TDECU Data Breach: 500,000+ Members Affected by MOVEit Exploit

TDECU reports a data breach affecting over 500,000 members due to a MOVEit vulnerability. Compromised data includes Social…...

ZOHO ManageEngine ADAudit Plus SQL Injection Vulnerability (CNVD-2024-37483)

ZOHO ManageEngine ADAudit Plus is ZOHO's solution for simplifying audits, proving compliance and detecting threats. ZOHO ManageEngine ADAudit Plus prior to version 8000 suffers from a SQL injection vulnerability that can be exploited by an attacker to execute custom queries and access database...

Unpacking Slack Hacks: 6 Ways to Protect Sensitive Data with Secure Collaboration

Nowadays, sensitive and critical data is traveling in everyday business channels that offer only the basic level of security and encryption, and companies are often oblivious to the risk. A case in point: Disney suffered a devastating data leak by a hacktivist group known as NullBulge that got ho...

A week in security (August 19 – August 25)

Last week on Malwarebytes Labs: Millennials’ sense of privacy uniquely tested in romantic relationships Hacked GPS tracker reveals location data of customers "We will hold them accountable": General Motors sued for selling customer driving data to third parties Why you need to know about ransomwa...

CentralSquare CryWolf 安全漏洞

CentralSquare CryWolf is a misinformation management system from CentralSquare, Inc. A security vulnerability exists in CentralSquare CryWolf that stems from GeneralDocs.aspx containing a path traversal vulnerability...

Chisel 安全漏洞

Chisel is a fast TCP/UDP tunnel for Jaime Pillora Personal Developer. A security vulnerability exists in Chisel versions prior to v1.10.0 that stems from the server not reading the AUTH environment variable used to set authentication credentials, which could result in any unauthenticated user bei...

K000140784: Apache HTTPD vulnerability CVE-2024-38477

Security Advisory Description null pointer dereference in modproxy in Apache HTTP Server 2.4.59 and earlier allows an attacker to crash the server via a malicious request. Users are recommended to upgrade to version 2.4.60, which fixes this issue. CVE-2024-38477 Impact Attackers can exploit this...

USDoD Hacker Behind $3 Billion SSN Leak Reveals Himself as Brazilian Citizen

Infamous hacker USDoD, linked to major data breaches, reveals his identity as a Brazilian citizen. Discover the implications…...

PT-2024-30003 · Publiccms · Publiccms

Name of the Vulnerable Software and Affected Versions: publiccms versions V4.0.202302.e and before Description: The issue concerns an Any File Upload vulnerability via the "publiccms/admin/cmsTemplate/saveMetaData" endpoint. This allows unauthorized file uploads, potentially leading to security...

No, not every Social Security number in the U.S. was stolen

My current least favorite thing about the churn of social media that Ive seen over the past week is waves of stories, posts and videos saying that every U.S. citizens Social Security number has been stolen or potentially viewed by a threat actor. The claim comes from a class action lawsuit filed ...

My child had her data stolen—here’s how to protect your kids from identity theft

Recently, I received a letter in the mail from a company about a data breach. The letter said that the company had been a victim of a cyberattack back in March in which files were scrambled what we know as ransomware. The attacker had also accessed sensitive files and customer health data. Sadly,...

GO-2023-2398 lakeFS logs S3 credentials in plain text in github.com/treeverse/lakefs

lakeFS logs S3 credentials in plain text in github.com/treeverse/lakefs...

GO-2023-2072 Cros secrets may be disclosed to untrusted relay in github.com/schollz/croc

Cros secrets may be disclosed to untrusted relay in github.com/schollz/croc...

National Public Data leaked passwords online

Earlier this month, a huge trove of data from scraping service National Public Data was posted online. The dump made international headlines because it included data on hundreds of millions of people, and included Social Security Numbers. As if that wasnt bad enough, KrebsOnSecurity is now...

Toyota confirms customer and employee data stolen, says breach at third party to blame

Last week, a cybercriminal using the handle ZeroSevenGroup dumped 240GB of data on the infamous stolen data site BreachForums, that they said came from a hack on the US branch of car manufacturer Toyota. ZeroSevenGroup claims the dump includes customer and employee data. ZeroSevenGroup posted the...

Detecting AWS Account Compromise: Key Indicators in CloudTrail Logs for Stolen API Keys

As cloud infrastructure becomes the backbone of modern enterprises, ensuring the security of these environments is paramount. With AWS Amazon Web Services still being the dominant cloud it is important for any security professional to know where to look for signs of compromise. AWS CloudTrail...

Umbraco 安全漏洞

Umbraco is an open source content management system CMS written in C from Umbraco, Denmark. A security vulnerability exists in Umbraco versions prior to 14.1.2 that stems from an authenticated user having access to some unintended endpoints...

pharmacy-manage-system 安全漏洞

pharmacy-manage-system is a pharmacy management system by Krishna Aryal, an individual developer. A security vulnerability exists in pharmacy-manage-system, which stems from an SQL injection vulnerability in the invoicenumber parameter of the salesreport.php page...

Han ERP 安全漏洞

Han ERP is an ERP import/export system developed by Han Individual Developer. A security vulnerability exists in the ERP that originates from the /index.php/basedata/contact/delete?action=delete location that contains a SQL injection vulnerability...

Han ERP 安全漏洞

Han ERP is an ERP import/export system developed by Han Individual Developer. Han ERP has a security vulnerability that originates from the /index.php/basedata/inventory/delete?action=delete location contains a SQL injection vulnerability...