Design/Logic Flaw

In onCreate of UninstallerActivity, there is a possible way to uninstall an all without informed user consent due to a tapjacking/overlay attack. This could lead to local escalation of privilege with User execution privileges needed. User interaction is needed for exploitation.Product:...

CVE-2021-0314

In onCreate of UninstallerActivity, there is a possible way to uninstall an all without informed user consent due to a tapjacking/overlay attack. This could lead to local escalation of privilege with User execution privileges needed. User interaction is needed for exploitation.Product:...

WhatsApp Will Disable Your Account If You Don't Agree Sharing Data With Facebook

"Respect for your privacy is coded into our DNA," opens WhatsApp's privacy policy. "Since we started WhatsApp, we've aspired to build our Services with a set of strong privacy principles in mind." But come February 8, 2021, this opening statement will no longer find a place in the policy. The...

Microsoft Office 2007/2010 Download and Execute Vulnerability

This vulnerability allows to download and execute a file note: the vulnerability is triggered only when Includes macros or user consents to the inclusion...

You Are Here: Giving Your Users the Local Experience They Deserve

Locality matters for most things in life: weather, health care, shopping, product reviews, dinner reservations, social networking, data privacy, news, sports ... the list goes on and on in our ever more connected lives. From direct user interaction on your flagship website or app to IoT device da...

CVE-2020-0382

In RunInternal of dumpstate.cpp, there is a possible user consent bypass due to an uncaught exception. This could lead to local information disclosure of bug report data with System execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-11...

CVE-2020-0382

In RunInternal of dumpstate.cpp, there is a possible user consent bypass due to an uncaught exception. This could lead to local information disclosure of bug report data with System execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-11...

CVE-2020-0382

CVE-2020-0382 affects Android 10/11. In RunInternal of dumpstate.cpp, an uncaught exception enables a possible user-consent bypass, allowing local disclosure of bug report data with System privileges. No user interaction is required for exploitation, and the impact is limited to information discl...

CVE-2020-13300

GitLab CE/EE version 13.3 prior to 13.3.4 was vulnerable to an OAuth authorization scope change without user consent in the middle of the authorization flow...

DEBIAN-CVE-2020-11986

To be able to analyze gradle projects, the build scripts need to be executed. Apache NetBeans follows this pattern. This causes the code of the build script to be invoked at load time of the project. Apache NetBeans up to and including 12.0 did not request consent from the user for the analysis o...

CVE-2020-11986

To be able to analyze gradle projects, the build scripts need to be executed. Apache NetBeans follows this pattern. This causes the code of the build script to be invoked at load time of the project. Apache NetBeans up to and including 12.0 did not request consent from the user for the analysis o...

Code injection

To be able to analyze gradle projects, the build scripts need to be executed. Apache NetBeans follows this pattern. This causes the code of the build script to be invoked at load time of the project. Apache NetBeans up to and including 12.0 did not request consent from the user for the analysis o...

CVE-2020-11986

To be able to analyze gradle projects, the build scripts need to be executed. Apache NetBeans follows this pattern. This causes the code of the build script to be invoked at load time of the project. Apache NetBeans up to and including 12.0 did not request consent from the user for the analysis o...

CVE-2020-11986

The CVE-2020-11986 issue affects Apache NetBeans up to 12.0. Opening a Gradle project causes the build script to run at load time, potentially enabling remote attackers to execute code without user consent. The Arch Linux advisory confirms a remote arbitrary code execution vulnerability and direc...

CVE-2020-11986

To be able to analyze gradle projects, the build scripts need to be executed. Apache NetBeans follows this pattern. This causes the code of the build script to be invoked at load time of the project. Apache NetBeans up to and including 12.0 did not request consent from the user for the analysis o...

ASB-A-152944488

In RunInternal of dumpstate.cpp, there is a possible user consent bypass due to an uncaught exception. This could lead to local information disclosure of bug report data with System execution privileges needed. User interaction is not needed for exploitation...

Cisco, Zoom and Others Must Bolster Security, Say Privacy Chiefs

Global privacy commissioners issued a joint public decry against leading video conferencing companies such as Cisco Systems, Microsoft and Zoom to demand the companies beef up their security and privacy strategies. The critique was delivered via an open letter published by data protection and...

Skype for Business via Internet Explorer Information Disclosure Vulnerability

An information disclosure vulnerability exists when Skype for Business is accessed via Internet Explorer. An attacker who exploited the vulnerability could cause the user to place a call without additional consent, leading to information disclosure of the user profile. For the vulnerability to be...

Apple, Google Team on Coronavirus Tracking – Sparking Privacy Fears

Apple and Google are teaming up to launch technology that traces the spread of the coronavirus, via apps for iOS and Android users. Despite the companies’ insistence that privacy will be “of utmost importance,” some in the security space remain wary of data privacy concerns around the newly...

CVE-2018-21081

An issue was discovered on Samsung mobile devices with N7.x software. In Dual Messenger, the second app can use the runtime permissions of the first app without a user's consent. The Samsung ID is SVE-2017-11018 March 2018...