PayPal: Unsafe deserialization leads to token leakage in PayPal & PayPal for Business [Android]

A Bug Bounty researcher identified an issue where a JSON wrapper could be used to instantiate arbitrary Java objects. This could lead to circumstances where a class called in the PayPal Android app could be read by a malicious app on the same mobile device. A specific user’s session data could...

Malicious MDM: Let's Hide This App

This blog post is authored by Warren Mercer and Paul Rascagneres with contributions from Nick Biasini Summary Since our initial discovery of a malicious mobile device management MDM platform that was loading fake applications onto smartphones, we have gained greater insight into the attacker's...

Anghami - Persistent Input Validation Vulnerability

Document Title: =============== Anghami - Persistent Input Validation Vulnerability References: =========== https://www.vulnerability-lab.com/getcontent.php?id=2144 View Video: https://www.youtube.com/watch?v=7CnXLxs6CXo Release Date: ============= 2018-08-26 Vulnerability Laboratory ID VL-ID:...

Beers with Talos EP 34: Click Here to Assign New Mobile Device Owner

Beers with Talos BWT Podcast Ep. 34 is now available. Download this episode and subscribe to Beers with Talos: If iTunes and Google Play aren't your thing: www.talosintelligence.com/podcast. Ep. 34 show notes: Recorded July 20, 2018 — This week, we touch on several topics, but we spend the lion’s...

iPhone Hacking Campaign Using MDM Software Is Broader Than Previously Known

India-linked highly targeted mobile malware campaign, first unveiled two weeks ago, has been found to be part of a broader campaign targeting multiple platforms, including windows devices and possibly Android as well. As reported in our previous article, earlier this month researchers at Talos...

Bluetooth “BlueBorne” Vulnerabilities - NL

Lenovo Security Advisory: LEN-17125 Potential Impact: Remote code execution Severity: High Scope of Impact: Industry wide CVE Identifier: CVE-2017-0781, CVE-2017-0782, CVE-2017-0783, CVE-2017-0785, CVE-2017-8628, CVE-2017-14315, CVE-2017-1000250, CVE-2017-1000251 Summary Description: A collection...

Hackers Used Malicious MDM Solution to Spy On 'Highly Targeted' iPhone Users

Security researchers have uncovered a "highly targeted" mobile malware campaign that has been operating since August 2015 and found spying on 13 selected iPhones in India. The attackers, who are also believed to be operating from India, were found abusing mobile device management MDM protocol—a...

Summer Vacation Plans? Be Safe When Connecting!

Tips to Protect Yourself While Traveling Summer travel should be a respite from work, when you relax and don’t have to worry about business. And your mobile devices can help make it easier, whether it’s booking a flight or a hotel room, ordering a cab or an Uber driver, browsing websites for your...

June 21, 2018—KB4284822 (OS Build 16299.522)

None None...

com.getdropbox.Dropbox app for iOS authentication bypass vulnerability

com.getdropbox.Dropbox app for iOS is an online collaboration app for managing documents based on the iOS platform. A security vulnerability exists in com.getdropbox.Dropbox app for iOS based platforms that stems from the program failing to use the kSecAccessControlUserPresence protection...

Error: "Http/1.1 Internal Server Error 43531" When Enrolling Device to XenMobile

MAM enrollment is failing with below errors: 1. While authenticating from the Gateway Web Page -"Http/1.1 Internal Server Error 43531" 2. While attempting from the mobile device - "Enrollment Failed - There's a prblem with the server setup. Please contact your administrator"...

Now that you have a plan, it’s time to start deploying

This blog is part of a series that responds to common questions we receive from customers about deployment of Microsoft 365 security solutions. In this series, youll find context, answers, and guidance for deployment and driving adoption within your organization. Check out our last blog First...

First things first: Envisioning your security deployment

This blog post is part of a series that responds to common questions we receive from customers about deployment of Microsoft 365 Security solutions. In this series youll find context, answers, and guidance for deployment and driving adoption within your organization. Check out our last blog...

Google Android Security Bypass Vulnerability

Android is a Linux-based open source operating system jointly developed by Google and the Open Handheld Alliance OHA. A security vulnerability exists in the Device Administrator code in versions prior to Android 4.4.1r1, which stems from the program's failure to update the mAdminMap data structur...

CVE-2018-4844

A vulnerability has been identified in SIMATIC WinCC OA UI for Android All versions V3.15.10, SIMATIC WinCC OA UI for iOS All versions V3.15.10. Insufficient limitation of CONTROL script capabilities could allow read and write access from one HMI project cache folder to other HMI project cache...

Design/Logic Flaw

A vulnerability has been identified in SIMATIC WinCC OA UI for Android All versions V3.15.10, SIMATIC WinCC OA UI for iOS All versions V3.15.10. Insufficient limitation of CONTROL script capabilities could allow read and write access from one HMI project cache folder to other HMI project cache...

CVE-2018-4844

A vulnerability has been identified in SIMATIC WinCC OA UI for Android All versions V3.15.10, SIMATIC WinCC OA UI for iOS All versions V3.15.10. Insufficient limitation of CONTROL script capabilities could allow read and write access from one HMI project cache folder to other HMI project cache...

Huawei Honor V9 Play Forensic Bypass Vulnerability

Huawei Honor V9 Play is a smartphone from Chinese company Huawei Huawei. A component in the Huawei Honor V9 Play phone suffers from a forensic bypass vulnerability, where an attacker can bypass the necessary forensic process and delete the phone's fingerprints through specific actions...

BYOD, why don’t you?

Bring Your Own Device BYOD is a policy that allows employees to bring their own devices to the workplace and use them there. At one time, this was the latest bonus to attract and keep employees happy—plus save a few bucks. Nowadays the question is more like: Is there anyone who doesn't bring his...

Chongqing Cable Networks Come to the Point app suffers from overstepping access vulnerability

Lai Dot app is an exclusive service for Chongqing Cable broadband subscribers to watch videos, just download and install the client on smart mobile terminals such as cell phones and flat-panel computers and then access Chongqing Cable WIFI network to enjoy the viewing experience. Chongqing Cable ...