CVE-2017-0489: Undefined Security Weakness

An elevation of privilege vulnerability in Location Manager could enable a local malicious application to bypass operating system protections for location data. This issue is rated as Moderate because it could be used to generate inaccurate data. Product: Android. Versions: 4.4.4, 5.0.2, 5.1.1,...

Tracking Devices Latest Privacy Risk to Users

Update: TrackR has responded to Rapid7’s disclosure. First, it said it has addressed the authentication issue months ago, but the deprecated call remained online even though it was no longer used by its apps. “We are grateful that Rapid7 brought this possible point of confusion to our attention; ...

Mobile Applications Leak Device, Location Data

Both Android and iOS apps leak data, leaving users vulnerable to data theft, denial-of-service attacks, and remote SIM card rooting. In a report released Thursday “Are mobile apps a leaky tap in the enterprise?” researchers at Zscaler assert that Android and iOS users are equally vulnerable to a...

Foreman API and UI Privilege Vulnerability

Foreman is a set of lifecycle management tools for use in physical and virtual servers. The tool provides features such as service provisioning, configuration management, and status reporting. A privilege-lifting vulnerability exists in the Foreman API and UI. When a restricted user from a specif...

CVE-2016-1779

WebKit in Apple iOS before 9.3 and Safari before 9.1 allows remote attackers to bypass the Same Origin Policy and obtain physical-location data via a crafted geolocation request...

CVE-2016-1779

WebKit in Apple iOS before 9.3 and Safari before 9.1 allows remote attackers to bypass the Same Origin Policy and obtain physical-location data via a crafted geolocation request...

UBUNTU-CVE-2016-1779

WebKit in Apple iOS before 9.3 and Safari before 9.1 allows remote attackers to bypass the Same Origin Policy and obtain physical-location data via a crafted geolocation request...

PT-2016-1529

Name of the Vulnerable Software and Affected Versions Safari versions prior to 9.1 iOS versions prior to 9.3 Description The issue allows remote attackers to bypass the Same Origin Policy and obtain physical-location data via a crafted geolocation request. This is due to a lack of protection for...

Apple Patches iOS Ins0mnia Vulnerability

Apple’s monster security update of Aug. 13 included a patch for an iOS vulnerability that could beacon out location data and other personal information from a device, even if a particular task has been shut off by the user. A mobile app exploiting this vulnerability could also look benign enough ...

CVE-2014-4453

Apple iOS before 8.1.1 and OS X before 10.10.1 include location data during establishment of a Spotlight Suggestions server connection by Spotlight or Safari, which might allow remote attackers to obtain sensitive information via unspecified vectors...

Design/Logic Flaw

Apple iOS before 8.1.1 and OS X before 10.10.1 include location data during establishment of a Spotlight Suggestions server connection by Spotlight or Safari, which might allow remote attackers to obtain sensitive information via unspecified vectors...

CVE-2014-4453

Apple iOS before 8.1.1 and OS X before 10.10.1 include location data during establishment of a Spotlight Suggestions server connection by Spotlight or Safari, which might allow remote attackers to obtain sensitive information via unspecified vectors...

CVE-2014-4453

CVE-2014-4453 affects Apple iOS before 8.1.1 and OS X before 10.10.1. The issue concerns Spotlight/Safari connections to Spotlight Suggestions where a user’s approximate location is included in the initial connection, potentially enabling information disclosure via unspecified vectors. Documents ...

CVE-2014-4453: Exposure of Sensitive Information to an Unauthorized Actor

Apple iOS before 8.1.1 and OS X before 10.10.1 include location data during establishment of a Spotlight Suggestions server connection by Spotlight or Safari, which might allow remote attackers to obtain sensitive information via unspecified vectors...

Privacy Criticism Hits OSX Yosemite over Location Data

Apple has fixed a huge number of security vulnerabilities in OS X and iTunes and, at the same time, is being hit with criticisms about privacy issues in the new version of OS X. The latest version of the operating system, known as Yosemite, sends location information to Apple by default via the...

New Verizon Transparency Report Shows Large Government Appetite for Location, Content Data

Verizon said in a new transparency report that though the number of some kinds of orders dropped–including wiretap orders and warrants–others rose, including general orders and pen register and trap and trace orders, and the company received nearly 150,000 total orders in the first half of 2014...

First AT&T Transparency Report Shows 2,000+ NSL Requests

AT&T, in its first transparency report, said that it received at least 2,000 National Security Letters and nearly 38,000 requests for location data on its subscribers in 2013. The new report from AT&T is the latest in a growing list of publications from telecom companies, Web providers and cell...

Starbucks Patches Vulnerable iOS App

Starbucks has patched a vulnerability in its iOS app that was found last week spilling user data, including usernames and passwords, by adding what it’s called an “additional safeguard measure” to protect its customers. While it’s a relatively quick turnaround for the company – it only took about...

NSA Monitors Google PREF Cookie to Spy

The National Security Agency is monitoring a certain type of cookie – deployed by the search giant Google – as yet another tool in their increasingly public surveillance apparatus. This, according to slides from an April 2013 NSA presentation acquired by the Washington Post, is the latest...

NSA Director Alexander Confirms Cell Location Pilot Program

In between pleas to end the government shutdown that has upwards of 70 percent of the intelligence community furloughed until further notice, NSA director Gen. Keith Alexander and Director of National Intelligence James Clapper spent a significant amount of time before a Senate Judiciary Committe...