1791 matches found
CVE-2024-40787
CVE-2024-40787 is a local, low-privilege impact issue in Apple platforms where an attacker could bypass internet permission prompts. The root cause involves the handling of user consent prompts, allowing a Shortcut to circumvent Internet permission requirements. Affected products/versions include...
US senators ask FTC to investigate car makers’ privacy practices
An ongoing US Senate investigation indicated that connected car makers violate consumer privacy by sharing and selling drivers’ data, including their location, on a vast scale, and that the same car makers often obtain consumer consent through deception. Based on this investigation, senators have...
PT-2024-29045 · Apple · Macos Monterey +6
Name of the Vulnerable Software and Affected Versions: macOS Ventura versions prior to 13.6.8 macOS Monterey versions prior to 12.7.6 iOS versions prior to 17.6 iPadOS versions prior to 17.6 watchOS versions prior to 10.6 macOS Sonoma versions prior to 14.6 Description: This issue allows a shortc...
Meta Given Deadline to Address E.U. Concerns Over 'Pay or Consent' Model
Meta has been given time till September 1, 2024, to respond to concerns raised by the European Commission over its "pay or consent" advertising model or risk-facing enforcement measures, including sanctions. The European Commission said the Consumer Protection Cooperation CPC Network has notified...
Gen Z breakups tainted by login abuse for spying and stalking, research shows
Breaking up is hard to do, but for younger Americans today, ending a romantic relationship requires more than a heart-to-heart conversation—it could also require protection against follow-on invasions of online privacy and security. According to a new analysis of research released earlier this...
Google Android Security Vulnerability
Google Android is a Linux-based open source operating system from Google, Inc. in the United States. A security vulnerability exists in Google Android, which stems from a lack of permission checking in the CompanionDeviceManagerService.java method, which may have a method to pair a companion devi...
Brazil Halts Meta's AI Data Processing Amid Privacy Concerns
Brazil's data protection authority, Autoridade Nacional de Proteção de Dados ANPD, has temporarily banned Meta from processing users' personal data to train the company's artificial intelligence AI algorithms. The ANPD said it found "evidence of processing of personal data based on inadequate leg...
Meta's 'Pay or Consent' Approach Faces E.U. Competition Rules Scrutiny
Meta's decision to offer an ad-free subscription in the European Union E.U. has faced a new setback after regulators accused the social media behemoth of breaching the bloc's competition rules by forcing users to choose between seeing ads or paying to avoid them. The European Commission said the...
CVE-2024-4869
The WP Cookie Consent for GDPR, CCPA & ePrivacy plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘Client-IP’ header in all versions up to, and including, 3.2.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers...
WordPress Plugin WP Cookie Consent Cross-Site Scripting Vulnerability
WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a set of blogging platform developed using the PHP language. The platform supports personal blog sites on servers with PHP and MySQL. WordPress plugin is an application plugin. A cross-site scripting...
CVE-2024-4869
Based on the CVE entry CVE-2024-4869 and corroborating sources, the WP Cookie Consent plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Client-IP header in all versions up to 3.2.0 due to insufficient input sanitization and output escaping. The vulnerability can allow an u...
CVE-2024-4869 WP Cookie Consent ( for GDPR, CCPA & ePrivacy ) <= 3.2.0 - Unauthenticated Stored Cross-Site Scripting via Client-IP header
The WP Cookie Consent for GDPR, CCPA & ePrivacy plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘Client-IP’ header in all versions up to, and including, 3.2.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers...
MAL-2024-2018 Malicious code in consent-page (npm)
--- -= Per source details. Do not edit below this line.=-...
Malicious code in consent-page (npm)
--- -= Per source details. Do not edit below this line.=-...
Signal Foundation Warns Against EU's Plan to Scan Private Messages for CSAM
A controversial proposal put forth by the European Union to scan users' private messages for detection of child sexual abuse material CSAM poses severe risks to end-to-end encryption E2EE, warned Meredith Whittaker, president of the Signal Foundation, which maintains the privacy-focused messaging...
Meta Pauses AI Training on EU User Data Amid Privacy Concerns
Meta on Friday said it's delaying its efforts to train the company's large language models LLMs using public content shared by adult users on Facebook and Instagram in the European Union following a request from the Irish Data Protection Commission DPC. The company expressed disappointment at...
Google's Privacy Sandbox Accused of User Tracking by Austrian Non-Profit
Google's plans to deprecate third-party tracking cookies in its Chrome web browser with Privacy Sandbox has run into fresh trouble after Austrian privacy non-profit noyb none of your business said the feature can still be used to track users. "While the so-called 'Privacy Sandbox' is advertised a...
When things go wrong: A digital sharing warning for couples
“When things go wrong” is a troubling prospect for most couples to face, but the internet—and the way that romantic partners engage both with and across it—could require that this worst-case scenario become more of a best practice. In new research that Malwarebytes will release this month, romant...
