Shanghai ShangPai Network Technology Co., Ltd. Ecshop Has Logic Flaw Vulnerability

Commercial ECShop - new retail open source mall system, commercial B2C open source mall system, support for PC + H5 + APP + small program mall, source code free download, suitable for enterprises to quickly build a mall website, support for two open customization. And ECShop new upgrade ECShopX,...

Malicious Package

Overview commission-junctionstats is a malicious package. Affected versions of this package were found to be a Malicious Package, as it utilised typosquatting to run Malicious 3rd party scripts. It replaced genuine packages using an and replaced it with - and vice versa Remediation Avoid using...

Child identity theft, part 1: On familiar fraud

In 2013, 30-year-old Axton Betz-Hamilton received an angry phone call from her father two weeks after her mother, Pam, died. "What the hell were you thinking?" he screamed. He had just unearthed a credit card statement in her name that had run over its limit from a box of her mother’s paperwork...

HackerOne: Rounding errors on rewarding a bounty leads to bypassing the 20% H1 commission fee

Summary: The team discovered a rounding error issue when rewarding hackers with a bounty. Through a series of micro-payments, a malicious program manager is able to pay a full amount to the hacker while evading the 20% H1 commission fee. Description: H1 has a system for awarding and paying hacker...

Stalkerware Attacks Increased 50 Percent Last Year, Report

The number of stalkerware attacks on mobile devices increased 50 percent over the last year, showing an upward and continued trend in the emerging threat, researchers said. Over the past year, the instances of stalkerware—which tracks users without their knowledge and can result in harassment,...

Be Cautious of Romance Scams

This Valentine’s Day, the Cybersecurity and Infrastructure Security Agency CISA reminds users to be wary of internet romance scams. Cyber criminals partaking in this type of fraud target victims, gain their confidence, and convince them to transfer funds. When online dating, use caution and never...

A week in security (February 3 – 9)

Last week on Malwarebytes Labs, we looked at Washington state’s latest efforts in providing better data privacy rights for their residents, and we dove into some of the many questions regarding fintech: What is it? How secure is it? And what are some of the problems in the space? We also detailed...

Company Detected Years-Long Breach Only After Hacker Maxed Out Servers' Storage

What could be even worse than getting hacked? It's the "failure to detect intrusions" that always results in huge losses to the organizations. Utah-based technology companyInfoTrax Systems is the latest example of such a security blunder, as the company was breached more than 20 times from May 20...

CVE-2019-18633

European Commission eIDAS-Node Integration Package before 2.3.1 has Missing Certificate Validation because a certain ExplicitKeyTrustEvaluator return value is not checked. NOTE: only 2.1 is confirmed to be affected...

CVE-2019-18632

European Commission eIDAS-Node Integration Package before 2.3.1 allows Certificate Faking because an attacker can sign a manipulated SAML response with a forged certificate...

CVE-2019-18632

European Commission eIDAS-Node Integration Package before 2.3.1 allows Certificate Faking because an attacker can sign a manipulated SAML response with a forged certificate...

CVE-2019-18633

European Commission eIDAS-Node Integration Package before 2.3.1 has Missing Certificate Validation because a certain ExplicitKeyTrustEvaluator return value is not checked. NOTE: only 2.1 is confirmed to be affected...

Code injection

European Commission eIDAS-Node Integration Package before 2.3.1 allows Certificate Faking because an attacker can sign a manipulated SAML response with a forged certificate...

Code injection

European Commission eIDAS-Node Integration Package before 2.3.1 has Missing Certificate Validation because a certain ExplicitKeyTrustEvaluator return value is not checked. NOTE: only 2.1 is confirmed to be affected...

CVE-2019-18633

European Commission eIDAS-Node Integration Package before 2.3.1 has Missing Certificate Validation because a certain ExplicitKeyTrustEvaluator return value is not checked. NOTE: only 2.1 is confirmed to be affected...

CVE-2019-18633

CVE-2019-18633 concerns the European Commission eIDAS-Node Integration Package. Connected sources confirm a vulnerability in Missing Certificate Validation where a certain ExplicitKeyTrustEvaluator return value is not checked. The issue is explicitly tied to the package versions “before 2.3.1,” a...

CVE-2019-18632

European Commission eIDAS-Node Integration Package before 2.3.1 allows Certificate Faking because an attacker can sign a manipulated SAML response with a forged certificate...

CVE-2019-18632

The CVE-2019-18632 entry concerns the European Commission eIDAS-Node Integration Package prior to 2.3.1. Affected component: the eIDAS-Node integration package that handles SAML responses. Root cause: signing a manipulated SAML response with a forged certificate enables certificate faking. Impact...

Execs Could Face Jail Time For Privacy Violations

A new data privacy bill threatens large tech firms, like Facebook, with tough penalties – including monetary fines and up to 20 years of jail time for executives – if they violate user privacy policies. The “Mind Your Own Business Act,” proposed by Sen. Ron Wyden D-Ore. on Thursday, gives the...

Google Fined $170 Million For Violating Kids' Privacy On YouTube

Google has finally agreed to pay $170 million fine to settle allegations by the Federal Trade Commission and the New York attorney general that its YouTube service earned millions by illegally harvesting personal information from children without their parents' consent. The settlement requires...