Shopify: Order lookup features of Shopify Chat Application leads to customer orders enumeration due to lack of user input validation

It came to my attention that the Shopify Chat application allows a customer to retrieve its order status by only providing the order email and number. Noticing that it results in being provided the order status page link, I started playing a bit with both parameters and I found out that it is...

Ransomware Takes Down Network of French IT Giant

French IT giant Sopra Steria was hit with a cyber attack this week that disrupted the business of the firm and is widely believed to be the work of the threat actors behind Ryuk ransomware. The company revealed the attack in a brief press statement released Oct. 22, two days after officials said...

Oracle Retail Customer Management and Segmentation Foundation Promotions Unauthorized Access Vulnerability

Oracle Retail Customer Management and Segmentation Foundation is a retail customer management component from Oracle. This component is responsible for customer management and segmentation. An unauthorized access vulnerability exists in Oracle Retail Customer Management and Segmentation Foundation...

CVE-2020-14732

Vulnerability in the Oracle Retail Customer Management and Segmentation Foundation product of Oracle Retail Applications component: Promotions. The supported version that is affected is 19.0. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to...

CVE-2020-14731

Vulnerability in the Oracle Retail Customer Management and Segmentation Foundation product of Oracle Retail Applications component: Segment. Supported versions that are affected are 18.0 and 19.0. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to...

CVE-2020-14732

The CVE-2020-14732 entry concerns Oracle Retail Customer Management and Segmentation Foundation (Promotions) in version 19.0. The vulnerability allows a low-privilege attacker with network access over HTTP to read a subset of data, indicating a confidentiality impact. Root cause details are not e...

CVE-2020-14731

CVE-2020-14731 affects Oracle Retail Customer Management and Segmentation Foundation (Segment) with vulnerable versions 18.0 and 19.0. The issue is exploitable by a low-privileged attacker over HTTP with network access, leading to unauthorized read access of a subset of data. The connected Red Ha...

CVE-2020-14731

Vulnerability in the Oracle Retail Customer Management and Segmentation Foundation product of Oracle Retail Applications component: Segment. Supported versions that are affected are 18.0 and 19.0. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to...

CVE-2020-14732

Vulnerability in the Oracle Retail Customer Management and Segmentation Foundation product of Oracle Retail Applications component: Promotions. The supported version that is affected is 19.0. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to...

customer.ingtouch.com Cross Site Scripting vulnerability OBB-1432623

Following coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: &nbsp&nbsp&nbsp&nbsp&nbsp&nbspa. verified the vulnerability and confirmed its existence; &nbsp&nbsp&nbsp&nbsp&nbsp&nbspb. notified the website operator about its existence...

Pharma Giant Pfizer Leaks Customer Prescription Info, Call Transcripts

UPDATE Pharma giant Pfizer has leaked the private medical data of prescription-drug users in the U.S. for months or even years, thanks to an unprotected Google Cloud storage bucket. The exposed data includes phone-call transcripts and personally-identifiable information PII, according to...

Life post-acquisition: A people-centric plan to get you total data security a lot faster

Getting acquired can be an emotional rodeo. Some days are crazy excitement and others are heartache over the unknowns ahead. It’s natural – we’re human. I remember years ago sitting in a doctor’s office staring at a poster about the “10 most stressful life events” and “starting a new job” was 4...

GHSA-6GW4-X63H-5499 Ability to switch customer email address on account detail page and stay verified

Impact The user may register in a shop by email [email protected], verify it, change it to the mail [email protected] and stay verified and enabled. This may lead to having accounts addressed to totally different emails, that were verified. Note, that this way one is not able to take over any...

CVE-2020-24408 Stored XSS in customer address upload feature

Magento versions 2.4.0 and 2.3.5p1 and earlier are affected by a persistent XSS vulnerability that allows users to upload malicious JavaScript via the file upload component. This vulnerability could be abused by an unauthenticated attacker to execute XSS attacks against other Magento users. This...

Security Bulletin: A Security Vulnerability in Websphere Application Server Affects Predictive Customer Intelligence (CVE-2020-4643)

Summary Websphere Application Server is shipped with Predictive Customer Intelligence. Information about a security vulnerability affecting Websphere Application Server has been published in a security bulletin. Vulnerability Details Refer to the security bulletins listed in the Remediation/Fixes...

Exploit for Cross-site Scripting in Blinger

CVE-2019-13633 Suggested description: Blinger.io v.1.0.2...

Broadvoice Leak Exposes 350M Records, Personal Voicemail Transcripts

UPDATE Broadvoice, a well-known VoIP provider that serves small- and medium-sized businesses, has leaked more than 350 million customer records related to the company’s “b-hive” cloud-based communications suite. The data includes hundreds of thousands of voicemail transcripts, many involving...

PT-2020-4578 · Adobe · Magento

Name of the Vulnerable Software and Affected Versions: Magento versions 2.4.0 and 2.3.5p1 and earlier Description: The issue is related to an incorrect permissions vulnerability in the Integrations component of Magento. This could allow authenticated users with permissions to the Resource Access...

What's New in Customer Identity and Access Management

We all know that the ability to accurately identify, understand, and engage our customers across multiple channels and digital touchpoints is absolutely vital to the digital customer experience and business. This couldn't be more important in the current environment as we continue to move more of...

Security Bulletin: A Security Vulnerability in Websphere Application Server Affects Predictive Customer Intelligence (CVE-2020-4578)

Summary Websphere Application Server is shipped with Predictive Customer Intelligence. Information about a security vulnerability affecting Websphere Application Server has been published in a security bulletin. Vulnerability Details Refer to the security bulletins listed in the Remediation/Fixes...