Online Thesis Archiving System v1.0 - Multiple-SQLi

Exploit Title: Online Thesis Archiving System v1.0 - Multiple-SQLi Author: nu11secur1ty Date: 06.12.2023 Vendor: https://github.com/oretnom23 Software: https://www.sourcecodester.com/php/15083/online-thesis-archiving-system-using-phpoop-free-source-code.html Reference:...

Password Reset Hack Exposed in Honda's E-Commerce Platform, Dealers Data at Risk

Security vulnerabilities discovered in Honda's e-commerce platform could have been exploited to gain unrestricted access to sensitive dealer information. "Broken/missing access controls made it possible to access all data on the platform, even when logged in as a test account," security researche...

Improper access control

Incorrect access control in Chamilo 1.11. up to 1.11.18 allows a student subscribed to a given course to download documents belonging to another student if they know the document's ID...

CVE-2023-3126

The CVE-2023-3126 entry concerns the WordPress plugin B2BKing . A missing capability check in the function b2bkingdownloadpricelist (affected versions: up to and including 4.6.00) allows authenticated users with subscriber/customer-level permissions to retrieve the site’s full product pricing lis...

Play ransomware gang compromises Spanish bank, threatens to leak files

Ransomware is creating additional work for a major Spanish bank. Globalcaja, said to have more than 300 offices in Spain and close to half a million customers, has fallen victim to the Play ransomware gang. The gang claim to have swiped both private and personal information in the attack--includi...

Scrubs & Beyond Leaks 400GB of User PII and Card Data in Plain Text

By Waqas Scrubs & Beyond were alerted multiple times about the data leak, but the company did not respond or secure the server. This is a post from HackRead.com Read the original post: Scrubs & Beyond Leaks 400GB of User PII and Card Data in Plain Text...

Cloud Security Tops Concerns for Cybersecurity Leaders: EC-Council's Certified CISO Hall of Fame Report 2023

A survey of global cybersecurity leaders through the 2023 Certified CISO Hall of Fame Report commissioned by the EC-Council identified 4 primary areas of grave concern: cloud security, data security, security governance, and lack of cybersecurity talent. EC-Council, the global leader in...

Data Breach at MCNA Dental Insurer Impacts 9 Million Users

By Habiba Rashid The hackers managed to steal highly sensitive data in the data breach, including Social Security numbers, names, addresses, phone numbers, email addresses, and more. This is a post from HackRead.com Read the original post: Data Breach at MCNA Dental Insurer Impacts 9 Million User...

Severe Flaw in Google Cloud's Cloud SQL Service Exposed Confidential Data

A new security flaw has been disclosed in the Google Cloud Platform's GCP Cloud SQL service that could be potentially exploited to obtain access to confidential data. "The vulnerability could have enabled a malicious actor to escalate from a basic Cloud SQL user to a full-fledged sysadmin on a...

Apria Healthcare Discloses Major Data Breach Impacting 1.8M Users

By Habiba Rashid The breach spanned two periods: from 5th April to 7th May 2019, and from 27th August to 10th October 2021. This is a post from HackRead.com Read the original post: Apria Healthcare Discloses Major Data Breach Impacting 1.8M Users...

CVE-2023-2703

The CVE-2023-2703 entry describes a private-information exposure in Finex Media Competition Management System prior to version 23.07, allowing an unauthorized actor to retrieve embedded sensitive data and collect data provided by users. Affected product: Finex Media Competition Management System ...

LeadPro CRM v1.0 - SQL Injection

Exploit Title: LeadPro CRM v1.0 - SQL Injection Date: 2023-05-17 Exploit Author: Ahmet Ümit BAYRAM Vendor: https://codecanyon.net/item/leadifly-lead-call-center-crm/43485578 Demo Site: https://demo.leadifly.in Tested on: Kali Linux CVE: N/A Request GET...

Teen Charged in DraftKings Data Breach

By Waqas If convicted, the alleged culprit Joseph Garrison could face a maximum sentence of 57 years. This is a post from HackRead.com Read the original post: Teen Charged in DraftKings Data Breach...

CVE-2023-28045

Dell CloudIQ Collector version 1.10.2 contains a missing encryption of sensitive data vulnerability. An attacker with low privileges could potentially exploit this vulnerability, leading to gain access to unauthorized data...

How to Reduce Exposure on the Manufacturing Attack Surface

Digitalization initiatives are connecting once-isolated Operational Technology OT environments with their Information Technology IT counterparts. This digital transformation of the factory floor has accelerated the connection of machinery to digital systems and data. Computer systems for managing...

PharMerica breach impacts almost 6 million people

US pharmacy giant PharMerica has notified over 5.8 million people about a security incident in which it says personal information and medical information may have been obtained by cybercriminals. The Data Breach Notification lists the total number of persons affected as 5,815,591. An investigatio...

The vulnerability of the nf_tables_commit() function in the kernel’s net/netfilter/nf_tables_api.c file in the Linux operating system allows a attacker to compromise data confidentiality, integrity, and accessibility, or to enhance their privileges within the system and execute arbitrary code.

The vulnerability of the nftablescommit function in the net/netfilter/nftablesapi.c module of the Linux operating system is related to improper deletion of lists. Exploiting this vulnerability can allow an attacker to compromise data confidentiality, integrity, and accessibility, or enhance their...

Debt Collection Firm Credit Control Corporation Hit by Major Data Breach

By Habiba Rashid Credit Control Corporation CCC is a Newport News, Virginia based debt collection firm. This is a post from HackRead.com Read the original post: Debt Collection Firm Credit Control Corporation Hit by Major Data Breach...

U.S. Dept Of Defense: Docker Registry without authentication leads to docker images download

An exposed Docker Registry HTTP API allowed attackers to download Docker images and potentially access confidential source code without authentication. The vulnerability was caused by a lack of access control on the registry and could have been mitigated by implementing proper access controls or...

Aruba Networks EdgeConnect 安全漏洞

Aruba Networks EdgeConnect is an edge connectivity management platform from Aruba Networks, USA. A security vulnerability exists in Aruba Networks EdgeConnect Enterprise. An attacker exploited the vulnerability to cause a data breach...