CVE-2023-21891

...

CVE-2023-21889

CVE-2023-21889 affects Oracle VM VirtualBox (Core). Affected: VirtualBox versions prior to 6.1.42 and prior to 7.0.6. Exploitation requires local access (logon) to the infrastructure where VirtualBox runs. Impact: unauthorized read access to a subset of VirtualBox data. No details on root cause b...

CVE-2023-21859

The CVE-2023-21859 entry concerns Oracle Access Manager (Authentication Engine) in Oracle Fusion Middleware. Affected version: 12.2.1.4.0. Root cause described as insufficient input validation in the Authentication Engine, enabling a high-privilege attacker with logon on the infrastructure to com...

CVE-2023-21839

CVE-2023-21839 affects Oracle WebLogic Server (core) versions 12.2.1.3.0, 12.2.1.4.0, and 14.1.1.0.0. It is exploitable via unauthenticated network access over T3/IIOP and relates to post-deserialization of a ForeignOpaqueReference object, enabling remote code execution as the oracle user. Multip...

"Untraceable" surveillance firm sued for scraping Facebook and Instagram data

Days after Meta achieved victory after suing the NSO Group for Computer Fraud and Abuse Act charges, Meta filed a lawsuit against surveillance company Voyager Labs for violations of its Terms and Policies and California law. According to court documents, Voyager Labs created 38,000 fake accounts ...

Is the FSI innovation rush leaving your data and application security controls behind?

Fuelled by rising consumer expectations for innovative services and easy real-time access to financial products and information, financial services industries FSI and fintech organizations are racing to out-innovate each other and capture market share. The sizeable growth of investments into the...

Malware Attack on CircleCI Engineer's Laptop Leads to Recent Security Incident

DevOps platform CircleCI on Friday disclosed that unidentified threat actors compromised an employee's laptop and leveraged malware to steal their two-factor authentication-backed credentials to breach the company's systems and data last month. The CI/CD service CircleCI said the "sophisticated...

Threat Source newsletter (Jan. 12, 2023): Did ChatGPT write our newsletter?

Welcome to this weeks edition of the Threat Source newsletter. We tried to get ChatGPT to write this weeks newsletter but it was at capacity, so youll have to stick with us for another week. Or maybe thats just what the robots want you to think, you be the judge. The one big thing This week Talos...

Twitter Denies Hacking Claims, Assures Leaked User Data Not from its System

Twitter on Wednesday said that its investigation found "no evidence" that users' data sold online was obtained by exploiting any security vulnerabilities in its systems. "Based on information and intel analyzed to investigate the issue, there is no evidence that the data being sold online was...

Twitter Scraping Breach: 209 Million Accounts Leaked on Hacker Forum

By Waqas The data was collected through web scraping techniques however some sites are reporting it as a "Twitter data breach," or " Twitter being hacked." This is a post from HackRead.com Read the original post: Twitter Scraping Breach: 209 Million Accounts Leaked on Hacker Forum...

BitRAT Now Sharing Sensitive Bank Data as a Lure

Introduction In June of 2022 Qualys Threat Research Unit TRU wrote an in-depth report on Redline, a commercial off the shelf infostealer that spreads via fake cracked software hosted on Discord’s content delivery network. Since then, we have continued to track similar threats to identify their...

LastPass Data Breach: It’s Time to Ditch This Password Manager

The password manager’s most recent data breach is so concerning, users need to take immediate steps to protect themselves...

Online Casinos DraftKings and BetMGM Hacked; Data of Millions at Risk

By Waqas In BetMGM's case, hackers are selling data of 1.57 million customers, while data of 68,000 DraftKings customers is also up for grabs. This is a post from HackRead.com Read the original post: Online Casinos DraftKings and BetMGM Hacked; Data of Millions at Risk...

LastPass Admits to Severe Data Breach, Encrypted Password Vaults Stolen

The August 2022 security breach of LastPass may have been more severe than previously disclosed by the company. The popular password management service on Thursday revealed that malicious actors obtained a trove of personal information belonging to its customers that include their encrypted...

Millions of Gemini cryptocurrency exchange user details leaked

If youre a user of the Gemini cryptocurrency exchange, its time to be on your guard against phishing attacks. Gemini says its own systems have not been compromised, but an unnamed third party has become the focal point for a breach. On December 13 or some point before, rogues gained access to jus...

The Equifax Breach Settlement Offer is Real, For Now

Millions of people likely just received an email or snail mail notice saying theyre eligible to claim a class action payment in connection with the 2017 megabreach at consumer credit bureau Equifax. Given the high volume of reader inquiries about this, it seemed worth pointing out that while this...

Restaurant platform SevenRooms confirms data breach

SevenRooms, a "guest experience and retention platform" for food establishments and hospitality organisations, has confirmed it has fallen victim to a third party vendor data breach. Mostly known for its customer management platform, Seven Rooms' breach came to light after stolen data was seen fo...

Do more with less with Microsoft Security—3 strategies to get you started

Relentless bad actors, evolving attack tactics, and numerous surfaces and endpoints that attackers may try to exploit. With the average cost of a data breach reaching an all-time high of USD4.35 million in 2022,1 protecting your people and data from adversaries is more important than ever. Plus,...

LinkedIn: Entire database of emails exposed through URN injection

The entire database of LinkedIn emails was exposed due to a vulnerability in the decoration feature of the Voyager API. An attacker could assign an URN value to a text field inside a profile and trigger a URN resolution to retrieve the email. The query engine did not check whether a field should ...

Uber data stolen via third-party vendor

Uber is facing a new cybersecurity incident after threat actors stole some of its data from Teqtivity, a third-party vendor that provides asset management and tracking services. "We are aware of customer data that was compromised due to unauthorized access to our systems by a malicious third...