Enable secure remote work, address regulations and uncover new risks with Microsoft Compliance

As we talk with a broad range of customers in the current environment, we hear some consistent challenges businesses are facing. With so many remote workers, people are creating, sharing, and storing data in new ways, which fosters productivity, but can also introduce new risks. A recent Microsof...

CVE-2020-5629

UNIQLO App for Android versions 7.3.3 and earlier allows remote attackers to lead a user to access an arbitrary website via a malicious App created by the third party. As a result, if the access destination is a malicious website, the user may fall victim to the social engineering attack...

TikTok: Cross-Site-Scripting on www.tiktok.com and m.tiktok.com leading to Data Exfiltration

The researcher discovered a URL parameter reflecting its value without being properly sanitized and was able to achieve reflected XSS. In addition, researcher found an endpoint which was vulnerable to CSRF. The endpoint allowed to set a new password on accounts which had used third-party apps to...

Facebook's FTC-Mandated Privacy Committee Now in Effect

Facebook on Thursday said it has started to report its privacy practices to a newly formed, independent Privacy Committee. The creation of the independent committee was part of the company’s settlement a year ago with the Federal Trade Commission FTC over data privacy violations, which came in...

CVE-2019-19412

Huawei smart phones have a Factory Reset Protection FRP bypass security vulnerability. When re-configuring the mobile phone using the factory reset protection FRP function, an attacker login the Talkback mode and can perform some operations to install a third-Party application. Affected products...

Critical 'Sign in with Apple' Bug Could Have Let Attackers Hijack Anyone's Account

Apple recently paid Indian vulnerability researcher Bhavuk Jain a huge $100,000 bug bounty for reporting a highly critical vulnerability affecting its 'Sign in with Apple ' system. The now-patched vulnerability could have allowed remote attackers to bypass authentication and take over targeted...

May 5, 2020, update for Microsoft Office 2016 (KB4484327)

None None...

Fake reviews & third-party apps cause 50% of threats against Android

By Sudais Asif Android has a malware problem but it can be solved however fake revies and third-party stores are keeping this threat alive. This is a post from HackRead.com Read the original post: Fake reviews & third-party apps cause 50% of threats against Android...

How to Manage Your Privacy On and Off Facebook

Social media has come a long way in a short space of time. In a little over a decade, it’s grown from being the preserve of a relatively small group of online enthusiasts to one of the defining trends of 21st century life. As the undisputed global leader in this field, Facebook now boasts nearly...

CVE-2019-15629

Trend Micro Password Manager versions 3.x, 5.0, and 5.1 for Android is affected by a FLAGMISUSE vulnerability that could be exploited to allow the application to share information to third-party applications on the device...

Xiaomi Cepheus Access Control Error Vulnerability

Xiaomi Cepheus is a smartphone from Chinese company Xiaomi Technology Xiaomi. The Xiaomi Cepheus build fingerprint: Xiaomi/cepheus/cepheus:9/PKQ1.181121.001/V10.2.6.0.PFAMIXM:user/release-keys in the com.qualcomm.qti. An access control error vulnerability exists in the callenhancement app. An...

CVE-2019-15349

The Tecno Camon Android device with a build fingerprint of TECNO/H612/TECNO-ID5a:8.1.0/O11019/F-180828V106:user/release-keys contains a pre-installed platform app with a package name of com.lovelyfont.defcontainer versionCode=7, versionName=7.0.11. This app contains an exported service named...

New Way Found to Use Alexa, Google to 'Voice Phish' and Eavesdrop on Users

Researchers have found new ways that bad actors can exploit Alexa and Google Home smart speakers to spy on users. This time the hack not only includes eavesdropping, but also includes voice-phishing, or using people’s voice cues to determine passwords. The vulnerability lies in small apps created...

Facebook Now Pays Hackers for Reporting Security Bugs in 3rd-Party Apps

Following a series of security mishaps and data abuse through its social media platform, Facebook today expanding its bug bounty program in a very unique way to beef up the security of third-party apps and websites that integrate with its platform. Last year, Facebook launched "Data Abuse Bounty"...

Facebook Now Pays Hackers for Reporting Security Bugs in 3rd-Party Apps

Following a series of security mishaps and data abuse through its social media platform, Facebook today expanding its bug bounty program in a very unique way to beef up the security of third-party apps and websites that integrate with its platform. Last year, Facebook launched "Data Abuse Bounty"...

Device Hopping Shoppers Drive Up Bounce Rates Leading Into Holiday 2019

Executive Summary In 2018, Akamai reported for the first time that shoppers used mobile devices more than desktops for all the major peak traffic events we measured. Interestingly, they often don't complete their purchase on a mobile device. If the most recently concluded back-to-school shopping...

Use This Privacy Tool to View and Clear Your 'Off-Facebook Activity' Data

Well, here we have great news for Facebook users, which is otherwise terrible for marketers and publishers whose businesses rely on Facebook advertisement for re-targeted conversations. Following the Cambridge Analytica scandal, Facebook has taken several privacy measures in the past one year wit...

Integrating Threat and Vulnerability Management with Patch Management: The (Feasible) Quantum Leap

The rise of sophisticated attacks combined with the security-skills shortage have driven many organizations to go back to basics and review their processes for vulnerability and patch management. The approach is definitely a winning one, given that shrinking and managing the vulnerability surface...

Third-Party Apps Exposed Over 540 Million Facebook Records

A cybersecurity firm found that two different third-party Facebook apps left millions of records about users sitting unprotected on Amazon’s servers...

CVE-2018-14979

The CVE-2018-14979 entry concerns ASUS ZenFone 3 Max (ASUS_X008_1) with pre-installed com.asus.loguploader. The issue is an exported service, LogUploaderService, accessible via a specific action, that can write a bugreport (kernel log, logcat, system service states including active notifications)...