6605 matches found
22 Apple Distributors Arrested for Selling Customers’ Data in $7.4 Million
--- Image Source: South China Morning Post Chinese authorities have announced the arrest of around 22 distributors working as Apple distributors as part of a $7 million operation, who stole customers’ personal information from an internal Apple database and illegally sold it to Chinese black mark...
CVE-2017-7313
An issue was discovered in Personify360 e-Business 7.5.2 through 7.6.1. When going to the /TabId/275 URI, it is possible to read any customer name, master Customer Id, and email address. In other words, anyone can search for users/customers in the system - no authentication is required...
Authentication flaw
An issue was discovered in Personify360 e-Business 7.5.2 through 7.6.1. When going to the /TabId/275 URI, it is possible to read any customer name, master Customer Id, and email address. In other words, anyone can search for users/customers in the system - no authentication is required...
CVE-2017-7313
CVE-2017-7313 affects Personify360 e-Business 7.5.2–7.6.1. The issue allows unauthenticated access to the URI /TabId/275, enabling reading of customer data (names, master Customer Ids, and emails) without authentication. The description indicates that anyone can search for users/customers in the ...
CVE-2017-7313
An issue was discovered in Personify360 e-Business 7.5.2 through 7.6.1. When going to the /TabId/275 URI, it is possible to read any customer name, master Customer Id, and email address. In other words, anyone can search for users/customers in the system - no authentication is required...
OneLogin: Breach Exposed Ability to Decrypt Data
OneLogin, an online service that lets users manage logins to sites and apps from a single platform, says it has suffered a security breach in which customer data was compromised, including the ability to decrypt encrypted data. Headquartered in San Francisco, OneLogin provides single sign-on and...
OneLogin Breach Compromised Customer Data, Ability to Decrypt Encrypted Data
A breach at OneLogin, a company that provides customers with a single sign on for logging into multiple sites and apps, appears to have compromised customer data, including the ability to decrypt encrypted data. The company notified customers via email Wednesday that the incident stemmed from...
Privacy Issue Fixed in Yopify Ecommerce Notification Plugin
A plugin used by a number of popular ecommerce platforms has an over-sharing problem. Yopify, which provides popup notifications about the last 50 purchases made on a site for Shopify, BigCommerce and other platforms, leaks a significant amount of customers’ personal information to a determined...
Stored Cross-Site Scripting Vulnerability in Medical Attendant App
Apply for Medical Care is an online unified registration platform that provides online reservation and registration for domestic hospitals. There is a stored cross-site scripting vulnerability in the App, the vulnerability arises because the Contact Customer Service function module fails to...
Threat Outbreak Alert RuleID29245: Email Messages Distributing Malicious Software on May 24, 2017
Medium Alert ID: 53948 First Published: 2017 May 24 15:52 GMT Version: 1 Summary Cisco Security has detected significant activity related to spam email messages distributing malicious software. Email messages that are related to this threat RuleID29245 may contain the following files: Name | Size...
Other SD Projects Knowledge Base are accessible through direct link
h3. Summary: If a Customer only able to access one SD Portal and log in to Confluence, it is actually possible for that Customer to access other SD Project KBs through a Direct URL Link including navigating the space. h3. Steps to Reproduce: Prepare a JIRA instance that is connected to Confluence...
Other SD Projects Knowledge Base are accessible through direct link
h3. Summary: If a Customer only able to access one SD Portal and log in to Confluence, it is actually possible for that Customer to access other SD Project KBs through a Direct URL Link including navigating the space. h3. Steps to Reproduce: Prepare a JIRA instance that is connected to Confluence...
Should SaaS Companies Publish Customers Lists?
A few weeks back, HR and financial management firm Workday.com sent a security advisory to customers warning that crooks were sending targeted malware phishing attacks at customers. At the same time, Workday is publishing on its site a list of more than 800 companies that use its services, making...
President’s Cybersecurity Executive Order
On May 11, 2017, President Trump released the Presidential Executive Order on Strengthening the Cybersecurity of Federal Networks and Critical Infrastructure. This E.O. -- while stand alone in focus --should be seen in the context of a greater move in the Executive Branch to elevate the awareness...
The vulnerability of the CompanyDetailsSave.php file processing service in the vTiger CRM customer relationship management system allows a hacker to execute arbitrary code.
The vulnerability of the CompanyDetailsSave.php file processing service in the vTiger CRM customer relationship management system is related to the lack of restrictions on file downloads. Exploiting this vulnerability allows a malicious actor to execute arbitrary code through a direct request...
BSA-2017-338
Security Advisory ID : BSA-2017-338 Component : N/A Revision : 1.0: Final A ransomware calledWannaCryinfected computers in several countries. Computers that became infected had not been patched. Microsoft released a security bulletin on March 14th, 2017, titled Microsoft Security Bulletin MS17-01...
Bell Canada Hacked: Data of 1.9 Million Customers Stolen
While we all were busy in the WannaCry ransomware menace, two separate data breaches have been reported, one in DocuSign, a major provider of electronic signature technology, and another in BELL, Canada’s largest telecommunications company. Canadian mobile phone, TV, and internet service provider...
CVE-2017-6651
A vulnerability in Cisco WebEx Meetings Server could allow unauthenticated, remote attackers to gain information that could allow them to access scheduled customer meetings. The vulnerability is due to an incomplete configuration of the robots.txt file on customer-hosted WebEx solutions and occur...
Design/Logic Flaw
A vulnerability in Cisco WebEx Meetings Server could allow unauthenticated, remote attackers to gain information that could allow them to access scheduled customer meetings. The vulnerability is due to an incomplete configuration of the robots.txt file on customer-hosted WebEx solutions and occur...
CVE-2017-6651
A vulnerability in Cisco WebEx Meetings Server could allow unauthenticated, remote attackers to gain information that could allow them to access scheduled customer meetings. The vulnerability is due to an incomplete configuration of the robots.txt file on customer-hosted WebEx solutions and occur...