734 matches found
CVE-2019-20603
Summary: CVE-2019-20603 concerns a NULL pointer dereference in the ESECOMM Trustlet on Samsung mobile devices running N(7.x), O(8.0), and P(9.0) on Qualcomm chipsets. The issue originates in the Trustlet and is documented with Samsung ID SVE-2019-13950. The CVSS metrics indicate a network-exposed...
CVE-2019-20580
An issue was discovered on Samsung mobile devices with P9.0 software. The Motion photo player allows attackers to bypass the Secure Folder feature to view images. The Samsung ID is SVE-2019-14653 August 2019...
CVE-2019-20579
An issue was discovered on Samsung mobile devices with N7.x, O8.x, and P9.0 software. Gallery allows attackers to enable Location information sharing from the lock screen. The Samsung ID is SVE-2019-14462 August 2019...
CVE-2019-20578
An issue was discovered on Samsung mobile devices with P9.0 Exynos 9820 chipsets software. A Buffer overflow occurs when loading the UH Partition during Secure Boot. The Samsung ID is SVE-2019-14412 August 2019...
CVE-2019-20543
An issue was discovered on Samsung mobile devices with P9.0 software. Attackers can bypass Factory Reset Protection FRP via SamsungPay mini. The Samsung ID is SVE-2019-15090 November 2019...
CVE-2019-20543
CVE-2019-20543 involves Samsung mobile devices running Android 9.0 (P) where Factory Reset Protection can be bypassed via SamsungPay mini. The entry is corroborated across multiple sources (NVD, Red Hat, CNVD, CVE List) with the Samsung ID SVE-2019-15090. The connected documents confirm the issue...
The vulnerability of the diagnostic tool for Mobile Device Management applications, which allows attackers to escalate their privileges.
The vulnerability of the diagnostic tool for Mobile Device Management MDM applications that diagnose Windows operating systems involves improper handling of files. Exploiting this vulnerability can allow attackers to enhance their privileges through a specially created application...
Microsoft Windows Mobile Device Management Diagnostics Elevation of Privilege Vulnerability
Microsoft Windows and Microsoft Windows Server are both products of Microsoft Corporation.Microsoft Windows is an operating system for personal devices.Microsoft Windows Server is a server operating system. Mobile Device Management Diagnostics is one of the mobile device management diagnostics...
CVE-2020-0854
Microsoft Windows Mobile Device Management Diagnostics Elevation of Privilege (CVE-2020-0854) is caused by improper handling of junctions in MDM Diagnostics. An attacker who can log on and run a crafted application could bypass access restrictions and delete files. The vulnerability is addressed ...
KB4538461: Windows 10 Version 1809 and Windows Server 2019 March 2020 Security Update
The remote Windows host is missing security update 4538461. It is, therefore, affected by multiple vulnerabilities : - An elevation of privilege vulnerability exists when the Windows Device Setup Manager improperly handles file operations. An attacker who successfully exploited this vulnerability...
Android Trojan xHelper uses persistent re-infection tactics: here’s how to remove
We first stumbled upon the nasty Android Trojan xHelper, a stealthy malware dropper, in May 2019. By mid-summer 2019, xHelper was topping our detection charts—so we wrote an article about it. After the blog, we thought the case was closed on xHelper. Then a tech savvy user reached out to us in...
Phishing Campaign Targets 250 Android Apps with Anubis Malware
A new phishing campaign is attempting to deliver sophisticated malware that can completely hijack an Android mobile device to steal user credentials, install a keylogger and even hold a device’s data for ransom. The attacks are designed for mobile inboxes and leverage the Anubis malware, a...
KLA11651 Multiple vulnerabilities in Apple iTunes
Multiple vulnerabilities were found in Apple iTunes. Malicious users can exploit these vulnerabilities to execute arbitrary code, cause denial of service, perform cross-site scripting attack, bypass security restrictions. Below is a complete list of vulnerabilities: 1. Multiple memory corruption...
Zero Trust Access: Santa Claus Wasn't the Only One Working Christmas Eve
The days from Christmas Eve to New Year's Day are filled with celebrations. Many companies shut down and encourage their employees to take vacations. However, a sample of data comparing an average work week around the holiday, shows the idea of "downtime" isn't exactly accurate. In fact, many use...
A week in security (December 9 – 15)
Last week on Malwarebytes Labs, we cautioned readers against purchasing potentially privacy-invasive, cyber-insecure smart doorbells, warned about a new credit card skimmer vulnerability embedded within hundreds of fraudulent web sites selling supposedly name-brand shoes, and looked at the newest...
The little-known ways mobile device sensors can be exploited by cybercriminals
The bevy of mobile device sensors in modern smartphones and tablets make them more akin to pocket-sized laboratories and media studios than mere communication devices. Cameras, microphones, accelerometers, and gyroscopes give incredible flexibility to app developers and utility to mobile device...
JVN#41566067: Rakuma App vulnerable to authentication information disclosure
Rakuma App provided by Rakuten, Inc. contains an authentication information disclosure vulnerability CWE-200. Impact If a malicious application created by the third party with a purpose to attack a Rakuma user is installed in the Rakuma user's mobile device, it may obtain Rakuma user's...
Beware of Stalking Apps
The Federal Trade Commission FTC has released an article warning consumers of “stalking apps”—spyware that secretly monitors smartphones. These apps can share information like call history, text messages, photos, GPS locations, and browser history without the user's knowledge. Although this can b...
