Breaches, breaches everywhere, it must be the season

After last weeks shocker from Marriott this week started off with disclosures about breaches at Quora, Dunkin’ Donuts, and 1-800-Flowers. Quora Quora is an online community that focuses on asking and answering questions. It was founded in 2009 by two former Facebook employees. The stolen data may...

Design/Logic Flaw

Missing verification of a password in ASUSTOR ADM version 3.1.1 allows attackers to change account passwords without entering the current password...

Hackers Breach Dunkin' Donuts Accounts in Credential Stuffing Attack

A credential stuffing attack has allowed hackers to take a big bite out of Dunkin’ Donuts customer data. The donut giant announced Tuesday evening that a data breach in October may have led to customers’ personal information being compromised. Dunkin’ Brands Inc. in an advisory posted to its...

Hacker takeovers Drake’s Fortnite account to yell racial slurs

By Carolina The official Fortnite account of the Canadian rapper Drake going by the handle of "Duddus647" was hacked in an attack on Thanksgiving weekend. The hacker used the account to join Fortnite live stream charity event run by Ninja, a pro streamer and shout racial slurs and obscenities. Th...

Holiday Scams and Malware Campaigns

As the holidays approach, the Cybersecurity and Infrastructure Security Agency CISA reminds users to be aware of seasonal scams and malware campaigns. Users should be cautious of unsolicited emails that contain malicious links or attachments with malware, advertisements infected with malware, and...

How to Check If Your Facebook Account Got Hacked—And How Badly

Facebook Friday offered more details about its recent breach. Here's how to see if you were affected...

SHEIN-Fashion Shopping Site Suffers Data Breach Affecting 6.5 Million Users

U.S. online fashion retailer SHEIN has admitted that the company has suffered a significant data breach after unknown hackers stole personally identifiable information PII of almost 6.5 million customers. Based in North Brunswick and founded in 2008, SHEIN has become one of the largest online...

Chaturbate: Forget password link not expiring after email change.

I found a token miss configuration flaw in chaturbate.com, When we reset password for a user a link is sent to the registered email address but incase it remain unused and email is updated by user from setting panel then too that old token reset link sent at old email address remains valid. A...

How To Check If Your Twitter Account Has Been Hacked

Did you ever wonder if your Twitter account has been hacked and who had managed to gain access and when it happened? Twitter now lets you know this. After Google and Facebook, Twitter now lets you see all the devices—laptop, phone, tablet, and otherwise—logged into your Twitter account. Twitter h...

Improper access control

LG LNB, LND, LNU, and LNV smart network camera devices have broken access control. Attackers are able to download /updownload/t.report aka Log & Report files and download backup files via download.php without authenticating. These backup files contain user credentials and configuration informatio...

BOHEMIA INTERACTIVE a.s.: Weak Password Policy on Signup at https://accounts.bistudio.com/auth

Hi, I found that you are using a weak password policy! Because user can set his password same as Email address! Steps To reproduce: 1. Register an account with Email address "[email protected]" 2. Also password "[email protected]". You can see both values are same. You will become successfully register...

CVE-2018-15478

An issue was discovered in myStrom WiFi Switch V1 before 2.66, WiFi Switch V2 before 3.80, WiFi Switch EU before 3.80, WiFi Bulb before 2.58, WiFi LED Strip before 3.80, WiFi Button before 2.73, and WiFi Button Plus before 2.73. The process of registering a device with a cloud account was based o...

Instagram’s New Security Tools are a Welcome Step, But Not Enough

Instagram users should soon have more secure options for protecting their accounts against Internet bad guys. On Tuesday, the Facebook-owned social network said it is in the process of rolling out support for third-party authentication apps. Unfortunately, this welcome new security offering does...

T-Mobile Alerts 2.3 Million Customers of Data Breach Tied to Leaky API

Wireless carrier T-Mobile notified its 2.3 million subscribers via text message earlier this week that their personal account information may have been exposed. The warnings accompanied a customer advisory posted to the T-Mobile website alerting all its 77 million customers of the breach. Affecte...

Widespread Instagram Hack Locking Users Out of Their Accounts

Instagram has been hit by a widespread hacking campaign that appears to stem from Russia and have affected hundreds of users over the past week, leaving them locked out of their accounts. A growing number of Instagram users are taking to social media, including Twitter and Reddit, to report a...

Logical Design Vulnerabilities in Jiangsu Jinzhi Education Unified Identity Authentication System

Jiangsu Jinzhi Education Information Co., Ltd. is a well-known provider of informatization services for colleges and universities in China. There is a logical design vulnerability in the Jiangsu Jinzhi Education Unified Identity Authentication System, which can be exploited by an attacker to rese...

Google: Security Keys Neutralized Employee Phishing

Google has not had any of its 85,000+ employees successfully phished on their work-related accounts since early 2017, when it began requiring all employees to use physical Security Keys in place of passwords and one-time codes, the company told KrebsOnSecurity. A YubiKey Security Key made by...

CVE-2011-3172 unix2_chkpwd do not check for a valid account

A vulnerability in pammodules of SUSE Linux Enterprise allows attackers to log into accounts that should have been disabled. Affected releases are SUSE Linux Enterprise: versions prior to 12...

CyberArk 10 - Memory Disclosure

CyberArk 10 - Memory Disclosure Exploit Title: CyberArk 10 - Memory Disclosure Date: 2018-06-04 Exploit Author: Thomas Zuk Vendor Homepage: https://www.cyberark.com/products/privileged-account-security-solution/enterprise-password-vault/ Version: 9.7 and 10 Tested on: Windows 2008, Windows 2012,...

Liberapay: Same CSRF token is being used for deleting other platform login’s within an account and across other liberapay Account’s

We’ve got “Accounts Elsewhere” option in the profile section. where we can connect our liberapay account with multiple other platform accounts. While deleting those Multiple other platform accounts same CSRF token is being used. I’ve signed up with a couple of liberapay accounts. Where I found th...