CVE-2019-1449

CVE-2019-1449 describes a security feature bypass in Office Click-to-Run (C2R) where specially crafted files can escalate from a standard user to SYSTEM within LPAC Protected View. Affected is the Office C2R handling component; exploitation requires user to open a crafted file. The CVSSv3.1 base ...

CVE-2019-1449

A security feature bypass vulnerability exists in the way that Office Click-to-Run C2R components handle a specially crafted file, which could lead to a standard user, any AppContainer sandbox, and Office LPAC Protected View to escalate privileges to SYSTEM.To exploit this bug, an attacker would...

CVE-2019-1449: Undefined Security Weakness

A security feature bypass vulnerability exists in the way that Office Click-to-Run C2R components handle a specially crafted file, which could lead to a standard user, any AppContainer sandbox, and Office LPAC Protected View to escalate privileges to SYSTEM.To exploit this bug, an attacker would...

PT-2019-3907

Name of the Vulnerable Software and Affected Versions Microsoft Office and Office 365 affected versions not specified Description The issue is related to insecure privilege management in the Click-to-Run C2R component of Microsoft Office and Office 365. It allows a remote attacker to escalate...

CVE-2019-3422

The Sec Consult Security Lab reported an information disclosure vulnerability in MF910S product to ZTE PSIRT in October 2019. Through the analysis of related product team, the information disclosure vulnerability is confirmed. The MF910S product's one-click upgrade tool can obtain the Telnet remo...

PT-2019-16574

Name of the Vulnerable Software and Affected Versions ZTE MF910S affected versions not specified Description An information disclosure issue was reported in the MF910S product, where the one-click upgrade tool can obtain the Telnet remote login password. If Telnet is enabled, an attacker can...

CVE-2019-3422: Exposure of Sensitive Information to an Unauthorized Actor

The Sec Consult Security Lab reported an information disclosure vulnerability in MF910S product to ZTE PSIRT in October 2019. Through the analysis of related product team, the information disclosure vulnerability is confirmed. The MF910S product's one-click upgrade tool can obtain the Telnet remo...

July 11, 2017, update for Office 2013 (KB3172545)

July 11, 2017, update for Office 2013 KB3172545 This article describes update 3172545 for Microsoft Office 2013 that was released on July 11, 2017. This update also applies to Office Home and Student 2013 RT. This update has a prerequisite. Be aware that the update in the Microsoft Download Cente...

Gartner names Microsoft a Leader in the 2019 Cloud Access Security Broker (CASB) Magic Quadrant

In Gartner’s third annual Magic Quadrant for Cloud Access Security Brokers CASB, Microsoft was named a Leader based on its completeness of vision and ability to execute in the CASB market. Microsoft was also identified as strongest in execution. Gartner led the industry when they defined the term...

How 18 Malware Apps Snuck Into Apple's App Store

Sing it loud: The App Store's not perfect. Especially when it's up against click fraud code this clever...

CVE-2019-11765

A compromised content process could send a message to the parent process that would cause the 'Click to Play' permission prompt to be shown. However, due to lack of validation from the parent process, if the user accepted the permission request an attacker-controlled permission would be granted...

UBUNTU-CVE-2019-11765

A compromised content process could send a message to the parent process that would cause the 'Click to Play' permission prompt to be shown. However, due to lack of validation from the parent process, if the user accepted the permission request an attacker-controlled permission would be granted...

Fake iOS Jailbreak Site Lures in Apple Users

Bad actors are taking advantage of a recently-disclosed iOS bug with a fake website claiming to give iPhone users the ability to jailbreak their phones. In reality, researchers warn, the site ultimately enables attackers to conduct click fraud. A jailbreak, a method to escape Apple’s limitations ...

Checkrain fake iOS jailbreak leads to click fraud

By Warren Mercer and Paul Rascagneres. Introduction Attackers are capitalizing on the recent discovery of a new vulnerability that exists across legacy iOS hardware. Cisco Talos recently discovered a malicious actor using a fake website that claims to give iPhone users the ability to jailbreak...

Microsoft Office 365 (2016 Click-to-Run) Multiple Vulnerabilities (Oct 2019)

This host is missing an important security update according to Microsoft Office Click-to-Run updates. SPDX-FileCopyrightText: 2019 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier:...

CVE-2019-17051

Evernote before 7.13 GA on macOS allows code execution because the com.apple.quarantine attribute is not used for attachment files, as demonstrated by a one-click attack involving a drag-and-drop operation on a crafted Terminal file...

Divergent: "Fileless" NodeJS Malware Burrows Deep Within the Host

Update 09/27/2019: Additional information regarding the malware interaction with various online advertisements has been included to highlight the click-fraud related network communications associated with Divergent. Executive summary Cisco Talos recently discovered a new malware loader being used...

CVE-2019-4109: Improper Restriction of Rendered UI Layers or Frames

IBM WebSphere eXtreme Scale 8.6 Admin Console could allow a remote attacker to hijack the clicking action of the victim. By persuading a victim to visit a malicious Web site, a remote attacker could exploit this vulnerability to hijack the victim's click actions and possibly launch further attack...

PT-2019-14927

Name of the Vulnerable Software and Affected Versions Evernote versions prior to 7.13 GA on macOS Description The issue allows code execution due to the lack of the com.apple.quarantine attribute for attachment files. This can be exploited through a one-click attack by dragging and dropping a...

PT-2019-16902 · Ibm · Ibm Websphere Extreme Scale

Name of the Vulnerable Software and Affected Versions: IBM WebSphere eXtreme Scale version 8.6 Description: A remote attacker could hijack the clicking action of a victim by persuading them to visit a malicious Web site, potentially launching further attacks against the victim. Recommendations: F...