CVE-2023-47168 Open redirect in /oauth/<service>/mobile_login?redirect_to=

Mattermost fails to properly check a redirect URL parameter allowing for an open redirect was possible when the user clicked "Back to Mattermost" after providing a invalid custom url scheme in /oauth/service/mobilelogin?redirectto=...

CVE-2023-25632

CVE-2023-25632 concerns the Android Mobile Whale browser app, affected versions prior to 3.0.1.2. The vulnerability lets an attacker bypass the browser unlock function through the Open in Whale feature. The issue is described as a local issue with low privileges required and no user interaction, ...

The vulnerability of Firefox’s Reader Mode in the iOS browser allows a hacker to gain unauthorized access to protected information and perform cross-site scripting attacks.

The vulnerability of Firefox’s Reader Mode for iOS relates to the lack of measures taken to eliminate HTML tags. Exploiting this vulnerability can allow a remote attacker to gain unauthorized access to protected information and perform cross-site scripting attacks...

The vulnerability of Firefox’s Reader Mode in the iOS browser allows a user to increase their privileges.

The vulnerability of Firefox’s Reader Mode for iOS relates to shortcomings in access control due to filtering of the referrerpolicy cookie. Exploiting this vulnerability can allow a malicious actor to enhance their privileges remotely...

Mattermost 输入验证错误漏洞

Mattermost is an open source collaboration platform from Mattermost, Inc. in the United States. Mattermost suffers from an open redirect vulnerability that occurs when a user clicks "Back to Mattermost" after providing an invalid custom URL scheme in /oauth/service/mobilelogin?redirectto=, which...

Important: Red Hat Security Advisory: Red Hat Single Sign-On 7.6.6 security update

A security update is now available for Red Hat Single Sign-On 7.6 from the Customer Portal. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each...

Important: Red Hat Security Advisory: Red Hat Single Sign-On 7.6.6 security update on RHEL 9

New Red Hat Single Sign-On 7.6.6 packages are now available for Red Hat Enterprise Linux 9. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each...

CVE-2023-47312

Headwind MDM Web panel 5.22.1 is vulnerable to Incorrect Access Control due to Login Credential Leakage via Audit Entries...

Malwarebytes consumer product roundup: The latest

At Malwarebytes, we’re constantly evolving to protect our customers. These days, our products don’t just protect you from malware, we protect your identity, defend you from ads, safeguard your social media, and keep your mobile safe too. Here are the innovations we’ve made in our products recentl...

CVE-2023-47393

An access control issue in Mercedes me IOS APP v1.34.0 and below allows attackers to view the maintenance orders of other users and access sensitive user information via unspecified vectors...

Headwind MDM Security Vulnerability

Headwind MDM is a platform for managing Android devices in your organization. A security vulnerability exists in Headwind MDM Web panel version 5.22.1, which stems from a credential leak leading to an access control error...

Malicious Apps Disguised as Banks and Government Agencies Targeting Indian Android Users

Android smartphone users in India are the target of a new malware campaign that employs social engineering lures to install fraudulent apps that are capable of harvesting sensitive data. "Using social media platforms like WhatsApp and Telegram, attackers are sending messages designed to lure user...

Social engineering attacks lure Indian users to install Android banking trojans

Microsoft has observed ongoing activity from mobile banking trojan campaigns targeting users in India with social media messages designed to steal users’ information for financial fraud. Using social media platforms like WhatsApp and Telegram, attackers are sending messages designed to lure users...

Social engineering attacks lure Indian users to install Android banking trojans

Microsoft has observed ongoing activity from mobile banking trojan campaigns targeting users in India with social media messages designed to steal users’ information for financial fraud. Using social media platforms like WhatsApp and Telegram, attackers are sending messages designed to lure users...

Alarm system cyberattack leaves those in need struggling to call for help

An alarm system company that allows those in need to ask for help at the touch of a button has suffered a cyberattack, causing serious disruption. Tunstall Netherlands says the attack left the control room struggling to receive distress calls from clients on Sunday November 12, 2023. Tunstall,...

SQL Injection Vulnerability in Mobile Phone Service Management Backend of Zhengzhou Zhengda Information Technology Co.

Zhengzhou Zhengda Information Technology Co., Ltd. is a supply chain-industrial chain digitization and financial service solution provider. Zhengzhou Zhengda Information Technology Co., Ltd. mobile service management backend has a SQL injection vulnerability, which can be exploited by attackers t...

Siemens Mendix Authentication Bypass Vulnerability

Mendix is a high-productivity application platform for building and continuously improving mobile and web applications at scale. An authentication bypass vulnerability exists in Siemens Mendix, which can be exploited by an attacker to access or modify objects without proper authorization or to...

Intel Processors Security Vulnerability

Intel Processors are U.S.-based Intel Corporation's offerings for interpreting computer instructions and processing data in computer software. A security vulnerability exists in Intel Processors, which stems from a processor instruction sequence that can cause unexpected behavior in certain Intel...

VulnCheck KEV: CVE-2022-3980

An XML External Entity XEE vulnerability allows server-side request forgery SSRF and potential code execution in Sophos Mobile managed on-premises between versions 5.0.0 and 9.7.4...

Vulnerabilities fixed in Ivanti Endpoint Manager Mobile

Ivanti has fixed vulnerabilities in Endpoint Manager Mobile formerly MobileIron. A malicious party could exploit the vulnerabilities to request certificates on behalf of another user request certificates, or register a mobile device in someone else's name. This allows the malicious party to gain...