CVE-2022-20234

In Car Settings app, the NotificationAccessConfirmationActivity is exported. In NotificationAccessConfirmationActivity, it gets both 'mComponentName' and 'pkgTitle' from user.An unprivileged app can use a malicous mComponentName with a benign pkgTitle e.g. Settings app to make users enable...

U.S. FTC Vows to Crack Down on illegal Use and Sharing of Citizens' Sensitive Data

The U.S. Federal Trade Commission FTC warned this week that it will crack down on tech companies' illegal use and sharing of highly sensitive data and false claims about data anonymization. "While many consumers may happily offer their location data in exchange for real-time crowd-sourced advice ...

CVE-2022-33708

Improper input validation vulnerability in AppsPackageInstaller in Galaxy Store prior to version 4.5.41.8 allows local attackers to launch activities as Galaxy Store privilege...

July 12, 2022—KB5015827 (OS Build 20348.825)

None None...

KLA12584 Multiple vulnerabilities in Microsoft Office

Multiple vulnerabilities were found in Microsoft Office. Malicious users can exploit these vulnerabilities to execute arbitrary code, bypass security restrictions. Below is a complete list of vulnerabilities: 1. A remote code execution vulnerability in Skype for Business and Lync can be exploited...

Galaxy Store Improper Authorization

The vulnerability of the Galaxy Store app is related to improper authorization. Exploiting this vulnerability allows a hacker to install apps from the Galaxy Store without any interaction with the user...

CVE-2015-5298: Improper Authentication

The Google Login Plugin versions 1.0 and 1.1 allows malicious anonymous users to authenticate successfully against Jenkins instances that are supposed to be locked down to a particular Google Apps domain through client-side request modification...

Fedora: Security Advisory for moby-engine (FEDORA-2022-fae3ecee19)

The remote host is missing an update for the Copyright C 2022 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

Fedora: Security Advisory for golang-github-spf13-cobra (FEDORA-2022-fae3ecee19)

The remote host is missing an update for the Copyright C 2022 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

My Body, My Data Act would lock down reproductive and sexual health data

A new bill entered into both the House of Representatives and the Senate proposes the strongest Federal data privacy protections yet for an increasingly scrutinized form of data in the United States—reproductive and sexual health data. The “My Body, My Data Act of 2022” was announced in early Jun...

Cloud OSINT. Finding Interesting Resources

Locating sensitive information, personally identifiable information PII and questionable assets in the cloud. TL; DR I had a curiosity driven excursion into the public clouds of AWS and Azure to find what is publicly hosted and who by. As anticipated, the results were extremely broad and...

Microsoft Excel Office Web Apps Server Code Execution

The vulnerability of Microsoft Excel and Microsoft Office Web Apps Server programs is related to insufficient validation of input data. Exploiting this vulnerability allows an attacker to execute arbitrary code using a specially created malicious file...

Input validation

An improper validation vulnerability in IBM InfoSphere Information Server 11.7 Pack for SAP Apps and BW Packs may lead to creation of directories and files on the server file system that may contain non-sensitive debugging information like stack traces. IBM X-Force ID: 221323...

CVE-2022-22373

CVE-2022-22373 affects IBM InfoSphere Information Server Pack for SAP Apps and BW Packs (11.7). The vulnerability is an improper validation that may allow creation of directories/files on the server filesystem containing non‑sensitive debugging info (e.g., stack traces). Impact per sources includ...

Amazon Quietly Patches 'High Severity' Vulnerability in Android Photos App

Amazon, in December 2021, patched a high severity vulnerability affecting its Photos app for Android that could have been exploited to steal a user's access tokens. "The Amazon access token is used to authenticate the user across multiple Amazon APIs, some of which contain personal data such as...

CVE-2022-22373: Undefined Security Weakness

An improper validation vulnerability in IBM InfoSphere Information Server 11.7 Pack for SAP Apps and BW Packs may lead to creation of directories and files on the server file system that may contain non-sensitive debugging information like stack traces. IBM X-Force ID: 221323...

Security Updates for Microsoft Office Web Apps (April 2022)

The Microsoft Office Web Apps installation on the remote host is missing a security update. It is, therefore, affected by a remote code execution vulnerability. An attacker can exploit this to bypass authentication and execute unauthorized arbitrary commands. C Tenable Network Security, Inc...

Security Bulletin: IBM InfoSphere Information Server Pack for SAP Apps and BW Packs is affected by an improper validation vulnerability

Summary An improper validation vulnerability in IBM InfoSphere Information Server Pack for SAP Apps and BW Packs was addressed. Vulnerability Details CVEID:CVE-2022-22373 DESCRIPTION: An improper validation vulnerability in IBM InfoSphere Information Server Pack for SAP Apps and BW Packs may lead...

Microsoft 365 Apps for Enterprise Code Execution

The vulnerability of Microsoft 365 Apps for Enterprise and Microsoft Office lies in insufficient validation of input data. Exploiting this vulnerability allows an attacker to execute arbitrary code by loading a specially created file...

LGBTQ+ community targeted by extortionists who threaten to publish nudes

The FTC Federal Trade Commission has warned the LGBTQ+ community about extortionists posing as potential romantic partners on Grindr and Feeld. The scammers send their targets explicit photos and then ask for them to reciprocate. If they do, targets are then blackmailed into paying a ransom,...