Microsoft Mitigates RCE Vulnerability Affecting Azure Synapse and Data Factory

Microsoft on Monday disclosed that it mitigated a security flaw affecting Azure Synapse and Azure Data Factory that, if successfully exploited, could result in remote code execution. The vulnerability, tracked as CVE-2022-29972, has been codenamed "SynLapse" by researchers from Orca Security, who...

Costa Rica continues defence against sustained Conti ransomware attacks

Its not been plain sailing recently for Conti ransomware, the Ransomware as a Service RaaS group with several major attacks under its belt. In August last year, a pen tester leaked valuable manuals and documents related to the operation. These leaks continued as the Conti gang expressed support f...

Thousands of Borrowers' Data Exposed from ENCollect Debt Collection Service

An ElasticSearch server instance that was left open on the Internet without a password contained sensitive financial information about loans from Indian and African financial services. The leak, which was discovered by researchers from information security company UpGuard, amounted to 5.8GB and...

US healthcare billing services group hacked, affecting at least half a million individuals

According to the US Department of Health and Human Services, Adaptive Health Integrations AHI, a healthcare software and billing services firm in North Dakota, suffered a data breach that affected more than half a million individuals. According to the firm, the breach occurred in mid-October last...

CVE-2021-25002

CVE-2021-25002 affects the Tipsacarrier WordPress plugin prior to 1.5.0.5. The vulnerability is due to missing authorization checks in certain functions, allowing unauthenticated users to access orders data and potentially retrieve customer PII (full address, name, phone) via a tracking URL. Affe...

Data Protection as the Foundation of Trust: Celebrating Privacy Awareness Week in APAC

As part of our mission to help organisations protect their data and all paths to it, Imperva is supporting Privacy Awareness Week in Australia and Singapore, with the aim of educating individuals and organisations about the importance of data privacy and protection. In today’s digital economy, da...

CVE-2022-1534 Buffer Over-read at parse_rawml.c:1416 in bfabiszewski/libmobi

Buffer Over-read at parserawml.c:1416 in GitHub repository bfabiszewski/libmobi prior to 0.11. The bug causes the program reads data past the end of the intented buffer. Typically, this can allow attackers to read sensitive information from other memory locations or cause a crash...

US and China Exposed Most Databases Among 308,000 Discovered in 2021

By Waqas In total, 308,000 unsecured databases were found exposing sensitive assets worldwide of which around 90,000 databases have already… This is a post from HackRead.com Read the original post: US and China Exposed Most Databases Among 308,000 Discovered in 2021...

Attacker Breach ‘Dozens’ of GitHub Repos Using Stolen OAuth Tokens

GitHub revealed details tied to last week’s incident where hackers, using stolen OAuth tokens, downloaded data from private repositories. “We do not believe the attacker obtained these tokens via a compromise of GitHub or its systems because the tokens in question are not stored by GitHub in thei...

CVE-2021-29776

Summary (CVE-2021-29776) IBM QRadar SIEM versions 7.3.3 FP10, 7.4.3 FP4, and 7.5.0 GA are affected. An authenticated user could obtain sensitive information from another user’s dashboard by supplying that user’s dashboard ID. The issue is a user-access leakage across dashboards, enabling exposure...

Hospitals taken offline after cyberattack

The GHT Coeur Grand Est has become a victim of a cyberattack on the hospital centers of Vitry-le-François and Saint-Dizier. The hospital’s administration has warned French that data have been exfiltrated and might be used for phishing in the future. As a consequence, the GHT Cœur Grand Est has cu...

Heap overflow

Heap-based Buffer Overflow in GitHub repository radareorg/radare2 prior to 5.7.0. The bug causes the program reads data past the end of the intented buffer. Typically, this can allow attackers to read sensitive information from other memory locations or cause a crash...

Leaked Chats Show LAPSUS$ Stole T-Mobile Source Code

KrebsOnSecurity recently reviewed a copy of the private chat messages between members of the LAPSUS$ cybercrime group in the week leading up to the arrest of its most active members last month. The logs show LAPSUS$ breached T-Mobile multiple times in March, stealing source code for a range of...

ZOHO ManageEngine OpManager SQL Injection Vulnerability (CNVD-2022-70603)

ZOHO ManageEngine OpManager is a comprehensive network monitoring software from ZOHO USA. A SQL injection vulnerability exists in versions prior to ZOHO ManageEngine OpManager 125588 and 125603, which stems from a problem in the inventory reporting module. An attacker could use this vulnerability...

Design/Logic Flaw

Vulnerability in the Oracle Transportation Management product of Oracle Supply Chain component: User Interface. Supported versions that are affected are 6.4.3 and 6.5.1. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Transportati...

CVE-2022-21467

CVE-2022-21467 affects Oracle Agile PLM (Attachments) in Oracle Supply Chain; vulnerable component/version: Attachments in Oracle Agile PLM 9.3.6. Root cause described as an input/validation issue allowing a low-privileged attacker with network access over HTTP to compromise Oracle Agile PLM, pot...

CVE-2022-21447

CVE-2022-21447 affects Oracle PeopleSoft Enterprise CS Academic Advisement (component: Advising Notes) in version 9.2. The vulnerability is an information disclosure that can be accessed over the network via HTTP by a low-privileged attacker, potentially exposing critical data across the affected...

CVE-2022-27863

The CVE targets WordPress VikBooking Hotel Booking Engine & PMS plugin

Protect Your Executives’ Cybersecurity Amidst Global Cyberwar

It’s been roughly two months since Russia first launched its unprovoked invasion of Ukraine. Since then, the world has borne witness to unspeakable tragedy. While damaged and destroyed property can and will be rebuilt; the death and despair incurred by Ukrainians will leave a lasting imprint acro...

GitHub Notifies Victims Whose Private Data Was Accessed Using OAuth Tokens

GitHub on Monday noted that it had notified all victims of an attack campaign, which involved an unauthorized party downloading private repository contents by taking advantage of third-party OAuth user tokens maintained by Heroku and Travis CI. "Customers should also continue to monitor Heroku an...