Read Time:4 Second
SOVA v4 features new capabilities and is reportedly targeting more than 200 mobile applications
Daily Archives: August 11, 2022
CVE-2021-22289 (studio)
Read Time:9 Second
Improper Input Validation vulnerability in the project upload mechanism in B&R Automation Studio version >=4.0 may allow an unauthenticated network attacker to execute code.
CVE-2021-0975 (android)
Read Time:16 Second
In USB Manager, there is a possible way to determine whether an app is installed, without query permissions, due to side channel information disclosure. This could lead to local information disclosure of installed packages with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-13Android ID: A-180104273
CVE-2021-0735 (android)
Read Time:16 Second
In PackageManager, there is a possible way to get information about installed packages ignoring limitations introduced in Android 11 due to a missing permission check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-13Android ID: A-188913056
CVE-2021-0734 (android)
Read Time:18 Second
In Settings, there is a possible way to determine whether an app is installed without query permissions, due to side channel information disclosure. This could lead to local information disclosure of an installed package, without proper query permissions, with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-13Android ID: A-189122911
Years after claiming DogWalk wasn’t a vulnerability, Microsoft confirms flaw is being exploited and issues patch
Read Time:12 Second
This week Microsoft finally released a patch for a zero-day security flaw being exploited by hackers, that the company had claimed since 2019 was not actually a vulnerability.
Read more in my article on the Hot for Security blog.
What happened to the Lapsus$ hackers?
Read Time:21 Second
[Editor’s note: This article originally appeared on the CSO Germany website on July 29.]
Claire Tills, senior research engineer at Tenable, describes the methods of the hacking group Lapsus$ as bold, illogical and poorly thought out. The criminals attacked renowned companies such as Microsoft, Samsung, Nvidia, Vodafone, Ubisoft and Okta. They stole data and sometimes used ransomware to extort their victims.
#BHUSA: The Cyber Safety Review Board Outlines Log4j Lessons
Read Time:6 Second
The CSRB concluded that the initial disclosure on Log4j was done right, but there is still much to improve
Hacking Starlink
#BHUSA: Russia’s Wiper Attacks Against Ukraine Detailed
Read Time:5 Second
According to researchers, Russia is rolling out a growing list of wiper attacks against Ukraine