GE CARESCAPE, ApexPro, and Clinical Information Center systems

1. EXECUTIVE SUMMARY CVSS v3 10.0 ATTENTION: Exploitable remotely/low skill level to exploit Vendor: GE Equipment: CARESCAPE Telemetry Server, ApexPro Telemetry Server, CARESCAPE Central Station CSCS and Clinical Information Center CIC systems, CARESCAPE B450, B650, B850 Monitors Vulnerabilities:...

Saudi Prince Allegedly Hacked World's Richest Man Jeff Bezos Using WhatsApp

The iPhone of Amazon founder Jeff Bezos, the world's richest man, was reportedly hacked in May 2018 after receiving a WhatsApp message from the personal account of Saudi crown prince Mohammed bin Salman, the Guardian newspaper revealed today. Citing unnamed sources familiar with digital forensic...

Download: The State of Security Breach Protection 2020 Survey Results

What are the key considerations security decision-makers should take into account when designing their 2020 breach protection? To answer this, we polled 1,536 cybersecurity professionals in The State of Breach Protection 2020 survey Download the full survey here to understand the common practices...

Razer: [SSRF] Server-Side Request Forgery at https://sea-web.gold.razer.com/dev/simulator via notify_url Parameter

The tester discovered an SSRF that could have allowed the compromise of the web.gold.razer.com server, leading to a significant data breach. Razer thanks the tester for the excellent report...

Business in the front, party in the back: backdoors in elastic servers expose private data

It seems like every day we read another article about a data breach or leak of cloud storage exposing millions of users' data. The unfortunate truth is that the majority of these leaks require no actual "hacking" on the part of the attacker. Most of the time, this highly confidential data is just...

Baby pics, videos & location data from Peekaboo Moments app leaked online

By Sudais Thousands of families using the Peekaboo Moments app have been affected. Here's what happened... This is a post from HackRead.com Read the original post: Baby pics, videos & location data from Peekaboo Moments app leaked online...

Equifax Settles Class-Action Breach Lawsuit for $380.5M

A Georgia court granted final approval for an Equifax settlement in a class-action lawsuit, after the credit-reporting agency was hit by its massive 2017 data breach. Equifax will pay $380.5 million to settle lawsuits regarding the 2017 data breach, the Atlanta federal judge reportedly ruled this...

CVE-2020-2718

Vulnerability in the Oracle Banking Corporate Lending product of Oracle Financial Services Applications component: Core. Supported versions that are affected are 12.3.0-12.4.0 and 14.0.0-14.3.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to...

CVE-2020-2629

Vulnerability in the Enterprise Manager Base Platform product of Oracle Enterprise Manager component: Extensibility Framework. Supported versions that are affected are 12.1.0.5, 13.2.0.0 and 13.3.0.0. Easily exploitable vulnerability allows high privileged attacker with network access via HTTP to...

CVE-2020-2624

Vulnerability in the Enterprise Manager Base Platform product of Oracle Enterprise Manager component: Connector Framework. Supported versions that are affected are 12.1.0.5, 13.2.0.0 and 13.3.0.0. Easily exploitable vulnerability allows high privileged attacker with network access via HTTP to...

CVE-2020-2616

Vulnerability in the Enterprise Manager Base Platform product of Oracle Enterprise Manager component: Enterprise Manager Repository. Supported versions that are affected are 12.1.0.5, 13.2.0.0 and 13.3.0.0. Easily exploitable vulnerability allows high privileged attacker with network access via...

Buffer overflow

Vulnerability in the Oracle Retail Customer Management and Segmentation Foundation product of Oracle Retail Applications component: Security. The supported version that is affected is 18.0. Easily exploitable vulnerability allows high privileged attacker with network access via HTTP to compromise...

Design/Logic Flaw

Vulnerability in the Oracle FLEXCUBE Investor Servicing product of Oracle Financial Services Applications component: Infrastructure. Supported versions that are affected are 12.1.0-12.4.0 and 14.0.0-14.1.0. Easily exploitable vulnerability allows low privileged attacker with network access via HT...

How to implement Multi-Factor Authentication (MFA)

Another day, another data breach. If the regular drumbeat of leaked and phished accounts hasn't persuaded you to switch to Multi-Factor Authentication MFA already, maybe the usual January rush of 'back to work' password reset requests is making you reconsider. When such an effective option for...

CVE-2020-2705

CVE-2020-2705 affects Oracle VM VirtualBox (Core) on multiple lines: vulnerable versions include Oracle VM VirtualBox prior to 5.2.36, 6.0.x prior to 6.0.16, and 6.1.x prior to 6.1.2. The advisory notes an easily exploitable vulnerability that lets a low-privilege, logon-allowed attacker compromi...

CVE-2020-2693

CVE-2020-2693 concerns Oracle VM VirtualBox (Core) with affected versions prior to 5.2.36, 6.0.16 and 6.1.2. The vulnerability is characterized as difficult to exploit but can allow a high-privilege attacker with local logon to compromise VirtualBox and potentially access or exfiltrate data acros...

CVE-2020-2668

CVE-2020-2668 affects Oracle iSupport (Oracle E-Business Suite) with affected versions 12.1.1–12.1.3 and 12.2.3–12.2.9. The issue allows an unauthenticated attacker with network access over HTTPS to compromise iSupport, with human interaction required. Vulnerability results in potential unauthori...

CVE-2020-2671

CVE-2020-2671 affects Oracle E-Business Suite, Oracle Email Center (Message Display) in versions 12.1.1–12.1.3 and 12.2.3–12.2.9. Root cause enables unauthenticated network access via HTTPS to Oracle Email Center, with user interaction required, potentially leading to unauthorized access to sensi...

CVE-2020-2675

CVE-2020-2675 affects Oracle Hospitality OPERA 5 (Oracle Hospitality Applications), specifically the Login component. Affected version is 5.5. The vulnerability allows a low-privilege, network-accessible (HTTP) attacker to compromise OPERA 5, potentially gaining unauthorized access to critical da...

CVE-2020-2649

The CVE-2020-2649 entry concerns Oracle Retail Customer Management and Segmentation Foundation (Internal Operations) v16.0. The vulnerability is described as allowing a low-privilege attacker with logon to the hosting infrastructure to read a subset of data from the Foundation. Affected component...