PT-2024-1568 · Unknown +11 · Postgresql +10

Name of the Vulnerable Software and Affected Versions: PostgreSQL versions prior to 16.2 PostgreSQL versions prior to 15.6 PostgreSQL versions prior to 14.11 PostgreSQL versions prior to 13.14 PostgreSQL versions prior to 12.18 Description: The issue is related to a late privilege drop in the...

Design/Logic Flaw

The Advanced Forms for ACF plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the exportjsonfile function in all versions up to, and including, 1.9.3.2. This makes it possible for unauthenticated attackers to export form settings...

A week in security (January 29 – February 4)

Last week on Malwarebytes Labs: CISA: Disconnect vulnerable Ivanti products TODAY FBI removes malware from hundreds of routers across the US "You have blood on your hands." Senate Committee calls for action by social media giants to protect children online Tax season is here, so are scammers Moth...

Former CIA Engineer Sentenced to 40 Years for Leaking Classified Documents

A former software engineer with the U.S. Central Intelligence Agency CIA has been sentenced to 40 years in prison by the Southern District of New York SDNY for transmitting classified documents to WikiLeaks and for possessing child pornographic material. Joshua Adam Schulte, 35, was originally...

Mother of all Breaches may contain NEW breach data

On January 23, 2024, we reported on the discovery of billions of exposed records online, now commonly referred to as the “mother of all breaches” MOAB. Since then, the source of the dataset has been identified as data breach search engine Leak-Lookup. Prevention platform SpyCloud compared the MOA...

PT-2024-1894 · WordPress · Ultimate Member

Name of the Vulnerable Software and Affected Versions: Ultimate Member versions 2.1.3 through 2.8.2 Description: The issue is related to a SQL injection vulnerability in the Ultimate Member plugin for WordPress. This vulnerability can be exploited by unauthenticated attackers to append additional...

Hewlett Packard Enterprise also searched by Cozy Bear

Hewlett Packard Enterprise HPE has disclosed that the state-sponsored actor known as Cozy Bear aka Midnight Blizzard, gained unauthorized access to HPE’s cloud-based email environment. This news comes only days after Microsoft broke very similar news that it got hacked by this same state sponsore...

A week in security (January 22 – January 28)

Last week on Malwarebytes Labs: 10 things to do to improve your online privacy Ring curtails law enforcement’s access to footage Malicious ads for restricted messaging applications target Chinese users Malwarebytes wins every MRG Effitas award for 2 years in a row AI likely to boost ransomware,...

Tech Giant HP Enterprise Hacked by Russian Hackers Linked to DNC Breach

Hackers with links to the Kremlin are suspected to have infiltrated information technology company Hewlett Packard Enterprise's HPE cloud email environment to exfiltrate mailbox data. "The threat actor accessed and exfiltrated data beginning in May 2023 from a small percentage of HPE mailboxes...

MAL-2024-852 Malicious code in wlwz-2312-7507 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 9d9294f70d449bd920d7147923a8647597c10d30f5c8e64fc260f827fe2a4430 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2024-603 Malicious code in wlwz-2312-4801 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware c0d013be48e7b64278808c5e0b8ebb58623605af677a0711bd9626039f6b864e Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2024-440 Malicious code in wlwz-2312-3000 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 0fcf14fd0d80ab5b58044ad2d8faf523f93ab0d0d6500b6a0804284024d9686b Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Jason’s Deli Data Breach Exposes 344,000 Users in Credential Stuffing Attack

By Waqas The data breach occurred a few days before Christmas on December 21, 2023, but the details have only been revealed now. This is a post from HackRead.com Read the original post: Jasons Deli Data Breach Exposes 344,000 Users in Credential Stuffing Attack...

Global Retailer BuyGoods.com Leaks 198GB of Internal and User PII, KYC data

By Waqas Hailing from Wilmington, Delaware BuyGoods.com boasts a user base of 3 million consumers spanning across 17 countries. This is a post from HackRead.com Read the original post: Global Retailer BuyGoods.com Leaks 198GB of Internal and User PII, KYC data...

10 years on from the Target breach. Has building cyber security improved?

It’s over a decade since the Target data breach. It was an event that reinforced the need for supply chain security reviews. It seems that much has changed since then, or has it? Has the security profile of the average connected building in the USA improved in that time period, be it retail,...

The vulnerabilities of the Content Access SDK, Image Export SDK, PDF Export SDK, and HTML Export SDK components of Oracle Outside In Technology’s software development kit (SDK) allow attackers to compromise the confidentiality, integrity, and accessibility of protected information.

The vulnerabilities of the Content Access SDK, Image Export SDK, PDF Export SDK, and HTML Export SDK components of Oracle Outside In Technology’s software development kit SDK exist due to insufficient testing of input data. Exploiting these vulnerabilities can allow attackers to compromise the...

“The mother of all breaches”: 26 billion records found online [Updated]

Security researchers have discovered billions of exposed records online, calling it the "mother of all breaches". However, the dataset doesnt seem to be from one single data breach, but more a compilation of multiple breaches. These sets are often created by data enrichment companies. Data...

Trezor Data Breach Exposes Email and Names of 66,000 Users

By Waqas The latest Trezor data breach places users at risk of phishing scams, potentially leading to the theft of additional login credentials. This is a post from HackRead.com Read the original post: Trezor Data Breach Exposes Email and Names of 66,000 Users...

A week in security (January 15 – January 21)

Last week on Malwarebytes Labs: Google failing to scrub abortion access in location history, study claims Google changes wording for Incognito browsing in Chrome CISA urges urgent patching of two actively exploited Citrix NetScaler vulnerabilities Cybersecurity spend to soar in 2024: How companie...

mylush.net Cross Site Scripting vulnerability OBB-3839476

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...