EUVD-2019-18860

Malware in sbrugna...

A week in security (August 25 – August 31)

Last week on Malwarebytes Labs: Microsoft wants to automatically save your Word docs to the cloud "No place in our networks": FCC hangs up on thousands of voice operators in robocall war Claude AI chatbot abused to launch "cybercrime spree" Developer verification: a promised lift for Android...

What Is Cloud Data Protection?

A Deep Dive into the Cosmic Universe of Information Safeguarding: An Exhaustive Examination of Distributed Data Security As the virtual dominions continue to propagate at a phenomenal pace, the totality of data we generate daily scales new zeniths. We see ourselves increasingly relying on 'online...

COVID-19 Results for 25% of Wyoming Accidentally Posted Online

The Wyoming Department of Health WDH said on Wednesday it accidentally posted COVID test results of state residents onto their public-facing storage buckets. The WDH said in a public advisory that an employee fumbled the health information of about 164,021 Wyoming residents and of people from oth...

CVE-2019-9486

STRATO HiDrive Desktop Client 5.0.1.0 for Windows suffers from a SYSTEM privilege escalation vulnerability through the HiDriveMaintenanceService service. This service establishes a NetNamedPipe endpoint that allows applications to connect and call publicly exposed methods. An attacker can inject...

CVE-2019-9486

STRATO HiDrive Desktop Client 5.0.1.0 for Windows suffers from a SYSTEM privilege escalation vulnerability through the HiDriveMaintenanceService service. This service establishes a NetNamedPipe endpoint that allows applications to connect and call publicly exposed methods. An attacker can inject...

Privilege escalation

STRATO HiDrive Desktop Client 5.0.1.0 for Windows suffers from a SYSTEM privilege escalation vulnerability through the HiDriveMaintenanceService service. This service establishes a NetNamedPipe endpoint that allows applications to connect and call publicly exposed methods. An attacker can inject...

CVE-2019-9486

STRATO HiDrive Desktop Client 5.0.1.0 for Windows suffers from a SYSTEM privilege escalation vulnerability through the HiDriveMaintenanceService service. This service establishes a NetNamedPipe endpoint that allows applications to connect and call publicly exposed methods. An attacker can inject...

CVE-2019-9486

STRATO HiDrive Desktop Client 5.0.1.0 for Windows is affected by a SYSTEM privilege-escalation vulnerability via the HiDriveMaintenanceService, which exposes a NetNamedPipe endpoint and allows code injection through insecure interprocess communication. The issue also affects Telekom MagentaCLOUD ...

PT-2019-19679

Name of the Vulnerable Software and Affected Versions STRATO HiDrive Desktop Client versions 5.0.1.0 Telekom MagentaCLOUD versions through 5.7.0.0 1&1 Online Storage versions through 6.1.0.0 Description The issue concerns a SYSTEM privilege escalation through the HiDriveMaintenanceService service...

CVE-2019-9486: Time-of-check Time-of-use (TOCTOU) Race Condition

STRATO HiDrive Desktop Client 5.0.1.0 for Windows suffers from a SYSTEM privilege escalation vulnerability through the HiDriveMaintenanceService service. This service establishes a NetNamedPipe endpoint that allows applications to connect and call publicly exposed methods. An attacker can inject...

1&1 Online Storage - Exported ContentProvider, External URLs, SD-card access vulnerabilities

HackApp vulnerability scanner discovered that application 1&1 Online Storage published at the 'play' market has multiple vulnerabilities...

[SECURITY] Fedora 21 Update: s3ql-2.13-1.fc21

S3QL is a file system that stores all its data online using storage services like Google Storage, Amazon S3 or OpenStack. S3QL effectively provides a ha rd disk of dynamic, infinite capacity that can be accessed from any computer with Internet access. S3QL is a standard conforming, full featured...

[SECURITY] Fedora 22 Update: s3ql-2.13-1.fc22

S3QL is a file system that stores all its data online using storage services like Google Storage, Amazon S3 or OpenStack. S3QL effectively provides a ha rd disk of dynamic, infinite capacity that can be accessed from any computer with Internet access. S3QL is a standard conforming, full featured...

CVE-2014-5884

The 1&1 Online Storage aka de.einsundeins.smartdrive application 5.0.11 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

Information disclosure

The 1&1 Online Storage aka de.einsundeins.smartdrive application 5.0.11 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

CVE-2014-5884

The 1&1 Online Storage aka de.einsundeins.smartdrive application 5.0.11 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

CVE-2014-5884

The CVE-2014-5884 entry concerns the 1&1 Online Storage (aka de.einsundeins.smartdrive) Android app version 5.0.11, which fails to verify X.509 certificates when connecting to SSL servers. This enables man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted cer...

CVE-2014-5884: Undefined Security Weakness

The 1&1 Online Storage aka de.einsundeins.smartdrive application 5.0.11 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

PT-2014-6869

Name of the Vulnerable Software and Affected Versions 1&1 Online Storage aka de.einsundeins.smartdrive version 5.0.11 Description The issue allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate, as the application does not verify X.509...