About the security content of Xcode 11.3

About the security content of Xcode 11.3 This document describes the security content of Xcode 11.3. About Apple security updates For our customers' protection, Apple doesn't disclose, discuss, or confirm security issues until an investigation has occurred and patches or releases are available...

Birth Certificate Data Laid Bare on the Web in Multiple States

A third-party government supplier has exposed hundreds of thousands of applications containing birth-certificate data. The trove of information is owned by a company that provides an online platform to state governments – including California, New York and Texas – that allows residents to request...

OMRON CX-Supervisor Vulnerable Third-Party Component Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on affected installations of OMRON CX-Supervisor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within Teamviewer tha...

Nord Security: Connection informaton is sent to a third-party service

Application event data exposed through the reuse of API key The researcher reported that iOS app usage event information sent to the third party service can be intercepted through the reuse of API key. In order to resolve the issue we have disabled GET requests for API keys, removed the third par...

AT&T, Verizon Subscribers Exposed as Mobile Bills Turn Up on the Open Web

Hundreds of thousands of mobile phone bills for AT&T, Verizon and T-Mobile subscribers have been laid open to anyone with an internet connection, thanks to the oversight of a contractor working with Sprint. According to a media investigation, the contractor misconfigured a cloud storage bucket on...

Nebraska Medicine Breached By Rogue Employee

Hospital network Nebraska Medicine has disclosed a data breach after a former employee accessed sensitive patient data – including medical records and Social Security numbers. The Nebraska Medicine network encompasses Nebraska’s largest hospital, Nebraska Medical Center, as well as other location...

Nord Security: Password Reset Link Leaked In Refer Header In Request To Third Party Sites

The reporter has identified that the web application is leaking password reset token in the HTTP referrer header. By obtaining a token, malicious user would be able to reset the passwords for a particular user. It is worth to mention that the attack must be highly personalised and requires prior...

Supply Chain Account Takeover: How Criminals Exploit Third-Party Access

Empower Your Suppliers Against Attack The average business shares data with a complex network of third parties, depending on their operational needs. In a survey of security and risk professionals, Forrester learned that the average business has 4,700 third-party partners with some access to...

Top 5 Cybersecurity and Cybercrime Predictions for 2020

We distilled 30 independent reports dedicated to cybersecurity and cybercrime predictions for 2020 and compiled the top 5 most interesting findings and projections in this post. Compliance fatigue will spread among security professionals Being a source of ongoing controversy and debate, the...

Network security simplified with Amazon VPC Ingress Routing and Trend Micro

Today, Amazon Web Services AWS announced the availability of a powerful new service, Amazon Virtual Private Cloud Amazon VPC Ingress Routing. As a Launch Partner for Amazon VPC Ingress Routing, we at Trend Micro are proud to continue to innovate alongside AWS to provide solutions to...

FreeBSD : py-matrix-synapse -- incomplete cleanup of 3rd-party-IDs on user deactivation (9c36d41c-11df-11ea-9b6d-901b0e934d69)

Matrix developers report : Clean up local threepids from user on account deactivation. C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from the FreeBSD VuXML database : Copyright 2003-2019 Jacques Vidrine and contributors Redistribution and u...

Microsoft OAuth Flaw Opens Azure Accounts to Takeover

A vulnerability in the way Microsoft applications use OAuth for third-party authentication could allow an attacker to take over Azure cloud accounts. OAuth is a protocol that allows app users to share data about their accounts with third-party websites or apps, so that when they sign into the app...

GHSA-6RMQ-X2HV-VXPP Drupal core third-party PEAR Archive_Tar library is vulnerable to Deserialization of Untrusted Data

In Drupal Core versions 7.x prior to 7.62, 8.6.x prior to 8.6.6 and 8.5.x prior to 8.5.9; Drupal core uses the third-party PEAR ArchiveTar library. This library has released a security update which impacts some Drupal configurations. Refer to CVE-2018-1000888 for details...

Node.js third-party modules: [express-laravel-passport] Improper Authentication

I would like to report Improper Authentication in express-laravel-passport It allows to forge user's identity Module module name: express-laravel-passport version: 1.1.2 npm page: https://www.npmjs.com/package/express-laravel-passport Module Description You want a middleware support express get...

Huawei Mate 20 RS Improper Authorization Vulnerability

Huawei Mate 20 RS is a smartphone from Chinese company Huawei Huawei. An improper authorization vulnerability exists in previous versions of Huawei Mate 20 RS 9.1.0.135 C786E133R3P1, which stems from the system's failure to appropriately restrict some of the user's actions in ADB mode. An attacke...

Facebook & Twitter suffer data breach via third-party developers

By Sudais Another day another breach involving Facebook, Twitter, and third-party developers. This is a post from HackRead.com Read the original post: Facebook & Twitter suffer data breach via third-party developers...

Malicious Android SDKs Caught Accessing Facebook and Twitter Users Data

Two third-party software development kits integrated by over hundreds of thousands of Android apps have been caught holding unauthorized access to users' data associated with their connected social media accounts. In a blog post published yesterday, Twitter revealed that an SDK developed by...

CVE-2019-15629

Trend Micro Password Manager versions 3.x, 5.0, and 5.1 for Android is affected by a FLAGMISUSE vulnerability that could be exploited to allow the application to share information to third-party applications on the device...

The vulnerability of the pg_user_mappings component in the PostgreSQL database management system allows a hacker to gain access to the login information of a third-party server.

The vulnerability of the pgusermappings component in the PostgreSQL database management system is related to insufficient protection of registration data. Exploiting this vulnerability can allow a perpetrator with USAGE privileges to remotely access the login credentials of a third-party server...

Google Discloses Android Camera Hijack Hack

Researchers have disclosed a high-severity issue that could allow attackers to hijack the Google Camera App, the built-in smartphone camera for Android phones. The issue was fixed for Google-manufactured phones in July – but Google said patches are still rolling out to smartphones in the broader...