Attackers Breach Microsoft Customer Service Accounts

The same group behind the SolarWinds supply-chain attacks has been targeting Microsoft’s corporate networks to gain access to specific organizations — primarily, U.S.-based IT and government organizations. Microsoft officially announced the attacks after Reuters obtained an email sent to customer...

CVE-2021-28585

Magento versions 2.4.2 and earlier, 2.4.1-p1 and earlier and 2.3.6-p1 and earlier are affected by an Improper input validation vulnerability in the New customer WebAPI.Successful exploitation could allow an attacker to send unsolicited spam e-mails...

CVE-2021-28563

Magento versions 2.4.2 and earlier, 2.4.1-p1 and earlier and 2.3.6-p1 and earlier are affected by an Improper Authorization vulnerability via the 'Create Customer' endpoint. Successful exploitation could lead to unauthorized modification of customer data by an unauthenticated attacker. Access to...

CVE-2021-28563

Magento versions 2.4.2 and earlier, 2.4.1-p1 and earlier and 2.3.6-p1 and earlier are affected by an Improper Authorization vulnerability via the 'Create Customer' endpoint. Successful exploitation could lead to unauthorized modification of customer data by an unauthenticated attacker. Access to...

Input validation

Magento versions 2.4.2 and earlier, 2.4.1-p1 and earlier and 2.3.6-p1 and earlier are affected by an Improper input validation vulnerability in the New customer WebAPI.Successful exploitation could allow an attacker to send unsolicited spam e-mails...

Authorization

Magento versions 2.4.2 and earlier, 2.4.1-p1 and earlier and 2.3.6-p1 and earlier are affected by an Improper Authorization vulnerability via the 'Create Customer' endpoint. Successful exploitation could lead to unauthorized modification of customer data by an unauthenticated attacker. Access to...

CVE-2021-28563

Magento Commerce/Open Source prior to 2.4.3 (specifically 2.4.2 and earlier, 2.4.1-p1 and earlier, 2.3.6-p1 and earlier) is affected by an Improper Authorization vulnerability via the Create Customer endpoint. An unauthenticated attacker could cause unauthorized modification of customer data, wit...

CVE-2021-28563 Magento Commerce improper Authorization via the 'Create Customer' endpoint

Magento versions 2.4.2 and earlier, 2.4.1-p1 and earlier and 2.3.6-p1 and earlier are affected by an Improper Authorization vulnerability via the 'Create Customer' endpoint. Successful exploitation could lead to unauthorized modification of customer data by an unauthenticated attacker. Access to...

SolarWinds Hackers Breach Microsoft Customer Support to Target its Customers

In yet another sign that the Russian hackers who breached SolarWinds network monitoring software to compromise a slew of entities never really went away, Microsoft said the threat actor behind the malicious cyber activities used password spraying and brute-force attacks in an attempt to guess...

Mercedes-Benz Customer Data Flies Out the Window

Ahh, the luxury of Mercedes-Benz cars: The high-end upholstery, plush carpeting, polished wood trim, LED mood lighting. “Even the scent signals that this vehicle is special,” as the automaker sighs. Of course, even a company like Mercedes-Benz can inadvertently fart out customer data. That’s what...

07FLY-CRM suffers from SQL injection vulnerability (CNVD-2021-46886)

07FLY-CRM is a domestic open source general-purpose customer management system . 07FLY-CRM has a SQL injection vulnerability that can be exploited by attackers to obtain sensitive information from the database...

07FLY-CRM suffers from SQL injection vulnerability (CNVD-2021-46885)

07FLY-CRM is a domestic open source general-purpose customer management system . 07FLY-CRM has a SQL injection vulnerability that can be exploited by attackers to obtain sensitive information from the database...

07FLY-CRM suffers from SQL injection vulnerability (CNVD-2021-46943)

07FLY-CRM is a domestic open source general-purpose customer management system . 07FLY-CRM has a SQL injection vulnerability that can be exploited by attackers to obtain sensitive information from the database...

Wegmans Exposes Customer Data in Misconfigured Databases

Wegmans Food Markets, the U.S. supermarket chain, has notified customers that some of their data was exposed because two of its cloud-based databases were misconfigured, making them publicly accessible online. In a publicly posted breach notification letter, Wegmans said that the issue was first...

07FLY-CRM Customer Management System v1.2 suffers from SQL injection vulnerability (CNVD-2021-46818)

07FLY-CRM is a domestic open source general-purpose customer management system for various industries , mainly for small and medium-sized sales / after-sales service team . 07FLY-CRM customer management system v1.2 SQL injection vulnerability , attackers can exploit the vulnerability to obtain...

Customer Relationship Management System (CRM) 1.0 - Remote Code Execution Exploit

Exploit Title: Customer Relationship Management System CRM 1.0 - Remote Code Execution Exploit Author: Ishan Saha Vendor Homepage: https://www.sourcecodester.com/php/14794/customer-relationship-management-crm-system-php-source-code.html Software Link:...

Customer Relationship Management System (CRM) 1.0 - Remote Code Execution

Exploit Title: Customer Relationship Management System CRM 1.0 - Remote Code Execution Date: 21.06.2021 Exploit Author: Ishan Saha Vendor Homepage: https://www.sourcecodester.com/php/14794/customer-relationship-management-crm-system-php-source-code.html Software Link:...

07FLY-CRM Customer Management System v1.2 suffers from SQL Injection Vulnerability

Zero take-off CRM management system 07FLY-CRM, based on the GPLv3 agreement issued for small and medium-sized management activities , currently provides customer relationship management CRM, sales and marketing inventory JXC, open source software free of charge , in order to create China's first...

SQL Injection Vulnerability in 07FLY-CRM

07FLY-CRM is a domestic open source general-purpose customer management system for various industries , mainly for small and medium-sized sales / after-sales service team . 07FLY-CRM SQL injection vulnerability , an attacker can use this vulnerability to obtain sensitive information in the databa...

07FLY-CRM suffers from SQL injection vulnerability (CNVD-2021-46255)

07FLY-CRM is a domestic open source general-purpose customer management system for various industries , mainly for small and medium-sized sales / after-sales service team . 07FLY-CRM SQL injection vulnerability , an attacker can use this vulnerability to obtain sensitive information in the databa...