Asylum Ambuscade: A Cybercrime Group with Espionage Ambitions

The threat actor known as Asylum Ambuscade has been observed straddling cybercrime and cyber espionage operations since at least early 2020. "It is a crimeware group that targets bank customers and cryptocurrency traders in various regions, including North America and Europe," ESET said in an...

Abandoned Cart Lite for WooCommerce < 5.15.0 - Authentication Bypass

The plugin does not use adequate cryptographic practices to secure its cart link decoding process, allowing unauthenticated attackers to bypass authentication and login as customers who have abandoned their carts...

CVE-2023-25439

Stored Cross Site Scripting XSS vulnerability in Square Pig FusionInvoice 2023-1.0, allows attackers to execute arbitrary code via the description or content fields to the expenses, tasks, and customer details...

A Zero-Day Vulnerability Found in Barracuda Email Security Gateway

Threat Level Vulnerability Report For a detailed threat advisory, download the pdf file here Summary Zero-day Vulnerability Exploited in Barracuda Email Security Gateway Appliances, Promptly Patched, and a Subset of Customers Notified; Other Barracuda Products are Unaffected. To receive real-time...

Prestashop 8.0.4 CSV Injection

Exploit Title: Prestashop 8.0.4 - CSV injection Application: prestashop Version: 8.0.4 Bugs: CSV Injection Technology: PHP Vendor URL: https://prestashop.com/ Software Link: https://prestashop.com/prestashop-edition-basic/ Date of found: 14.05.2023 Author: Mirabbas Ağalarov Tested on: Windows 2...

PT-2023-22623 · Prestashop · Prestashop Scexportcustomers

Name of the Vulnerable Software and Affected Versions: PrestaShop scexportcustomers versions 3.6.1 and earlier Description: The issue is related to Incorrect Access Control due to a lack of permissions control. This allows a guest to access exports from the module, potentially leading to a leak o...

Video: Everything you need to know about ongoing state-sponsored attacks targeting network infrastructure across the globe

Cisco and Talos are continuing to track and research a series of ongoing cyber attacks and espionage targeting out-of-date and unpatched network hardware. In this video, Hazel Burton interviews Matt Olney and J.J. Cummings from Talos to discuss the "Jaguar Tooth" campaign the U.K. government and...

Tesla Employees Allegedly Shared Customers’ Private Videos and Photos

By Habiba Rashid The use of cameras on Tesla vehicles has come under scrutiny after reports revealed that some employees have… This is a post from HackRead.com Read the original post: Tesla Employees Allegedly Shared Customers Private Videos and Photos...

CVE-2023-0357

Helpy version 2.8.0 allows an unauthenticated remote attacker to exploit an XSS stored in the application. This is possible because the application does not correctly validate the attachments sent by customers in the ticket...

CVE-2023-0265

Uvdesk version 1.1.1 allows an authenticated remote attacker to execute commands on the server. This is possible because the application does not properly validate profile pictures uploaded by customers...

3CX Desktop App Supply Chain Attack Leaves Millions at Risk - Urgent Update on the Way!

3CX said it's working on a software update for its desktop app after multiple cybersecurity vendors sounded the alarm on what appears to be an active supply chain attack that's using digitally signed and rigged installers of the popular voice and video conferencing software to target downstream...

Latitude Financial Data Breach: 14 Million Customers Affected

By Waqas The CEO of Latitude Financial, Ahmed Fahour, has expressed disappointment in the incident and apologized unreservedly to customers. This is a post from HackRead.com Read the original post: Latitude Financial Data Breach: 14 Million Customers Affected...

Stored XSS in name parameter of "Customers Reports"

Description The name parameter of the "Static Routes" functionality is vulnerable to stored XSS. Proof of Concept 1.Login to https://demo.pimcore.fun/admin/. 2.Now go to Marketing - Customers Reports - Add and Enter the name of the new item a-zA-Z-. 3.Then capture the request on the burp suite an...

Multiple Stored XSS in name parameter of "Pricing Rules", "Predefined Properties", "Customers Reports" & "Static Routes"

Description The name parameter of the "Pricing Rules", "Predefined Properties", "Customers Reports" & "Static Routes" functionality is vulnerable to Stored XSS. Proof of Concept 1.Login to https://demo.pimcore.fun/admin/. 2.Now go to Online Shop - Pricing Rules - Add and Enter the name of the new...

CVE-2022-47508

Customers who had configured their polling to occur via Kerberos did not expect NTLM Traffic on their environment, but since we were querying for data via IP address this prevented us from utilizing Kerberos...

SUSE CVE-2015-2906

Mobile Devices aka MDI C4 OBD-II dongles with firmware 2.x and 3.4.x, as used in Metromile Pulse and other products, store SSH private keys that are the same across different customers' installations, which makes it easier for remote attackers to obtain access by leveraging knowledge of a private...

SUSE CVE-2017-16854

In Open Ticket Request System OTRS through 3.3.20, 4 through 4.0.26, 5 through 5.0.24, and 6 through 6.0.1, an attacker who is logged in as a customer can use the ticket search form to disclose internal article information of their customer tickets...

Austrian ‘mobile concierge’ app Gustaffo leaking 100k customers’ data

By Waqas Gustaffo Digital Service GmbH has been leaking personal and contact details of its customers since last month. This is a post from HackRead.com Read the original post: Austrian mobile concierge app Gustaffo leaking 100k customers data...

CVE-2022-3990

HPSFViewer might allow Escalation of Privilege. This potential vulnerability was remediated on July 29th, 2022. Customers who opted for automatic updates should have already received the remediation...

T-Mobile reports data theft of 37 million customers in the US

T-Mobile has announced that an attacker has accessed "limited types of information" on customers. It says it is informing impacted customers. According to the press release, no passwords, payment card information, social security numbers, government ID numbers or other financial account informati...