Ticketmaster confirms customer data breach

Live Nation Entertainment has confirmed what everyone has been speculating on for the last week: Ticketmaster has suffered a data breach. In a filing with the SEC, Live Nation said on May 20th it identified "unauthorized activity within a third-party cloud database environment containing Company...

ShinyHunters Claims Santander Bank Breach: 30M Customers’ Data for Sale

ShinyHunters claims surfaced two weeks after Santander Bank acknowledged a data breach linked to a third-party contractor involving…...

DRUPAL-CONTRIB-2024-021

The Commerce View Receipts module enables you to view commerce order receipts in the browser. The module doesn't sufficiently check access permissions, allowing an unauthorised user to view the private information of other customers...

The vulnerability of Microsoft Dynamics 365 Customer Insights’ CDP platform allows a hacker to perform spear-phishing attacks.

The vulnerability of the Microsoft Dynamics 365 Customer Insights CDP platform is related to the lack of measures taken to protect the website structure. Exploiting this vulnerability could allow a malicious actor to carry out spear-phishing attacks...

Dell Data Breach: Personal Information of 49 Million Customers Compromised due to latest API Abuse

Dell recently issued a notice regarding a data breach that occurred on May 9, which has reportedly affected over 49 million customers across the globe. According to a report by BleepingComputer, Dell initiated the distribution of notifications cautioning its customers that their personally...

Unauthorized Data Access

Klaviyo Magento 2 is vulnerable to Unauthorized Data Access. The vulnerability is due to insufficient access controls in an endpoint, allowing attackers to read private customer data from stores by reclaiming guest-carts and accessing order details via the Magento API...

GHSA-HVGW-GG3P-295J Read private customer data reclaiming carts in Klaviyo Magento

A researcher identified an endpoint in a thirth party module Klaviyo Magento 2 which allows to read private customer data from stores. It works by reclaiming any guest-cart as your own and reading the private data for the orders in the Magento API...

PT-2024-40329 · Klaviyo · Klaviyo Magento 2

Name of the Vulnerable Software and Affected Versions: Klaviyo Magento 2 affected versions not specified Description: A researcher discovered an issue in a third-party module that allows reading private customer data from stores. This is achieved by reclaiming any guest-cart as one's own and then...

Dell Discloses Data Breach As Hacker Sells 49 Million Customer Data

By Waqas Dell has announced a data breach, while a hacker using the alias Menelik is selling 49 million Dell customer data on the notorious Breach Forums. This is a post from HackRead.com Read the original post: Dell Discloses Data Breach As Hacker Sells 49 Million Customer Data...

Dropbox Sign customer data accessed in breach

Dropbox is reporting a recent "security incident" in which an attacker gained unauthorized access to the Dropbox Sign formerly HelloSign production environment. During this access, the attacker had access to Dropbox Sign customer information. Dropbox Sign is a platform that allows customers to...

CVE-2024-33666

An issue was discovered in Zammad before 6.3.0. Users with customer access to a ticket could have accessed time accounting details of this ticket via the API. This data should be available only to agents...

CVE-2024-1756

The WooCommerce Customers Manager WordPress plugin before 29.8 does not have authorisation and CSRF in an AJAX action, allowing any authenticated users, such as subscriber, to call it and retrieve the list of customer email addresses along with their id, first name and last name...

PT-2024-18279 · WordPress · Woocommerce Customers Manager

Name of the Vulnerable Software and Affected Versions: WooCommerce Customers Manager WordPress plugin versions prior to 29.8 Description: The issue concerns a lack of authorization and CSRF protection in an AJAX action, allowing any authenticated user to retrieve a list of customer email addresse...

Italtel Embrace 安全漏洞

Italtel Embrace is a software-only, cloud-enabled Web application server from Italtel. It can be used to enable WebRTC services in a TLC network or as a standalone WebRTC service. A security vulnerability exists in Italtel Embrace version 1.6.4 that could allow an unauthorized attacker to access...

Wiz Research finds architecture risks that may compromise AI-as-a-Service providers and consequently risk customer data; works with Hugging Face on mitigations

Wiz researchers discovered architecture risks that may compromise AI-as-a-Service providers and put customer data at risk. Wiz and Hugging Face worked together to mitigate the issue...

CVE-2023-36483

Authorization bypass can be achieved by session ID prediction in MASmobile Classic Android version 1.16.18 and earlier and MASmobile Classic iOS version 1.7.24 and earlier which allows remote attackers to retrieve sensitive data including customer data, security system status, and event history...

CVE-2023-36483

Authorization bypass can be achieved by session ID prediction in MASmobile Classic Android version 1.16.18 and earlier and MASmobile Classic iOS version 1.7.24 and earlier which allows remote attackers to retrieve sensitive data including customer data, security system status, and event history...

CVE-2023-36483

Authorization bypass can be achieved by session ID prediction in MASmobile Classic Android version 1.16.18 and earlier and MASmobile Classic iOS version 1.7.24 and earlier which allows remote attackers to retrieve sensitive data including customer data, security system status, and event history...

CVE-2023-36483 MAS (a Carrier brand) MASmobile Classic Authorization Bypass

Authorization bypass can be achieved by session ID prediction in MASmobile Classic Android version 1.16.18 and earlier and MASmobile Classic iOS version 1.7.24 and earlier which allows remote attackers to retrieve sensitive data including customer data, security system status, and event history...

CVE-2023-36483 MAS (a Carrier brand) MASmobile Classic Authorization Bypass

Authorization bypass can be achieved by session ID prediction in MASmobile Classic Android version 1.16.18 and earlier and MASmobile Classic iOS version 1.7.24 and earlier which allows remote attackers to retrieve sensitive data including customer data, security system status, and event history...