4666 matches found
911 Proxy Service Implodes After Disclosing Breach
The 911 service as it existed until July 28, 2022. 911.re, a proxy service that since 2015 has sold access to hundreds of thousands of Microsoft Windows computers daily, announced this week that it is shutting down in the wake of a data breach that destroyed key components of its business...
To settle with the DoJ, Uber must confess to a cover-up. And it did.
Uber covered up the 2016 data breach that affected its 57 million customers and drivers. The confession came as part of the settlement between the DOJ US Department of Justice and the taxi company, which will see it avoid criminal prosecution. In a press release from the DOJ, Uber "admits that it...
CVE-2022-36999
An issue was discovered in Veritas NetBackup 8.1.x through 8.1.2, 8.2, 8.3.x through 8.3.0.2, 9.x through 9.0.0.1, and 9.1.x through 9.1.0.1 and related NetBackup products. Under certain conditions, an attacker with authenticated access to a NetBackup Client could remotely read files on a NetBack...
To Maze and Beyond: How the Ransomware Double Extortion Space Has Evolved
We're here with the final installment in our Pain Points: Ransomware Data Disclosure Trends report blog series, and today we're looking at a unique aspect of the report that clarifies not just what ransomware actors choose to disclose, but who discloses what, and how the ransomware landscape has...
T-Mobile agrees to pay customers $350 million in settlement over data breach
T-Mobile has agreed to pay $350 million to settle class action claims related to a 2021 cyberattack which impacted around 80 million US residents. Under the proposed settlement, T-Mobile would also commit to an aggregate incremental spend of $150 million for data security and related technology i...
A Retrospective on the 2015 Ashley Madison Breach
Its been seven years since the online cheating site AshleyMadison.com was hacked and highly sensitive data about its users posted online. The leak led to the public shaming and extortion of many Ashley Madison users, and to at least two suicides. To date, little is publicly known about the...
Lock down your Neopets account: Data breach being investigated
Bad news for players of long-time virtual pet management title Neopets. Word is spreading of a compromise claimed to have accessed around 69 million user accounts. This compromise, posted to a hacking forum, is said to include both the database and around 460 MB of compressed source code from...
Neopets Suffers Second Data Breach as 69 Million Accounts are Stolen
By Waqas Neopets has acknowledged the data breach and currently urging users to change their passwords immediately. Neopets is a… This is a post from HackRead.com Read the original post: Neopets Suffers Second Data Breach as 69 Million Accounts are Stolen...
MAL-2022-5418 Malicious code in portail-web (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 28af909b137497bda660ba3ccc4b18280ee50ca9c9193484047675e6b4243c18 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
Oracle Enterprise Manager Base Platform Input Validation Error Vulnerability
Oracle Enterprise Manager Base Platform is a set of local management platform of Oracle Oracle. The platform is primarily used to manage Oracle product deployments. An input validation error vulnerability exists in Oracle Enterprise Manager Base Platform component: Enterprise Manager Install...
Unspecified Vulnerability in Oracle Commerce
Oracle Commerce is the United States Oracle Oracle company's set of e-business solutions. Commerce Platform is one of them to provide a multi-functional e-business platform components. Oracle Commerce has a security vulnerability that can be exploited by an attacker to cause unauthorized access t...
CVE-2022-21579
CVE-2022-21579 affects Oracle FLEXCUBE Universal Banking (Infrastructure) with affected versions 12.1–12.4, 14.0–14.3 and 14.5. The issue is exploitable by a low-privilege attacker over HTTP with network access, requiring user interaction; impact includes unauthorized creation/deletion/modificati...
CVE-2022-21555
CVE-2022-21555 affects MySQL Shell for VS Code (Shell: GUI) with affected versions 1.1.8 and earlier. The connected IBM Security Guardium bulletin lists the CVE-2022-21555 entry among several Oracle MySQL vulnerabilities and describes the impact as low confidentiality, low integrity, and no avail...
CVE-2022-21521
CVE-2022-21521 affects Oracle PeopleSoft Enterprise PeopleTools (XML Publisher) with vulnerable versions 8.58 and 8.59. The issue allows a high-privilege attacker with network access over HTTP to compromise PeopleSoft Enterprise PeopleTools and potentially access all data. Public sources cite a ...
Authentication Risks Discovered in Okta Platform
Researchers at Authomize have discovered four “high impact” security risks in the identity and access management IAM platform Okta, according to a Tuesday report. The risks include cleartext password leakage via SCIM – the System for Cross-domain Identity Management – sharing of passwords and oth...
A week in security (July 11 – July 17)
Last week on Malwarebytes Labs: Elden Ring maker Bandai Namco hit by ransomware and data leaks Predatory Sparrow massively disrupts steel factories while keeping workers safe New variant of Android SpyJoker malware removed from Play Store after 3 million+ installs China’s Tonto Team increases...
Orange Station 1.0 SQL Injection
Title: Orange Station 1.0 SQLi Author: nu11secur1ty Date: 0.16.2022 Vendor: https://www.mayurik.com/ Software: https://www.sourcecodester.com/php/15485/garage-management-system-using-phpmysql-source-code.html Reference:...
Threat Source newsletter (July 14, 2022) — Are virtual IDs worth the security risk of saving a few seconds in the TSA line?
By Jon Munshaw. Welcome to this week’s edition of the Threat Source newsletter. I’ve started flying again on a somewhat regular basis now that work conferences and out-of-state vacations are becoming a thing again. I took about 18 months or so off flying during the peak of the pandemic, but now...
PT-2022-10841
Name of the Vulnerable Software and Affected Versions IBM Engineering Lifecycle Optimization - Publishing versions 6.0.6 through 7.0.2 Description The issue allows a remote attacker to upload arbitrary files due to improper access controls. This could potentially lead to unauthorized access or da...
Targeted attack on Government Agencies
Targeted Attack on Government Agencies By Sushant Kumar Arya, Mohsin Dalla · July 13, 2022 Executive summary The Trellix Email Security Research Team has discovered a malicious campaign targeting government agencies of Afghanistan, India, Italy, Poland, and the United States since 2021. The attac...