CVE-2021-24038

CVE-2021-24038 affects Oculus Desktop where a bug in the management of handles in OVRServiceLauncher.exe can expose a privileged process handle to an unprivileged process, enabling local privilege escalation . Impact is described for Oculus Desktop versions after 1.39 and before 31.1.0.67.507. Th...

PT-2021-15660

Name of the Vulnerable Software and Affected Versions: Oculus Desktop versions after 1.39 and prior to 31.1.0.67.507 Description: The issue is caused by a bug in the management of handles in OVRServiceLauncher.exe, allowing an attacker to expose a privileged process handle to an unprivileged...

CVE-2021-24038: Improper Privilege Management

Due to a bug with management of handles in OVRServiceLauncher.exe, an attacker could expose a privileged process handle to an unprivileged process, leading to local privilege escalation. This issue affects Oculus Desktop versions after 1.39 and prior to 31.1.0.67.507...

Is it game over for VR advergaming?

We’ve been warning about advergaming—the combination of virtual reality VR and ads—for years on the Labs Blog. I’ve given a few talks on the subject too, and how ad networks will slowly work their way into enclosed spaces formerly reserved for your head. They still might, but thanks to a recent...

Facebook Oculus Desktop Elevation of Privilege Vulnerability

Facebook Oculus Desktop is a virtual desktop application from the American company Facebook that supports the operation of computers in VR. A security vulnerability exists in previous versions of Facebook Oculus Desktop 1.44.0.32849 for Windows-based platforms. The vulnerability can be exploited ...

CVE-2020-1885

Writing to an unprivileged file from a privileged OVRRedir.exe process in Oculus Desktop before 1.44.0.32849 on Windows allows local users to write to arbitrary files and consequently gain privileges via vectors involving a hard link to a log file...

CVE-2020-1885

Writing to an unprivileged file from a privileged OVRRedir.exe process in Oculus Desktop before 1.44.0.32849 on Windows allows local users to write to arbitrary files and consequently gain privileges via vectors involving a hard link to a log file...

Hardcoded credentials

Writing to an unprivileged file from a privileged OVRRedir.exe process in Oculus Desktop before 1.44.0.32849 on Windows allows local users to write to arbitrary files and consequently gain privileges via vectors involving a hard link to a log file...

CVE-2020-1885

Writing to an unprivileged file from a privileged OVRRedir.exe process in Oculus Desktop before 1.44.0.32849 on Windows allows local users to write to arbitrary files and consequently gain privileges via vectors involving a hard link to a log file...

CVE-2020-1885

CVE-2020-1885 affects Oculus Desktop on Windows prior to 1.44.0.32849. A privileged OVRRedir.exe process can write to an unprivileged destination via a hard link to a log file, enabling local privilege escalation to arbitrary files. The issue is described as local privilege elevation stemming fro...

PT-2020-15141

Name of the Vulnerable Software and Affected Versions Oculus Desktop versions prior to 1.44.0.32849 Description The issue allows local users to write to arbitrary files and gain privileges through vectors involving a hard link to a log file, by exploiting the ability of the OVRRedir.exe process t...

CVE-2020-1885: Improper Link Resolution Before File Access

Writing to an unprivileged file from a privileged OVRRedir.exe process in Oculus Desktop before 1.44.0.32849 on Windows allows local users to write to arbitrary files and consequently gain privileges via vectors involving a hard link to a log file...

Code injection

A remote web page could inject arbitrary HTML code into the Oculus Browser UI, allowing an attacker to spoof UI and potentially execute code. This affects the Oculus Browser starting from version 5.2.7 until 5.7.11...

CVE-2019-3562

A remote web page could inject arbitrary HTML code into the Oculus Browser UI, allowing an attacker to spoof UI and potentially execute code. This affects the Oculus Browser starting from version 5.2.7 until 5.7.11...

CVE-2019-3562

A remote web page could inject arbitrary HTML code into the Oculus Browser UI, allowing an attacker to spoof UI and potentially execute code. This affects the Oculus Browser starting from version 5.2.7 until 5.7.11...

PT-2019-16611

Name of the Vulnerable Software and Affected Versions Oculus Browser versions 5.2.7 through 5.7.11 Description A remote web page could inject arbitrary HTML code into the Oculus Browser UI, allowing an attacker to spoof UI and potentially execute code. Recommendations For Oculus Browser versions...

CVE-2019-3562: Improper Neutralization of Special Elements in Output Used by a Downstream Component

A remote web page could inject arbitrary HTML code into the Oculus Browser UI, allowing an attacker to spoof UI and potentially execute code. This affects the Oculus Browser starting from version 5.2.7 until 5.7.11...

VR social app Bigscreen presence of security vulnerabilities, hackers executable MITR attack-vulnerability warning-the black bar safety net

Connecticut West Haven University security team found the VR social platform Bigscreen there is a serious security vulnerability. The vulnerability allows the attacker without the player permission to enter their virtual reality space, thereby enhancing system is embedded in a malicious program b...

Bug Bounty: Earn $40,000 for hacking Facebook, Instagram or WhatsApp

By Waqas Facebook has launched a new bug bounty program inviting hackers to identify and report vulnerabilities in its website and applications. The social network has increased payouts and offers researchers to look for vulnerabilities in a wide variety of products owned by Facebook including...

Get paid up to $40,000 for finding ways to hack Facebook or Instagram accounts

Here we have great news for all bug bounty hunters. Now you can get paid up to $40,000 for finding and responsibly reporting critical vulnerabilities in the websites and mobile applications owned by Facebook that could allow cyber attackers to take over user accounts. In the latest post published...