this vulnerability can allow an attacker to execute arbitrary code by opening a specially created file...
Microsoft Office 365 Apps for Enterprise Buffer Overflow
The vulnerability of Microsoft Office and 365 Apps for Enterprise packages is related to the execution of operations outside the buffer in memory. Exploiting this vulnerability allows an attacker to execute arbitrary code by opening a specially created file...
Facebook Detects 400 Android and iOS Apps Stealing Users Log-in Credentials
Meta Platforms on Friday disclosed that it had identified over 400 malicious apps on Android and iOS that it said targeted online users with the goal of stealing their Facebook login information. "These apps were listed on the Google Play Store and Apple's App Store and disguised as photo editors...
Meta Says It Has Busted More Than 400 Login-Stealing Apps This Year
The company plans to alert 1 million Facebook users that their account credentials may have been compromised by malicious software...
Threat Source newsletter (Oct. 6, 2022) — Continuing down the Privacy Policy rabbit hole
By Jon Munshaw. Welcome to this week’s edition of the Threat Source newsletter. As I wrote about last week, I’ve been diving a lot into apps’ privacy policies recently. And I was recently made aware of a new type of app I never knew existed — family trackers. There are countless mobile apps for...
ASB-A-238377411
In getBackgroundRestrictionExemptionReason of AppRestrictionController.java, there is a possible way to bypass device policy restrictions due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not need...
Threat Source newsletter (Sept. 29, 2022) — Personal health apps are currently under a spotlight, but their warning signs have always been there
By Jon Munshaw. Welcome to this week’s edition of the Threat Source newsletter. I’ve spent the past few months with my colleague Ashlee Benge looking at personal health apps’ privacy policies. We found several instances of apps that carry sensitive information stating they would share certain...
CVE-2022-39255
Summary (CVE-2022-39255): The Matrix iOS SDK (prior to 0.23.19) is vulnerable to protocol confusion between Megolm and Olm for to-device messages. An attacker collaborating with a malicious homeserver can craft messages that appear to come from another user, enabling impersonation and targeted at...
Scylla Ad Fraud Attack on iOS and Android Users Halted by Apple and Google
By Waqas Before being removed, the Scylla ad fraud campaign used over 90 malicious apps to carry out its operation against Android and iOS users. This is a post from HackRead.com Read the original post: Scylla Ad Fraud Attack on iOS and Android Users Halted by Apple and Google...
[Security Nation] Taki Uchiyama of Panasonic on Product Security and Incident Response
!\Security Nation\ Taki Uchiyama of Panasonic on Product Security and Incident Responsehttps://blog.rapid7.com/content/images/2022/09/securitynationlogo-1.jpg In this episode of Security Nation, Jen and Tod chat with Taki Uchiyama about his work on Panasonic’s Product Security Incident Response...
Exchange servers abused for spam through malicious OAuth applications
Microsoft has published a security blog about an investigation into an attack in which threat actors used malicious OAuth applications to abuse Exchange servers for their spam campaign. The threat actor behind this attack has been active for many years, and has been running spam campaigns using...
GitHub: Github Apps can use Scoped-User-To-Server Tokens to Obtain Full Access to User's Projects in Project V2 GraphQL api
An incorrect authorization vulnerability was found in GitHub Enterprise Server that allowed GitHub Apps to gain access to and modify most organization-level resources that are not tied to a repository, regardless of granted permissions. This vulnerability affected all versions of GitHub Enterpris...
New Spam Attack Abusing OAuth Apps to Target Microsoft Exchange Servers
By Deeba Ahmed According to Microsoft 365 Defender Research Team, in an incident they analyzed, malicious OAuth applications were deployed on compromised cloud tenants, and eventually, attackers took over Exchange servers to carry out spam campaigns. This is a post from HackRead.com Read the...
My SpringOne 2022
It has taken me an embarrassingly long time to appreciate and understand that the devil is in the details regarding software development. Writing happy-path business logic isnt the hard part! Its the failure cases, observability, resilience, and process. Its security and other so-called...
Hackers Using Malicious OAuth Apps to Take Over Email Servers
Microsoft on Thursday warned of a consumer-facing attack that made use of rogue OAuth applications deployed on compromised cloud tenants to ultimately seize control of Exchange servers and spread spam. "The threat actor launched credential stuffing attacks against high-risk accounts that didn't...
Fake Banking Rewards Apps Install Info-stealing RAT on Android Phones
By Deeba Ahmed The malware campaign is ongoing and one of its targets was ICICI bank in India. This is a post from HackRead.com Read the original post: Fake Banking Rewards Apps Install Info-stealing RAT on Android Phones...
PT-2022-23690
Name of the Vulnerable Software and Affected Versions WhatsApp affected versions not specified Description An integer overflow in WhatsApp could result in remote code execution in an established video call. The issue affects WhatsApp mobile apps. Recommendations At the moment, there is no...
Mozilla Thunderbird security vulnerabilities
Mozilla Thunderbird is the United States Mozilla Foundation's set of independent from the Mozilla Application Suite e-mail client software. The program supports IMAP and POP mail protocols as well as the HTML mail format. A security vulnerability exists in Mozilla Thunderbird that stems from an...
