GHSA-7P8H-86P5-WV3P Cross-site scripting

Two kinds of XSS were found: 1. As mentioned in https://github.com/mongo-express/mongo-express/issues/577 when the content of a cell grows larger than supported size, clicking on a row will show full document unescaped, however this needs admin interaction on cell. 2. Data cells identified as med...

A week in security (June 21 – June 27)

Last week on Malwarebytes Labs: Want to stop ransomware attacks? Send the cybercriminals to jail, says Brian Honan: Lock and Code S02E11 Atomic research institute breached via VPN vulnerability Hotel staff bust Hermes SMS scammer with suspiciously large number of cables City of Liège hit by...

Urban Company: Exposed data of credit card details to hacker or attacker.

NOTE! Thanks for submitting a report! Please replace all the square sections below with the pertinent details. Remember, the more detail you provide, the easier it is for us to verify and then potentially issue a bounty, so be sure to take your time filling out the report! Name of Vulnerability:...

Mercedes-Benz Customer Data Flies Out the Window

Ahh, the luxury of Mercedes-Benz cars: The high-end upholstery, plush carpeting, polished wood trim, LED mood lighting. “Even the scent signals that this vehicle is special,” as the automaker sighs. Of course, even a company like Mercedes-Benz can inadvertently fart out customer data. That’s what...

3 Takeaways From The 2021 VDBIR: It’s An Appandemic

VDBIR Overview “Appandemic” sounds a bit like “appendectomy.” From a societal standpoint, it’s almost as alarming — if not more so — as the surgical procedure is from a personal standpoint. Because in the midst of the global pandemic we’ve all experienced over the past year and a half, web...

Oh FCUK! Fashion Label, Medical Diagnostics Firm Latest REvil Victims

U.K.-based fashion brand French Connection, which advertises under the acronym “FCUK,” confirmed that it has been compromised by ransomware group REvil. Just hours later, Brazilian medical diagnostics firm Grupo Fleury announced it had the same misfortune. The twin attacks reveal shifting...

Code injection

IBM Db2 for Linux, UNIX and Windows includes Db2 Connect Server 9.7, 10.1, 10.5, 11.1, and 11.5 could allow a user who can create a view or inline SQL function to obtain sensitive information when AUTOREVAL is set to DEFFEREDFORCE. IBM X-Force ID: 199283...

Hackers leak 260,000 accounts from Pakistani music streaming site Patari

By Waqas Hackread.com informed Patari of the data breach almost a week ago yet the company did not receive any response whatsoever. This is a post from HackRead.com Read the original post: Hackers leak 260,000 accounts from Pakistani music streaming site Patari...

How to Perform a Zero Trust AWS Assessment with Infection Monkey and ScoutSuite

Take action on issues highlighted in the report to ensure your AWS cloud defenses are protected in a data breach, minimizing impact and data loss...

What is Advanced Persistent Threat (APT) and security measures❓

Advanced persistent threat is a targeted attack against a specific entity, usually a corporation or government agency, that has the goal of obtaining information or access to computer systems. APTs rely on targeted attacks to achieve success. While malware and phishing attacks are not new, the AP...

Mail.ru: informations disclosure(Email,Numbers,Agreements, admin Sessions and more ...) through a PostgreSQL database belongs to (legium-back.corp.mail.ru)

Reported a vulnerability in legium.io cloud service, which is not part of Mail.Ru. legium.io is located outside the Mail.Ru infrastructure and does not have access to our company's product data. According to the rules in this case the service refers to Ext.O Third party project. While legium.io...

Logic Flaw Vulnerability in Water Resources Information System of Siltronic Ltd.

Siltronic Ltd. is an information service provider for disaster reduction and profitability. There is a logic flaw vulnerability in the water information system of Sicron Technology Limited, which can be exploited by an attacker to log in to any account and obtain sensitive information...

Embryology Data Breach Follows Fertility Clinic Ransomware Hit

A fertility clinic serving the Atlanta area has been hit with a ransomware attack that also exposed private health information for 38,000 of its patients. Reproductive Biology Associates RBA, along with its affiliate My Egg Bank North America, is a well-known pioneer in in-vitro fertilization IVF...

Cybersecurity firm exposes 5 billion data breach records

By Habiba Rashid Cybersecurity firm Cognyte fails to secure its database exposing 5 billion records comprise of previous data breaches. This is a post from HackRead.com Read the original post: Cybersecurity firm exposes 5 billion data breach records...

Carnival Cruise Cyber-Torpedoed by Cyberattack

Carnival Corp., the world’s largest cruise-ship operator, has sprung another leak: For the second time in a year, attackers have breached email accounts and accessed personal, financial and health information belonging to guests, employees and crew. Carnival has quite the armada: Its cruise brand...

First American Financial Pays Farcical $500K Fine

In May 2019, KrebsOnSecurity broke the news that the website of mortgage settlement giant First American Financial Corp. NYSE:FAF was leaking more than 800 million documents -- many containing sensitive financial data -- related to real estate transactions dating back 16 years. This week, the U.S...

CVS Health Records for 1.1 Billion Customers Exposed

More than 1 billion records for CVS Health customers were left in the database of a third-party, unnamed vendor – exposed, unprotected, online. Researchers said the data points revealed could be strung together to create an extremely personal snapshot of someones’s medical situation. The glitch i...

5 Tips to Prevent and Mitigate Ransomware Attacks

Ransomware attacks cost companies over $100 billion a year. Making matters worse, the overwhelming majority of ransomware attacks now include a threat to leak stolen data if the ransom isn’t paid, a technique called “double extortion.” Cybercriminals like ransomware because the entry barrier is...

Revil ransomware gang claims breaching US nuclear weapons contractor

By Deeba Ahmed The REvil ransomware gang have said that they will auction the data belonging to Sol Oriens, a US-based nuclear weapons contractor. This is a post from HackRead.com Read the original post: Revil ransomware gang claims breaching US nuclear weapons contractor...

Instagram‌ ‌Bug Allowed Anyone to View Private Accounts Without Following Them

Instagram has patched a new flaw that allowed anyone to view archived posts and stories posted by private accounts without having to follow them. "This bug could have allowed a malicious user to view targeted media on Instagram," security researcher Mayur Fartade said in a Medium post today. "An...