CVE-2019-2450

CVE-2019-2450 affects Oracle VM VirtualBox (Core) with affected versions prior to 5.2.24 and prior to 6.0.2. The issue is exploitable by a low-privilege user that can log on to the infrastructure where VirtualBox runs, potentially leading to unauthorized access to data or complete access to data ...

CVE-2019-2400

CVE-2019-2400 affects Oracle E-Business Suite, specifically the Oracle iStore User Registration subcomponent. Affected versions include 12.1.1–12.2.8. The vulnerability is exploitable by an unauthenticated attacker who can reach Oracle iStore over HTTP; however, user interaction is required for e...

CVE-2019-2446

CVE-2019-2446 affects Oracle VM VirtualBox (Core) with vulnerable OpenGL/guest-VM handling prior to 5.2.24 and prior to 6.0.2. Exploitation could allow a low-privileged user with logon to the host infrastructure to access or compromise data within VirtualBox. Public advisories from OpenSUSE/Magei...

CVE-2019-2401

CVE-2019-2401 affects Oracle Hospitality Reporting and Analytics in Oracle Food and Beverage Applications (affected version 9.1.0). The vulnerability allows a low-privileged admin with network access via HTTP to compromise data, enabling unauthorized creation, deletion, or modification of critica...

CVE-2019-2487

CVE-2019-2487 affects Oracle Transportation Management inside Oracle Supply Chain Products Suite, subcomponent UI Infrastructure. The vulnerability is applicable to supported versions 6.3.7, 6.4.1, 6.4.2 and 6.4.3. It enables a low-privilege, network-accessible attacker (via HTTP) to compromise O...

VOIPO Database Exposes Millions of Texts, Call Logs

UPDATE An improperly secured database owned by a California voice-over-internet provider left millions of customer call logs, SMS message logs and credentials in plain text open for months for the taking. The database belongs to VOIPO, which provides mobile services for consumers and commercial...

Data Breach Roundup: U.S. Healthcare, Cryptopia, SingHealth and Experian

Millions of people were affected by data breaches in 2018, and 2019 shows no signs of waning activity. The latest round of breaches as of Tuesday includes an attack on a managed-health provider in Indiana, an offensive against a rehab and wellness center in Michigan, millions in purloined funds a...

CVE-2019-0018

The CVE-2019-0018 entry documents a persistent cross-site scripting (XSS) vulnerability in the file upload menu of Juniper ATP, affecting Juniper ATP 5.0 versions prior to 5.0.3. The issue allows an authenticated attacker to inject arbitrary scripts and potentially steal sensitive data or credent...

Live Call Support Widget 1.5 - Remote Code Execution / SQL Injection

Exploit Title: Live Call Support 1.5 - Remote Code Execution / SQL Injection Dork: N/A Date: 2019-01-13 Exploit Author: Ihsan Sencan Vendor Homepage: http://ranksol.com/ Software Link: https://codecanyon.net/item/live-call-support-widget-software-online-calling-web-application/22532799 Version: 1...

Hyatt Hotels: Hyatt WeChat Secret, Baidu AK Secret, and mysql db credentials inadvertantly made publicly available

This one is slightly odd, so I've rated it a low, as I'm not able to confirm whether or not these are active creds/secrets it's late and I don't speak/read Chinese. During recon for hyatt.com, I stumbled across this github.com repo that seems to be for hyatt's wechat setup:...

This Week in Security News: Adware and Ransomware

Welcome to our weekly roundup, where we share what you need to know about the cybersecurity news and events that happened over the past few days. This week, learn about an adware that disguised itself as different apps and monitors mobile devices. Also, learn more about the different ransomware...

Over 202 Million Chinese Job Seekers' Details Exposed On the Internet

Cybersecurity researcher has discovered online a massive database containing records of more than 202 million Chinese citizens that remained accessible to anyone on the Internet without authentication until last week. The unprotected 854.8 gigabytes of the database was stored in an instance of...

Over 202 Million Chinese Job Seekers' Details Exposed On the Internet

Cybersecurity researcher has discovered online a massive database containing records of more than 202 million Chinese citizens that remained accessible to anyone on the Internet without authentication until last week. The unprotected 854.8 gigabytes of the database was stored in an instance of...

Town of Salem data breach: Personal data of 7.6M gamers stolen

By Uzair Amir Over 7.6 million players have been impacted by a massive data breach suffered by the well-known browser-based role-playing game “Town of Salem.” BlankMediaGames, the owner of the game, has confirmed on its online forum that the breach did occur. A copy of the compromised database fr...

Town of Salem Data Breach Exposes 7.6 Million Gamers' Accounts

A massive data breach at the popular online role-playing game 'Town of Salem' has reportedly impacted more than 7.6 million players, the game owner BlankMediaGames BMG confirmed Wednesday on its online forum. With the user base of more than 8 million players, Town of Salem is a browser-based game...

Town of Salem Data Breach Exposes 7.6 Million Gamers' Accounts

A massive data breach at the popular online role-playing game 'Town of Salem' has reportedly impacted more than 7.6 million players, the game owner BlankMediaGames BMG confirmed Wednesday on its online forum. With the user base of more than 8 million players, Town of Salem is a browser-based game...

Marriott Revises Breach Scope to 383M Records

Marriott has revised downward its estimate on the number of guests whose passport numbers and payment card data were impacted in its recent data breach. After the hospitality giant confirmed in November that there had been unauthorized access to its Starwood guest reservations database from 2014 ...

Wide-Ranging German Doxxing Incident Hits Hundreds of Politicians

Hundreds of German politicians, including Chancellor Angela Merkel, have been doxxed in a puzzling incident, with their private information and political documents dumped online. At least one local reporter is claiming the information is explosive. According to a report from German public...

Hackers steal credit card data of 14,579 BevMo customers

By Uzair Amir A warning has been issued by the Concord, California-based alcoholic beverages retailer BevMo informing its customers about a data breach that its online store experienced between 2 August and 26 September. During the attack, credit card data of its customers was exposed. “BevMo tak...

Hackers steal personal details of 1,000 North Korean Defectors

By Uzair Amir The data breach against North Korean Defectors came after hackers targeted computer at Resettling agency. Private data of approx. 1,000 North Korean Defectors present in the South have been exposed in a data breach which makes them vulnerable to all sorts of threats from the North,...