Incident Response report 2018

Download full report PDF Introduction This report covers our team's incident response practices for the year 2018. We have thoroughly analyzed all the service requests, customer conversations and incident response deliverables to provide you an overview in numbers. The report includes statistics ...

Imperva Firewall Breach Exposes Customer API Keys, SSL Certificates

UPDATE Imperva, the security vendor, has made a security breach public that affects customers using the Cloud Web Application Firewall WAF product. Formerly known as Incapsula, the Cloud WAF analyzes requests coming into applications, and flags or blocks suspicious and malicious activity. Users’...

Hostinger Data Breach: 14M Customer Passwords, Personal Data at Risk

Web hosting company Hostinger is warning that a breach of one of its servers potentially gave bad actors access to the hashed passwords and personal data of more than 14 million customers. Hostinger, a popular web, cloud and virtual private server hosting provider and domain registrar with 29...

Binance Confirms Hacker Obtained Its Users' KYC Data from 3rd-Party Vendor

As suspected, the KYC details of thousands of Binance's customers that hackers obtained and leaked online earlier this month came from the company's third-party vendor, Malta-based cryptocurrency exchange Binance confirmed. For those unaware, Binance, the world's largest cryptocurrency exchange b...

Vulnerability in Faster Wholesale System of Chengdu Renwei Technology Co.

Faster Horse New Wholesale System is a collection of professional B2B mall, fast ordering, lightweight sales and purchase inventory, CRM customer management, all-round aggregated payment, salesman patrols and performance appraisal, docking WMS intelligent warehousing and other functions in one...

Hacker Ordered to Pay Back Nearly £1 Million to Phishing Victims

A prolific hacker who carried out phishing scams against hundreds of companies worldwide has been ordered to pay back more than $1.1 million over £922,000 worth of cryptocurrencies to his victims. Grant West , a 27-year-old resident of Kent, England, targeted several well-known companies around t...

WordPress wp-customer-reviews plugin cross-site scripting vulnerability

WordPress is a set of blogging platforms developed using the PHP language by the WordPress Foundation. The platform supports setting up personal blog sites on servers with PHP and MySQL. A cross-site scripting vulnerability exists in the WordPress wp-customer-reviews plugin. An attacker can explo...

WordPress wp-customer-reviews plugin cross-site request forgery vulnerability

WordPress is a set of blogging platforms developed using the PHP language by the WordPress Foundation. The platform supports setting up personal blog sites on servers with PHP and MySQL. A cross-site request forgery vulnerability exists in the WordPress wp-customer-reviews plugin. An attacker can...

Breach at Hy-Vee Supermarket Chain Tied to Sale of 5M+ Stolen Credit, Debit Cards

On Tuesday of this week, one of the more popular underground stores peddling credit and debit card data stolen from hacked merchants announced a blockbuster new sale: More than 5.3 million new accounts belonging to cardholders from 35 U.S. states. Multiple sources now tell KrebsOnSecurity that th...

CVE-2016-10901

The wp-customer-reviews plugin before 3.0.9 for WordPress has XSS in the admin tools...

CVE-2016-10902

The wp-customer-reviews plugin before 3.0.9 for WordPress has CSRF in the admin tools...

CVE-2016-10901

The wp-customer-reviews plugin before 3.0.9 for WordPress has XSS in the admin tools...

Design/Logic Flaw

The wp-customer-reviews plugin before 3.0.9 for WordPress has XSS in the admin tools...

CVE-2016-10902

The CVE concerns the WordPress plugin wp-customer-reviews (before version 3.0.9). Multiple connected sources confirm a CSRF vulnerability in the admin tools of this plugin, with the issue described consistently across Red Hat, CNVD, CVE listings, and WP-related databases. The affected component i...

CVE-2016-10901

The vulnerability CVE-2016-10901 affects the WordPress plugin WP Customer Reviews, specifically versions before 3.0.9. The issue is a reflected/stored XSS in the plugin’s admin tools, which could allow arbitrary client-side code execution in privileged contexts. Supported by multiple sources (Red...

CVE-2017-18519

The customer-area plugin before 7.4.3 for WordPress has XSS via admin pages...

CVE-2017-18519

The customer-area plugin before 7.4.3 for WordPress has XSS via admin pages...

Your Business is Compliant with Data Security Regulations. It’s Still not Safe.

There has been plenty of discussion about the impact of global data regulations on data security practices. Particularly with the implementation of the EU’s GDPR last year, organizations in every industry have been scrambling to develop new security practices to avoid fines and the associated bad...

CVE-2017-18519

The customer-area plugin before 7.4.3 for WordPress has XSS via admin pages...

CVE-2017-18519

CVE-2017-18519 affects the WordPress plugin customer-area prior to version 7.4.3, with XSS via admin pages. Root cause: improper sanitization in admin interfaces. Impact: XSS could be triggered from the admin area; remediation: upgrade to 7.4.3 or later.