CVE-2020-22277

Import and export users and customers WordPress Plugin through 1.15.5.11 allows CSV injection via a customer's profile...

Design/Logic Flaw

Import and export users and customers WordPress Plugin through 1.15.5.11 allows CSV injection via a customer's profile...

CVE-2020-22274

CVE-2020-22274 affects JomSocial (Joomla Social Network Extention) 4.7.6, with a CSV injection flaw exploitable via a customer profile. The vulnerability’s root cause is CSV injection in the profile handling, and CVSS metrics indicate a HIGH/CRITICAL risk (CVSS v3.1: 9.8; network attack, no auth,...

CVE-2020-22277

Import and export users and customers WordPress Plugin through 1.15.5.11 allows CSV injection via a customer's profile...

Moderate: Red Hat Security Advisory: GNOME security, bug fix, and enhancement update

An update for GNOME is now available for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the...

Threat Roundup for October 23 to October 30

Today, Talos is publishing a glimpse into the most prevalent threats we've observed between Oct. 23 and Oct. 30. As with previous roundups, this post isn't meant to be an in-depth analysis. Instead, this post will summarize the threats we've observed by highlighting key behavioral characteristics...

Home Depot Confirms Data Breach in Order Confirmation SNAFU

Home Depot has exposed the private order confirmations of hundreds of Canadian consumers, containing names, physical addresses, email addresses, order details and partial credit-card information. After customers began reporting that they had received hundreds of emails from the home-improvement...

Amazon Fires Employee Who Leaked Customer Names, Emails

Amazon has fired an employee who shared customers’ names and email addresses with a third party. An Amazon spokesperson told Threatpost that it has systems in place to limit and control access to information, and processes in place for identifying and investigating suspicious behavior. These...

2020 DDoS Extortion Campaign -- A Sequel More Thrilling Than the Original

Costarring Susan McReynolds and Tom Emmons As you might imagine, as the go-to enterprise DDoS mitigation experts, our phones have been "ringing off the hook" as the global extortion DDoS campaign sequel rages on. It's bigger, badder, and features a broader cast of criminal characters than seen...

Unspecified Vulnerability in Oracle Retail Customer Management and Segmentation Foundation

Oracle Retail Customer Management and Segmentation Foundation is a retail customer management product. A security vulnerability exists in the Segment component of Oracle Retail Customer Management and Segmentation Foundation 18.0, 19.0. An attacker could exploit the vulnerability to gain...

Shopify: Customer's full name disclosure via Shopify Chat (by email lookup)

By making use of the Shopify Chat Application, it is possible to retrieve a customer First Name and Last Name by providing its email. Steps to reproduce 1. Having a shop with Shopify Chat installed, open up https://shop.myshopify.com/?chat in Incognito mode 1. Click on I need an update on my orde...

Shopify: Order lookup features of Shopify Chat Application leads to customer orders enumeration due to lack of user input validation

It came to my attention that the Shopify Chat application allows a customer to retrieve its order status by only providing the order email and number. Noticing that it results in being provided the order status page link, I started playing a bit with both parameters and I found out that it is...

Ransomware Takes Down Network of French IT Giant

French IT giant Sopra Steria was hit with a cyber attack this week that disrupted the business of the firm and is widely believed to be the work of the threat actors behind Ryuk ransomware. The company revealed the attack in a brief press statement released Oct. 22, two days after officials said...

Oracle Retail Customer Management and Segmentation Foundation Promotions Unauthorized Access Vulnerability

Oracle Retail Customer Management and Segmentation Foundation is a retail customer management component from Oracle. This component is responsible for customer management and segmentation. An unauthorized access vulnerability exists in Oracle Retail Customer Management and Segmentation Foundation...

CVE-2020-14732

Vulnerability in the Oracle Retail Customer Management and Segmentation Foundation product of Oracle Retail Applications component: Promotions. The supported version that is affected is 19.0. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to...

CVE-2020-14731

Vulnerability in the Oracle Retail Customer Management and Segmentation Foundation product of Oracle Retail Applications component: Segment. Supported versions that are affected are 18.0 and 19.0. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to...

CVE-2020-14731

CVE-2020-14731 affects Oracle Retail Customer Management and Segmentation Foundation (Segment) with vulnerable versions 18.0 and 19.0. The issue is exploitable by a low-privileged attacker over HTTP with network access, leading to unauthorized read access of a subset of data. The connected Red Ha...

CVE-2020-14732

The CVE-2020-14732 entry concerns Oracle Retail Customer Management and Segmentation Foundation (Promotions) in version 19.0. The vulnerability allows a low-privilege attacker with network access over HTTP to read a subset of data, indicating a confidentiality impact. Root cause details are not e...

CVE-2020-14732

Vulnerability in the Oracle Retail Customer Management and Segmentation Foundation product of Oracle Retail Applications component: Promotions. The supported version that is affected is 19.0. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to...

CVE-2020-14731

Vulnerability in the Oracle Retail Customer Management and Segmentation Foundation product of Oracle Retail Applications component: Segment. Supported versions that are affected are 18.0 and 19.0. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to...