Adware and PUPs families add push notifications as an attack vector

Some existing families of potentially unwanted programs and adware have added browser push notifications to their weapons arsenal. Offering themselves up as browser extensions on Chrome and Firefox, these threats pose as useful plugins then haggle users with notifications. A family of search...

CVE-2019-5954

JR East Japan train operation information push notification App for Android version 1.2.4 and earlier allows remote attackers to bypass access restriction to obtain or alter the user's registered information via unspecified vectors...

Servicing stack update for Windows 10, Version 1803: May 14, 2019

None None...

Servicing stack update for Windows 10, Version 1903: May 14, 2019

None None...

Siemens CPU-1511C-1 PN PLC Detection

Binary data 750168.prm...

UBUNTU-CVE-2019-11460

An issue was discovered in GNOME gnome-desktop 3.26, 3.28, and 3.30 prior to 3.30.2.2, and 3.32 prior to 3.32.1.1. A compromised thumbnailer may escape the bubblewrap sandbox used to confine thumbnailers by using the TIOCSTI ioctl to push characters into the input buffer of the thumbnailer's...

dovecot -- json encoder crash

Aki Tuomi reports: CVE-2019-10691: Trying to login with 8bit username containing invalid UTF8 input causes auth process to crash if auth policy is enabled. This could be used rather easily to cause a DoS. Similar crash also happens during mail delivery when using invalid UTF8 in From or Subject...

GitLab: Bypassing push rules via MRs created by Email

Hi GitLab Security Team, GitLab EE has the feature of so-called push rules. An administrator, or more fine-grained per project, the owner can create certain push rules. The goal of these push rules is avoiding to push certain commits to the repository, which violate one of the push rules. If a...

East Japan Railway JR East Japan train operation information push notification App for Android Access Control Error Vulnerability

East Japan Railway JR East Japan train operation information push notification App for Android is an Android-based train operation information push notification app from East Japan Railway. Push Notification App for Android is an Android-based train operation information push notification app for...

Servicing stack update for Windows 10 Version 1809: April 2, 2019

None None...

API server used by JR East Japan train operation information push notification App for Android fails to restrict access permissions

Overview JR East Japan train operation information push notification App for Android provided by East Japan Railway Company fails to restrict access permissions CWE-284. The application is no longer available/supported, and its service was ended in 2019 march 23. Tomoya Takahashi of TCU...

The vulnerability of the SAP Fiori Client’s mobile execution environment, related to insufficient validation of input data, allows a perpetrator to trigger a service failure.

The vulnerability of the SAP Fiori Client mobile environment is related to insufficient validation of input data. Exploiting this vulnerability can allow a malicious actor to cause service failures by sending empty push notifications remotely...

CloudBees Jenkins Cloud Foundry Plugin Information Disclosure Vulnerability

CloudBees Jenkins Hudson Labs is the United States CloudBees company's set of Java-based development of continuous integration tools. The product is mainly used to monitor the continuous software version of the release/testing project and some of the timed execution of the task . Cloud Foundry...

Microsoft Exchange Server Elevation of Privilege Vulnerability

An elevation of privilege vulnerability exists in Microsoft Exchange Server. An attacker who successfully exploited this vulnerability could gain the same rights as any other user of the Exchange server. This could allow the attacker to perform activities such as accessing the mailboxes of other...

Security Updates for Exchange (February 2019)

The Microsoft Exchange Server installed on the remote host is missing security updates. It is, therefore, affected by multiple vulnerabilities : - Multiple Vulnerabilites with the included libraries from Oracle Outside. CVE-2018-18223, CVE-2018-18224, CVE-2018-3147, CVE-2018-3217, CVE-2018-3218,...

A week in security (January 21 – 27)

Last week on the Malwarebytes Labs blog, we took a look at Modlishka, the latest hurdle in two-factor authentication 2FA, the potential for abuse of push notifications, a malware-phishing combo by the name of CryTekk ransomware, and why we detect PUPs, but enforce the power of users' choice. We...

Browser push notifications: a feature asking to be abused

“I’m seeing a lot of ads popping up in the corner of my screen, and the Malwarebytes scan does not show there is anything wrong. It says my computer is clean. So what's happening?” Our support team runs into questions like this regularly, but the volume seems to be increasing lately. In most of...

Fedora 28 : singularity (2018-da87b1e643)

This rebases singularity from 2.2.1 to 2.5.1, which should include all corresponding updates n.b. a request for rebase permission has been put into FESCo; hence auto-push has been disabled until they approve. Please test for functionality and backward compatibility issues, particularly around the...

CVE-2018-20579

Contiki-NG before 4.2 has a stack-based buffer overflow in the push function in os/lib/json/jsonparse.c that allows an out-of-bounds write of an '' or '' character...

Mail.ru: Cross application scripting via account.mail.ru

Crossapplication scripting via User-Agent on push login confirmation functionality in mobile application in the context of account.mail.ru domain allowed session hijacking with minimal user interaction...