Black Friday Alert 2019: Net Shopping Bag of Threats

Every year, Kaspersky releases an annual Black Friday alert to highlight how fraudsters may capitalize on increased levels of online shopping at this time of year when many brands are offering their customers appealing discounts. In the rush to get a big discount or, even more panic-inducing, a...

Russian Hacker Behind NeverQuest Banking Malware Gets 4 Years in U.S. Prison

A Russian hacker who created and used Neverquest banking malware to steal money from victims' bank accounts has finally been sentenced to 4 years in prison by the United States District Court for the Southern District of New York. Stanislav Vitaliyevich Lisov , 34, was arrested by Spanish...

T-Mobile Suffers Data Breach Affecting Prepaid Wireless Customers

Are you a T-Mobile prepaid customer? If yes, you should immediately create or update your associated account PIN/passcode as additional protection. The US-based telecom giant T-Mobile today disclosed a yet another data breach incident that recently exposed potentially personal information of some...

Microsoft Outlook for Android Spoofing Vulnerability

Microsoft Outlook for Android is an email application for the Android-based platform from Microsoft USA. A spoofing vulnerability exists in the way Microsoft Outlook for Android parses specially crafted emails. An attacker could exploit this vulnerability by sending a specially crafted email to a...

CVE-2011-4919

mpack 1.6 has information disclosure via eavesdropping on mails sent by other users...

Stripo Inc: Clickjacking on my.stripo.email for MailChimp credentials

Clickjacking is a malicious hacking technique where attackers can acquire sensitive data. Through simple social engineering techniques these links can be sent out to unsuspecting customers to steal their credentials or perform actions on their accounts. For this example I saw that where I goto...

New Group of Hackers Targeting Businesses with Financially Motivated Cyber Attacks

Security researchers have tracked down activities of a new group of financially-motivated hackers that are targeting several businesses and organizations in Germany, Italy, and the United States in an attempt to infect them with backdoor, banking Trojan, or ransomware malware. Though the new...

Email Subscribers & Newsletters < 4.2.3 - Multiple Issues

- Unauthenticated File Download leading to Information Disclosure - Blind SQL Injection in INSERT statement - Insecure Permissions on Dashboard and Settings - CSRF on Settings - Send Test Emails from the Administrative Dashboard as an Authenticated User with a role of Subscriber and above -...

Razer: Through blocking the redirect in /* the attacker able to bypass Authentication To see Sensitive Data sush as Game Keys , Emails ,..

The rsa3027.razersynapse.com server suffered a SQLi vulnerability which allowed write access to the server in the context of Cortex Deals. This allowed access to game key information from giveaways and emails of users who claimed these giveaways. This vulnerability was reported 11/12 and closed b...

Encrypted Emails on macOS Found Stored in Unprotected Way

A database on Apple’s macOS computers is storing emails that are supposed to be protected with encryption as readable files, a problem of which the company has been aware for months and still has yet to solve, according to a researcher. Apple IT specialist Bob Gendler discovered the problem while...

PT-2020-3630 · Roundcube +4 · Roundcube Webmail +4

Name of the Vulnerable Software and Affected Versions: Roundcube Webmail versions 1.2.10 and earlier, 1.3.x before 1.3.14, and 1.4.x before 1.4.7 Description: The issue allows for cross-site scripting XSS via a crafted HTML e-mail message. This can be demonstrated by a JavaScript payload in the...

Threat Roundup for November 1 to November 8

Today, Talos is publishing a glimpse into the most prevalent threats we've observed between Nov. 1 and Nov. 8. As with previous roundups, this post isn't meant to be an in-depth analysis. Instead, this post will summarize the threats we've observed by highlighting key behavioral characteristics,...

What’s So Dangerous About Spear Phishing?

Spear phishing is one of the most common and most effective cyberattack vectors seen today. Delivered through email, spear phishing campaigns aim either to infect devices with malware, or to steal important information—like credentials and bank numbers. Spear phishing is targeted at specific grou...

Rogue Trend Micro Employee Sold Customer Data for 68K Accounts

Trend Micro said that a rogue employee sold the data of 68,000 customers to a malicious third party, who then used that data to target customers with scam calls. The employee, who gained unauthorized access to a customer-support database, has since been terminated. Trend Micro said that the...

Magento Cross-Site Scripting Vulnerability (CNVD-2019-40835)

Magento is an open source PHP e-commerce system of the United States Magento company . The system provides rights management , search engines and payment gateways and other functions. A security vulnerability exists in Magento versions prior to 1.9.4.3 and prior to 1.14.4.3. An attacker can explo...

UniCredit Bank Suffers 'Data Incident' Exposing 3 Million Italian Customer Records

UniCredit, an Italian global banking and financial services company, announced today that it suffered a security incident that leaked some personal information belonging to at least 3 million of its domestic customers. Officially founded in 1870, UniCredit is Italy's biggest banking and financial...

IBM Cloud Orchestrator Security Bypass Vulnerability

IBM Cloud Orchestrator is a suite of cloud management solutions from IBM in the United States. The program provides extended internal and external deployment of cloud services and application program interfaces and tools to extend the integration with existing environments and other functions. A...

Unsecured Adobe Server Exposes Data for 7.5 Million Creative Cloud Users

The U.S. multinational computer software company Adobe has suffered a serious security breach earlier this month that exposed user records' database belonging to the company's popular Creative Cloud service. With an estimated 15 million subscribers, Adobe Creative Cloud or Adobe CC is a...

7M Adobe Creative Cloud Users Exposed to Hackers

Nearly 7.5 million Adobe Creative Cloud users are left open to phishing campaigns after their records were left exposed to the internet. Adobe Creative Cloud, which has an estimated 15 million subscribers, is a monthly service that gives users access to a suite of popular Adobe products such as...

CVE-2015-9520

The Easy Digital Downloads EDD Per Product Emails extension for WordPress, as used with EDD 1.8.x before 1.8.7, 1.9.x before 1.9.10, 2.0.x before 2.0.5, 2.1.x before 2.1.11, 2.2.x before 2.2.9, and 2.3.x before 2.3.7, has XSS because addqueryarg is misused...