170 matches found
EUVD-2025-197962
The Cryptocurrency Payment Gateway for WooCommerce plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'handleoptinoptout' function in all versions up to, and including, 2.0.22. This makes it possible for unauthenticated attackers to op...
CVE-2025-12392 Cryptocurrency Payment Gateway for WooCommerce <= 2.0.25 - Missing Authorization to Unauthenticated Tracking Status Update
The Cryptocurrency Payment Gateway for WooCommerce plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'handleoptinoptout' function in all versions up to, and including, 2.0.25. This makes it possible for unauthenticated attackers to op...
Sling TV turned privacy into a game you weren’t meant to win
Streaming service Sling TV has settled with the California Attorney General over allegations that it blocked users from exercising their privacy rights. The company will pay $530,000 after being accused of making it difficult for customers to opt out of its data collection practices. The Californ...
California just put people back in control of their data
California's 2025 legislative session closed with 14 new privacy and AI-related bills. We’d like to highlight a few of the most relevant signed bills and encourage other states and countries to follow California’s example. Let’s go over some of the bills that were signed by the governor and how...
EUVD-2023-29622
Malicious code in bioql PyPI...
A week in security (September 22 – September 28)
Last week on Malwarebytes Labs: Hackers threaten parents: Get nursery to pay ransom or we leak your child’s data Google and Flo to pay $56 million after misusing users’ health data Neon App pays users to record their phone calls, sells data for AI training updated New SVG-based phishing campaign ...
LinkedIn will use your data to train its AI unless you opt out now
LinkedIn plans to share user data with Microsoft and its affiliates for AI training. Framed as "legitimate interest", it won't ask for your permission—instead you'll have to opt out before the deadline. Microsoft has made major investments in ChatGPT’s creator OpenAI, and as we know, the more dat...
Linux Distros Unpatched Vulnerability : CVE-2018-6052
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Lack of support for a non standard no-referrer policy value in Blink in Google Chrome prior to 64.0.3282.119 allowed a remote attacker to obtain referrer detail...
Data Brokers Face New Pressure for Hiding Opt-Out Pages From Google
After reporters found dozens of firms hiding privacy tools from search results, US senator Maggie Hassan insists the companies explain their practices—and pledge to improve access to privacy controls...
Data Brokers Are Hiding Their Opt-Out Pages From Google Search
Dozens of companies are hiding how you can delete your personal data, The Markup and CalMatters found...
A week in security (June 23 – June 29)
Last week on Malwarebytes Labs: Gmail’s multi-factor authentication bypassed by hackers to pull off targeted attacks Thousands of private camera feeds found online. Make sure yours isn’t one of them Sextortion email scammers increase their "Hello pervert" money demands Many data brokers are faili...
Facial recognition: Where and how you can opt out
Our remote team recently took a trip to our Estonian office. When we arrived from our various destinations, we started chatting about how our travel had been. Our senior privacy advocate, David Ruiz, mentioned that he'd opted out of facial recognition while at San Francisco International Airport...
CVE-2024-40594
The OpenAI ChatGPT app before 2024-07-05 for macOS opts out of the sandbox, and stores conversations in cleartext in a location accessible to other apps...
CVE-2023-25712
Auth. admin+ Stored Cross-Site Scripting XSS vulnerability in WP-Buddy Google Analytics Opt-Out plugin = 2.3.4 versions...
Meta Resumes E.U. AI Training Using Public User Data After Regulator Approval
Meta has announced that it will begin to train its artificial intelligence AI models using public data shared by adults across its platforms in the European Union, nearly a year after it paused its efforts due to data protection concerns from Irish regulators. "This training will better support...
Linux Distros Unpatched Vulnerability : CVE-2024-24557
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Moby is an open-source project created by Docker to enable software containerization. The classic builder cache system is prone to cache poisoning if the image ...
122 million people’s business contact info leaked by data broker
A data broker has confirmed a business contact information database containing 132.8 million records has been leaked online. In February, 2024, a cybercriminal offered the records for sale on a data breach forum claiming the information came from pureincubation.com. Pure Incubation was founded in...
How to Stop Your Data From Being Used to Train AI
Some companies let you opt out of allowing your content to be used for generative AI. Here’s how to take back at least a little control from ChatGPT, Google’s Gemini, and more...
Don’t share the viral Instagram Meta AI “legal” post
A new variation of a hoax that has been doing the rounds on Facebook for years has crossed over to Instagram. We’re seeing this post on Instagram Stories a lot suddenly over the last few days. The post is usually posted as a shareable screenshot on Instagram Stories, but it’s also been spotted on...
WordPress Analytify plugin <= 5.3.1 - CSRF Leading to Optout Vulnerability
CSRF Leading to Optout Vulnerability discovered by Dhabaleshwar Das Patchstack Alliance in WordPress Plugin Analytify versions = 5.3.1...