NodeStealer Malware Targets Facebook Ad Accounts, Harvesting Credit Card Data

Threat hunters are warning about an updated version of the Python-based NodeStealer that's now equipped to extract more information from victims' Facebook Ads Manager accounts and harvest credit card data stored in web browsers. "They collect budget details of Facebook Ads Manager accounts of the...

New SteelFox Malware Posing as Popular Software to Steal Browser Data

SteelFox malware targets software pirates through fake activation tools, stealing credit card data and deploying crypto miners. Learn…...

Security Bulletin: Vulnerability in RC4 stream cipher affects IBM i (CVE-2015-2808)

Summary The RC4 “Bar Mitzvah” Attack for SSL/TLS affects IBM i Vulnerability Details CVEID: CVE-2015-2808 DESCRIPTION: The RC4 algorithm, as used in the TLS protocol and SSL protocol, could allow a remote attacker to obtain sensitive information. An attacker could exploit this vulnerability to...

Global Phishing Scam Hits Canadian Pizza Chains for Credit Card Data

Scammers are using domain spoofing, phishing and other tactics to steal customer information from pizza restaurants, especially in…...

PT-2024-26281 · Axepta · Axepta

Name of the Vulnerable Software and Affected Versions: Axepta versions prior to 1.3.4 Description: The issue allows a guest to download partial credit card information, such as expiry date, postal address, and email, without restriction due to a lack of permissions control. Recommendations: For...

Motorola Device Help 安全漏洞

Motorola Device Help is a feature of Motorola USA Inc. It provides a full product lifecycle service experience. A security vulnerability exists in the Motorola Device Help Application, which stems from improper use of sensitive SD card data and could allow a local attacker to read system logs...

CVE-2024-29839

The Web interface of Evolution Controller Versions 2.04.560.31.03.2024 and below contains poorly configured access control on DESKTOPEDITUSERGETCARD, allowing for an unauthenticated attacker to return the card value data of any user...

CVE-2024-29839 Broken Access control on DESKTOP_EDIT_USER_GET_CARD in Evolution Controller allows unauthenticated attackers to retrieve card data values.

The Web interface of Evolution Controller Versions 2.04.560.31.03.2024 and below contains poorly configured access control on DESKTOPEDITUSERGETCARD, allowing for an unauthenticated attacker to return the card value data of any user...

CVE-2024-29839 Broken Access control on DESKTOP_EDIT_USER_GET_CARD in Evolution Controller allows unauthenticated attackers to retrieve card data values.

The Web interface of Evolution Controller Versions 2.04.560.31.03.2024 and below contains poorly configured access control on DESKTOPEDITUSERGETCARD, allowing for an unauthenticated attacker to return the card value data of any user...

DirectCyber Evolution Controller 安全漏洞

DirectCyber Evolution Controller is an access control controller software from DirectCyber, Inc. that is used to controller physical access to facilities. A security vulnerability exists in DirectCyber Evolution Controller version 2.04.560.31.03.2024 and prior versions, which stems from an improp...

PT-2024-23076

Name of the Vulnerable Software and Affected Versions Evolution Controller versions 2.04.560.31.03.2024 and below Description The Web interface of Evolution Controller contains poorly configured access control on the DESKTOP EDIT USER GET CARD endpoint, allowing an unauthenticated attacker to...

PT-2024-18756 · Unknown · Storagemanagerservice

Name of the Vulnerable Software and Affected Versions: StorageManagerService versions prior to SMR Apr-2024 Release 1 Description: The issue is related to an Improper Access Control vulnerability. It allows local attackers to bypass security and read sdcard information. Recommendations: For...

Raccoon Infostealer operator extradited to the United States

A Ukrainian national, Mark Sokolovsky, has been indicted for crimes related to fraud, money laundering and aggravated identity theft and extradited to the United States from the Netherlands, the US Attorney’s Office of the Western District of Texas has announced. In March 2022, around the same ti...

PT-2023-24231 · Desfire · Desfire

Name of the Vulnerable Software and Affected Versions: DesFire affected versions not specified Description: The function that reads the card isn't properly checking the boundaries when copying internally the data received, allowing a heap-based buffer overflow. This could lead to a potential Remo...

New Magecart Attack Uses 404 Errors to Steal Your Card Data

By Deeba Ahmed Be cautious of scammers employing a new and convincing trick to steal your payment card data through a Magecart attack. This is a post from HackRead.com Read the original post: New Magecart Attack Uses 404 Errors to Steal Your Card Data...

Yacht Listing Script Security Vulnerability

Yacht Listing Script is yacht and boat classification software. A security vulnerability exists in Yacht Listing Script v1.0. An attacker exploited the vulnerability to export a customer's credit card number from the booking module...

Fluhorse: Flutter-Based Android Malware Targets Credit Cards and 2FA Codes

Cybersecurity researchers have shared the inner workings of an Android malware family called Fluhorse. The malware "represents a significant shift as it incorporates the malicious components directly within the Flutter code," Fortinet FortiGuard Labs researcher Axelle Apvrille said in a report...

Scrubs & Beyond Leaks 400GB of User PII and Card Data in Plain Text

By Waqas Scrubs & Beyond were alerted multiple times about the data leak, but the company did not respond or secure the server. This is a post from HackRead.com Read the original post: Scrubs & Beyond Leaks 400GB of User PII and Card Data in Plain Text...

Magento, WooCommerce, WordPress, and Shopify Exploited in Web Skimmer Attack

Cybersecurity researchers have unearthed a new ongoing Magecart-style web skimmer campaign that's designed to steal personally identifiable information PII and credit card data from e-commerce websites. A noteworthy aspect that sets it apart from other Magecart campaigns is that the hijacked site...

Darknet Carding Kingpin Pleads Guilty: Sold Financial Info of Tens of Thousands

A U.S. national has pleaded guilty in a Missouri court to operating a darknet carding site and selling financial information belonging to tens of thousands of victims in the country. Michael D. Mihalo , aka Dale Michael Mihalo Jr. and ggmccloud1, has been accused of setting up a carding site call...