Stored HTML Injection inside the >>> Request payment >>> Request Customer Data Checkout >>> Request shipping address

Team, I hope you are all doing well. . I wanted to bring to your attention a potential vulnerability on the website https://mainnet.demo.btcpayserver.org/stores/6YSiuoN6q1yF2ucWZvWojBuVJAJzXxFFUn9cw8iNPPMC/payment-requests/edit/ec575d56-6b8e-41bd-8b9a-bdcda9c5daad. . During my research, I...

AI Image Editing Tool Cutout Leaked User Images and Data

By Habiba Rashid In total, the Cutout-owned Elasticsearch server leaked a whopping 9 GB worth of customer data. This is a post from HackRead.com Read the original post: AI Image Editing Tool Cutout Leaked User Images and Data...

GoTo’s LastPass Breach: Encrypted Customer Data Taken

By Deeba Ahmed GoTo-owned LastPass revealed that hackers stole customers' encrypted data in a November 2022 data breach. This is a post from HackRead.com Read the original post: GoTos LastPass Breach: Encrypted Customer Data Taken...

LastPass Parent Company GoTo Suffers Data Breach, Customers' Backups Compromised

LastPass-owner GoTo formerly LogMeIn on Tuesday disclosed that unidentified threat actors were able to steal encrypted backups of some customers' data along with an encryption key for some of those backups in a November 2022 incident. The breach, which targeted a third-party cloud storage service...

Riot Games compromised, new releases and patches halted

Popular game developer Riot Games brings word of a system compromise which may cause issues for updates to well known titles, although for the time being it seems as though customer data isn't affected. A social engineering development Making the notification via Twitter late last week, were stil...

The vulnerability of the SAP Customer Data Cloud data management software lies in the use of a non-safe random number generator program, which allows an attacker to disclose sensitive information.

The vulnerability of the SAP Customer Data Cloud data management software is related to the use of a non-safe random number generator program. Exploiting this vulnerability could allow an attacker, operating remotely, to disclose sensitive information...

The vulnerability of the SAP Customer Data Cloud software for managing customer data, related to insufficiently secure data encryption, allows a perpetrator to disclose protected information.

The vulnerability of the SAP Customer Data Cloud software for managing customer data is related to insufficiently secure data encryption. Exploiting this vulnerability could allow a malicious actor, operating remotely, to disclose protected information...

Malware Attack on CircleCI Engineer's Laptop Leads to Recent Security Incident

DevOps platform CircleCI on Friday disclosed that unidentified threat actors compromised an employee's laptop and leveraged malware to steal their two-factor authentication-backed credentials to breach the company's systems and data last month. The CI/CD service CircleCI said the "sophisticated...

Hotel-Mgmt-System SQL注入漏洞

Hotel-Mgmt-System is a hotel management system. A security vulnerability in Tramyardg hotel-mgmt-system version 2022.4, which stems from its /app/dao/CustomerDAO.php allows attackers to implement SQL injection...

PT-2023-15568 · Unknown · Tramyardg Hotel-Mgmt-System

Name of the Vulnerable Software and Affected Versions: Tramyardg hotel-mgmt-system version 2022.4 Description: The issue concerns SQL Injection, which can be exploited via the /app/dao/CustomerDAO.php endpoint. This allows for potential unauthorized access or manipulation of data. No information ...

LastPass Breach

Last August, LastPass reported a security breach, saying that no customer information--or passwords--were compromised. Turns out the full story is worse: While no customer data was accessed during the August 2022 incident, some source code and technical information were stolen from our developmen...

GitHub Attack Allowed Attackers to Steal Okta’s Source Code

By Deeba Ahmed Okta has, however, confirmed that attackers couldnt access its customer data or services. Authentication giant Okta has suffered… This is a post from HackRead.com Read the original post: GitHub Attack Allowed Attackers to Steal Oktas Source Code...

Restaurant platform SevenRooms confirms data breach

SevenRooms, a "guest experience and retention platform" for food establishments and hospitality organisations, has confirmed it has fallen victim to a third party vendor data breach. Mostly known for its customer management platform, Seven Rooms' breach came to light after stolen data was seen fo...

inDrive: # Drivers can access the customers phone number, current location without getting their offer accepted!

A vulnerability was found where drivers could access customers' phone numbers and locations without having their offer accepted...

Medibank Refuses to Pay Ransom After 9.7 Million Customers Exposed in Ransomware Hack

Australian health insurer Medibank today confirmed that personal data belonging to around 9.7 million of its current and former customers were accessed following a ransomware incident. The attack, according to the company, was detected in its IT network on October 12 in a manner that it said was...

Microsoft Confirms Server Misconfiguration Led to 65,000+ Companies' Data Leak

Microsoft this week confirmed that it inadvertently exposed information related to thousands of customers following a security lapse that left an endpoint publicly accessible over the internet sans any authentication. "This misconfiguration resulted in the potential for unauthenticated access to...

Microsoft breach reveals some customer data

Microsoft customers find themselves in the middle of a data breach situation. The Microsoft Security Response Center blog reports that researchers reported a misconfigured Microsoft endpoint on September 24. This miscongifuration resulted in the possibility of "unauthenticated access to some...

Investigation Regarding Misconfigured Microsoft Storage Location

October 28, 2022 update: Added a Customer FAQ section. Summary Summary Security researchers at SOCRadar informed Microsoft on September 24, 2022, of a misconfigured Microsoft endpoint. This misconfiguration resulted in the potential for unauthenticated access to some business transaction data...

Investigation Regarding Misconfigured Microsoft Storage Location

October 28, 2022 update: Added a Customer FAQ section. Summary Security researchers at SOCRadar informed Microsoft on September 24, 2022, of a misconfigured Microsoft endpoint. This misconfiguration resulted in the potential for unauthenticated access to some business transaction data correspondi...

Import and export users and customers < 1.20.5 - Subscriber+ CSV Injection

The plugin does not properly escape data when exporting it via CSV files. PoC 1 Edit your subscriber account's nickname to: ;=1+3 2 As an administrator, export your users data via http://vulnerable-site.tld/wp-admin/tools.php?page=acui=export, and open the resulting CSV file in Excel or equivalen...