studio22.at Cross Site Scripting vulnerability OBB-3952573

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

It's best to just assume you’ve been involved in a data breach somehow

Between AT&T, all the follow-on activity from Snowflake, Microsoft Outlook, and more, its best to probably just assume at this point that your personal information has somehow been involved in a data breach. Were only halfway through 2024, and weve already seen some of the largest data breaches a...

shopgarden.com.br Cross Site Scripting vulnerability OBB-3945674

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

A week in security (July 8 – July 14)

Last week on Malwarebytes Labs: "Nearly all" AT&T customers had phone records stolen in new data breach disclosure Fake Microsoft Teams for Mac delivers Atomic Stealer Dangerous monitoring tool mSpy suffers data breach, exposes customer details iPhone users in 98 countries warned about spyware by...

AT&T Paid a Hacker $370,000 to Delete Stolen Phone Records

A security researcher who assisted with the deal says he believes the only copy of the complete dataset of call and text records of “nearly all” AT&T customers has been wiped—but some risks may remain...

AT&T Confirms Data Breach Affecting Nearly All Wireless Customers

American telecom service provider AT&T has confirmed that threat actors managed to access data belonging to "nearly all" of its wireless customers as well as customers of mobile virtual network operators MVNOs using AT&T's wireless network. "Threat actors unlawfully accessed an AT&T workspace on ...

Crooks Steal Phone, SMS Records for Nearly All AT&T Customers

AT&T Corp. disclosed today that a new data breach has exposed phone call and text message records for roughly 110 million people -- nearly all of its customers. AT&T said it delayed disclosing the incident in response to "national security and public safety concerns," noting that some of the...

The Sweeping Danger of the AT&T Phone Records Breach

Telecom giant AT&T says a major data breach has exposed the call and text records of “nearly all” of its customers, epitomizing the dire state of data security...

AT&T Data Breach: Hackers Steal Call and Text Records for “Nearly All” Customers

AT&T confirms a data breach exposing call and text records for "Nearly All" customers from May 2022 to…...

“Nearly all” AT&T customers had phone records stolen in new data breach disclosure

In a déjà-vu nightmare, US phone giant AT&T has notified customers that cybercriminals managed to download phone call and text message records of "nearly all of AT&T cellular customers from May 1, 2022 to October 31, 2022 as well as on January 2, 2023". In a filing with the Securities and Exchang...

AT&T Discloses Breach of Customer Data

On July 12, AT&T released a public statement on unauthorized access of customer data from a third-party cloud platform. AT&T also provided recommendations and resources for affected customers. CISA encourages customers to review the following AT&T article for additional information and follow...

Malicious code in sap-at (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis af773cc64d0bc11506f1b43171d7266fb59e5a34603003653cbcc43f1ad02ffd The OpenSSF Package Analysis project identified 'sap-at' @ 0.0.0 npm as malicious. It is considered malicious because: - The package communicate...

CVE-2024-5910

Missing authentication for a critical function in Palo Alto Networks Expedition can lead to an Expedition admin account takeover for attackers with network access to Expedition. Note: Expedition is a tool aiding in configuration migration, tuning, and enrichment. Configuration secrets, credential...

GHSA-G533-XQ5W-JMF3 node-stringbuilder vulnerable to Out-of-bounds Read

All versions of the package node-stringbuilder are vulnerable to Out-of-bounds Read due to incorrect memory length calculation, by calling ToBuffer, ToString, or CharAt on a StringBuilder object with a non-empty string value input. It's possible to return previously allocated memory, for example,...

MAL-2024-7407 Malicious code in @zitterorg/vitae-non (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware d396ac39fe415b823f8b908a69652a99cf9bc80b5f035f6c2a844a8d8686b328 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2024-7256 Malicious code in @zitterorg/laudantium-rerum (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware e45ff91dd83cc149d7abc8c6fb2c74e3509aa341e23c72cfac0a34868a4e2637 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in @zitterorg/vel-at-tenetur (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware ce96c6eb95e171ed20b8b7341a0a665ac092be2cf81d89899746f511ab279092 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2024-7324 Malicious code in @zitterorg/placeat-a (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 97e140c5d10bf92587d1e454856c6c3366a04c59862e78ec07694ece8216b221 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2024-7399 Malicious code in @zitterorg/vel-at-tenetur (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware ce96c6eb95e171ed20b8b7341a0a665ac092be2cf81d89899746f511ab279092 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2024-7240 Malicious code in @zitterorg/ipsum-magnam (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 3440d956b6278cf05a25decbc9392282bae51e16d8f6bdc717d7769c977324a4 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...