Lock down your Neopets account: Data breach being investigated

Bad news for players of long-time virtual pet management title Neopets. Word is spreading of a compromise claimed to have accessed around 69 million user accounts. This compromise, posted to a hacking forum, is said to include both the database and around 460 MB of compressed source code from...

Neopets Suffers Second Data Breach as 69 Million Accounts are Stolen

By Waqas Neopets has acknowledged the data breach and currently urging users to change their passwords immediately. Neopets is a… This is a post from HackRead.com Read the original post: Neopets Suffers Second Data Breach as 69 Million Accounts are Stolen...

MAL-2022-5418 Malicious code in portail-web (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 28af909b137497bda660ba3ccc4b18280ee50ca9c9193484047675e6b4243c18 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Oracle Enterprise Manager Base Platform Input Validation Error Vulnerability

Oracle Enterprise Manager Base Platform is a set of local management platform of Oracle Oracle. The platform is primarily used to manage Oracle product deployments. An input validation error vulnerability exists in Oracle Enterprise Manager Base Platform component: Enterprise Manager Install...

Unspecified Vulnerability in Oracle Commerce

Oracle Commerce is the United States Oracle Oracle company's set of e-business solutions. Commerce Platform is one of them to provide a multi-functional e-business platform components. Oracle Commerce has a security vulnerability that can be exploited by an attacker to cause unauthorized access t...

CVE-2022-21579

CVE-2022-21579 affects Oracle FLEXCUBE Universal Banking (Infrastructure) with affected versions 12.1–12.4, 14.0–14.3 and 14.5. The issue is exploitable by a low-privilege attacker over HTTP with network access, requiring user interaction; impact includes unauthorized creation/deletion/modificati...

CVE-2022-21555

CVE-2022-21555 affects MySQL Shell for VS Code (Shell: GUI) with affected versions 1.1.8 and earlier. The connected IBM Security Guardium bulletin lists the CVE-2022-21555 entry among several Oracle MySQL vulnerabilities and describes the impact as low confidentiality, low integrity, and no avail...

CVE-2022-21521

CVE-2022-21521 affects Oracle PeopleSoft Enterprise PeopleTools (XML Publisher) with vulnerable versions 8.58 and 8.59. The issue allows a high-privilege attacker with network access over HTTP to compromi­se PeopleSoft Enterprise PeopleTools and potentially access all data. Public sources cite a ...

Authentication Risks Discovered in Okta Platform

Researchers at Authomize have discovered four “high impact” security risks in the identity and access management IAM platform Okta, according to a Tuesday report. The risks include cleartext password leakage via SCIM – the System for Cross-domain Identity Management – sharing of passwords and oth...

A week in security (July 11 – July 17)

Last week on Malwarebytes Labs: Elden Ring maker Bandai Namco hit by ransomware and data leaks Predatory Sparrow massively disrupts steel factories while keeping workers safe New variant of Android SpyJoker malware removed from Play Store after 3 million+ installs China’s Tonto Team increases...

Orange Station 1.0 SQL Injection

Title: Orange Station 1.0 SQLi Author: nu11secur1ty Date: 0.16.2022 Vendor: https://www.mayurik.com/ Software: https://www.sourcecodester.com/php/15485/garage-management-system-using-phpmysql-source-code.html Reference:...

Threat Source newsletter (July 14, 2022) — Are virtual IDs worth the security risk of saving a few seconds in the TSA line?

By Jon Munshaw. Welcome to this week’s edition of the Threat Source newsletter. I’ve started flying again on a somewhat regular basis now that work conferences and out-of-state vacations are becoming a thing again. I took about 18 months or so off flying during the peak of the pandemic, but now...

Targeted attack on Government Agencies

Targeted Attack on Government Agencies By Sushant Kumar Arya, Mohsin Dalla · July 13, 2022 Executive summary The Trellix Email Security Research Team has discovered a malicious campaign targeting government agencies of Afghanistan, India, Italy, Poland, and the United States since 2021. The attac...

CVE-2022-31134

The CVE concerns Zulip Server exports: versions 2.1.0 and above expose a public data export that administrators can generate. The export incorrectly includes attachment contents from private messages and private streams, despite access controls. Root cause is a flaw in the public-export flow that...

Insecure password leads to Mangatoon data breach

The hugely popular Manga comics platform Mangatoon has fallen victim to a data breach. No fewer than 23 million user accounts could be at risk, thanks to a poorly secured database. Worse still, Mangatoon doesnt seem to be responding to messages from the breacher, or people notifying it that the...

CVE-2022-33138

A vulnerability has been identified in SIMATIC MV540 H All versions V3.3, SIMATIC MV540 S All versions V3.3, SIMATIC MV550 H All versions V3.3, SIMATIC MV550 S All versions V3.3, SIMATIC MV560 U All versions V3.3, SIMATIC MV560 X All versions V3.3. Affected devices do not perform authentication f...

CVE-2022-29512

CVE-2022-29512 affects Cybozu Garoon 4.0.0–5.9.1. The issue is an information disclosure where a remote authenticated attacker may obtain data without the viewing privilege, through an exposure in multiple Garoon applications. Root cause details indicate improper handling that allows exporting or...

4 ways businesses can save money on cyber insurance

So, your business has just suffered a data breach and it’s time to dig deep in your pockets to pay all the resulting expenses. Without cyber insurance, you can expect to pay a dizzying amount of cash. In 2022 alone, the average cost of a data breach for businesses under 1,000 employees was close ...

MAL-2022-6376 Malicious code in swiper-bundie (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware b5e1b659b47e3a72ea3f7e5f575acb49c0035c7a26095e57423c15e594d0161d Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Human Error Blamed for Leak of 1 Billion Records of Chinese Citizens

A prominent Chinese tech CEO has cited human error as the likely reason hackers got their hands on the personal data of 1 billion people in China from a Shanghai police database and then put some of it up for sale on illicit online markets. A government developer wrote a blog post on the China...