Protecting your remote workforce from application-based attacks like consent phishing

The global pandemic has dramatically shifted how people work. As a result, organizations around the world have scaled up cloud services to support collaboration and productivity from home. We’re also seeing more apps leverage Microsoft’s identity platform to ensure seamless access and integrated...

Cerberus Banking Trojan Unleashed on Google Play

A malicious Android app has been uncovered on the Google Play app marketplace that is distributing the banking trojan, Cerberus. The app has 10,000 downloads. Researchers said that the trojan was found within the last few days, as it was being spread via a Spanish currency converter app called...

CVE-2020-9852

An integer overflow was addressed through improved input validation. This issue is fixed in iOS 13.5 and iPadOS 13.5, macOS Catalina 10.15.5, tvOS 13.4.5, watchOS 6.2.5. A malicious application may be able to execute arbitrary code with kernel privileges...

CVE-2020-9852

An integer overflow was addressed through improved input validation. This issue is fixed in iOS 13.5 and iPadOS 13.5, macOS Catalina 10.15.5, tvOS 13.4.5, watchOS 6.2.5. A malicious application may be able to execute arbitrary code with kernel privileges...

CVE-2020-9851

An access issue was addressed with improved access restrictions. This issue is fixed in macOS Catalina 10.15.5. A malicious application may be able to modify protected parts of the file system...

CVE-2020-9813

A logic issue existed resulting in memory corruption. This was addressed with improved state management. This issue is fixed in iOS 13.5 and iPadOS 13.5, macOS Catalina 10.15.5, tvOS 13.4.5, watchOS 6.2.5. A malicious application may be able to execute arbitrary code with kernel privileges...

CVE-2020-9842

An entitlement parsing issue was addressed with improved parsing. This issue is fixed in iOS 13.5 and iPadOS 13.5, macOS Catalina 10.15.5, tvOS 13.4.5, watchOS 6.2.5. A malicious application could interact with system processes to access private information and perform privileged actions...

Shopify: Account takeover intercepting magic link for Arrive app

Summary The "magic link" used for login by Arrive app uses Branch.io to pass the login token via deeplink to the app. But the URL contained in the link app.link domain is not verified so it can be intercepted by a malicious app at takeover the account. Description When trying to login with Arrive...

Huawei Taurus-AL00B Information Disclosure Vulnerability

The Huawei Taurus-AL00B is a smartphone from the Chinese company Huawei Huawei. An information disclosure vulnerability exists in previous versions of Huawei Taurus-AL00B 10.0.0.205 C00E201R7P2, which stems from a program that fails to adequately authenticate a user's identity, and can be exploit...

CVE-2020-9070

Huawei smartphones Taurus-AL00B with versions earlier than 10.0.0.205C00E201R7P2 have an improper authentication vulnerability. The software insufficiently validate the user's identity when a user wants to do certain operation. An attacker can trick user into installing a malicious application to...

CVE-2020-3919

A memory initialization issue was addressed with improved memory handling. This issue is fixed in iOS 13.4 and iPadOS 13.4, macOS Catalina 10.15.4, tvOS 13.4, watchOS 6.2. A malicious application may be able to execute arbitrary code with kernel privileges...

CVE-2020-3892

A memory corruption issue was addressed with improved input validation. This issue is fixed in macOS Catalina 10.15.4. A malicious application may be able to execute arbitrary code with kernel privileges...

CVE-2020-3905

A memory corruption issue was addressed with improved input validation. This issue is fixed in macOS Catalina 10.15.4. A malicious application may be able to execute arbitrary code with kernel privileges...

Hackers exploiting vulnerable routers to drop malicious “WHO” COVID-19 app

By Sudais Asif In the wake of the Coronavirus or COVID-19 pandemic, we've seen cybercriminals take full advantage and launch different attacks as we covered them recently on HackRead.com. This is a post from HackRead.com Read the original post: Hackers exploiting vulnerable routers to drop...

Apple macOS Catalina AppleGraphicsControl Component Memory Corruption Vulnerability

Apple macOS Catalina is a specialized operating system developed by Apple for Mac computers.AppleGraphicsControl is one of the graphics control components. A memory corruption vulnerability exists in the AppleGraphicsControl component in Apple macOS Catalina versions prior to 10.15.4. An attacker...

Apple macOS Catalina Bluetooth component memory corruption vulnerability (CNVD-2020-22464)

Apple macOS Catalina is a specialized operating system developed by Apple for Mac computers.Bluetooth is one of the Bluetooth components. A memory corruption vulnerability exists in the Bluetooth component in Apple macOS Catalina versions prior to 10.15.4. An attacker can exploit this vulnerabili...

Memory Corruption Vulnerability in Kernel Component of Multiple Apple Products (CNVD-2020-22118)

Apple iOS is an operating system developed for mobile devices.Apple watchOS is an operating system for smartwatches.Apple iPadOS is an operating system for iPad tablets.Kernel is a kernel component of the operating system.Apple watchOS is a smartwatch operating system.Apple watchOS is a smartwatc...

CVE-2020-1878

Huawei smartphone OxfordS-AN00A with versions earlier than 10.0.1.152DC735E152R3P3,versions earlier than 10.0.1.160C00E160R4P1 have an improper authentication vulnerability. Authentication to target component is improper when device performs an operation. Attackers exploit this vulnerability to...

Huawei Honor V30 OxfordS-AN00A Authorization Issues Vulnerability

Huawei Honor V30 is a smartphone from Chinese company Huawei Huawei. An authorization issue vulnerability exists in Huawei Honor V30 OxfordS-AN00A prior version 10.0.1.167 C00E166R4P1. An attacker can exploit the vulnerability to obtain partial information with the help of a malicious application...

CVE-2020-1812

HUAWEI P30 smartphones with versions earlier than 10.0.0.173C00E73R1P11 have an improper authentication vulnerability. Due to improperly validation of certain application, an attacker should trick the user into installing a malicious application to exploit this vulnerability. Successful exploit...