Microsoft and Okta Confirm Data Breach Claims by LAPSUS$

By Deeba Ahmed Both companies have confirmed the breach after Lapsus$ hackers leaked screenshots of Oktas internal system and source code… This is a post from HackRead.com Read the original post: Microsoft and Okta Confirm Data Breach Claims by LAPSUS$...

Okta admits 366 customers may have been impacted by LAPSUS$ breach

Through its usual means of communication, its Telegram channel, the LAPSUS$ group has posted screenshots of what appears to be superuser access to the Okta management console. As such, the group claims to have acquired "superuser/admin" access to Okta.com and gained access to Oktas customer data,...

Microsoft and Okta Confirm Breach by LAPSUS$ Extortion Group

Microsoft on Tuesday confirmed that the LAPSUS$ extortion-focused hacking crew had gained "limited access" to its systems, as authentication services provider Okta revealed that nearly 2.5% of its customers have been potentially impacted in the wake of the breach. "No customer code or data was...

LAPSUS$ Hackers Leak Trove of Data, Claim to Breach Microsoft and Okta

By Waqas Microsoft and Okta are investigating the issue while LAPSUS$ hackers have leaked GBs worth of data apparently including… This is a post from HackRead.com Read the original post: LAPSUS$ Hackers Leak Trove of Data, Claim to Breach Microsoft and Okta...

Design/Logic Flaw

An access control issue in the authentication module of LexarF35 v1.0.34 allows attackers to access sensitive data and cause a Denial of Service DoS. An attacker without access to securely protected data on a secure USB flash drive can bypass user authentication without having any information...

A week in security (March 14 – 20)

Last week on Malwarebytes Labs: Beware of this bogus and phishy “Instagram Support” email Meet Exotic Lily, access broker for ransomware and other malware peddlers Double header: IsaacWiper and CaddyWiper How to protect RDP Online Safety Bill’s provisions for “legal but harmful” content described...

CafePress faces $500,000 fine for data breach cover up

The US Federal Trade Commission FTC has announced that it took action against online customized merchandise platform CafePress over allegations that it failed to secure consumers’ sensitive personal data and covered up a major breach. CafePress is a popular online custom T-shirt and merchandise...

Cybercriminals’ Recruiting Effort Highlights Need for Proper User Access Controls

The Lapsus$ ransomware gang’s modus operandi seems to be evolving. Following the recent data breaches of Nvidia and Samsung, on March 10, 2022, the Lapsus$ ransomware gang posted a message on their Telegram channel claiming that they were looking to recruit employees/insiders of companies in the...

Most Orgs Would Take Security Bugs Over Ethical Hacking Help

Enterprises are putting greater stock in cybersecurity, but outdated “security by obscurity” is still prevailing as companies wrestle with security awareness and shy away from bug-bounty programs. That’s according to new survey data from HackerOne, which found that a full 65 percent of...

CVE-2022-0482

Easy!Appointments before 1.4.3 is affected by a Broken Access Control vulnerability that allows an unauthorized user to retrieve sensitive appointment data via a public-facing API endpoint (examples reference /index.php/backend_api/ajax_get_calendar_events) due to missing authentication/permissio...

CVE-2021-28488

Ericsson Network Manager (ENM) prior to version 21.2 contains an access-control issue where users within the same AMOS authorization group can access managed-network data that was not intended for the entire group. The root cause, as stated in multiple sources, is incorrect access-control behavio...

Samsung confirms data breach as Lapsus$ hackers leak its source code

By Waqas In total, Lapsus$ hackers have leaked 189 GB worth of sensitive data, while Samsung has confirmed the incident;… This is a post from HackRead.com Read the original post: Samsung confirms data breach as Lapsus$ hackers leak its source code...

Church Admin < 3.4.135 - Unauthenticated Plugin's Backup Disclosure

The plugin does not have authorisation and CSRF in some of its action as well as requested files, allowing unauthenticated attackers to repeatedly request the "refresh-backup" action, and simultaneously keep requesting a publicly accessible temporary file generated by the plugin in order to...

Online Leave Management System 1.0 System SQL injection Vulnerability

Title: Online Leave Management System 1.0 System SQLi Best PHP Project Idea for Beginners 2021-2022 Author: nu11secur1ty Vendor: https://www.sourcecodester.com/users/tips23 Software: https://www.sourcecodester.com/php/14910/online-leave-management-system-php-free-source-code.html Reference:...

Hackers Who Broke Into NVIDIA's Network Leak DLSS Source Code Online

American chipmaking company NVIDIA on Tuesday confirmed that its network was breached as a result of a cyber attack, enabling the perpetrators to gain access to sensitive data, including source code purportedly associated with its Deep Learning Super Sampling DLSS technology. "We have no evidence...

Conti Ransomware Gang's Internal Chats Leaked Online After Siding With Russia

Days after the Conti ransomware group broadcasted a pro-Russian message pledging its allegiance to Vladimir Putin's ongoing invasion of Ukraine, an anonymous security researcher using the Twitter handle @ContiLeaks has leaked the syndicate's internal chats. The file dump, published by malware...

Security Notice: NVIDIA Response to Security Incident - March 2022

Go to NVIDIA Product Security. Update March 8, 2022: The two NVIDIA code-signing certificates that were reported to be leaked in this cybersecurity incident are expired: subject CN: NVIDIA Corporation issuer CN: VeriSign Class 3 Code Signing 2010 CA serial: 43bb437d609866286dd839e1d00309f5 valid...

Cyberattackers Cook Up Employee Personal Data Heist for Meyer

Meyer Corp., maker of Farberware and the largest cookware and bakeware distributor in the U.S., has begun notifying 2,747 employees that a cyberattack that occurred on Oct. 25 compromised their personal data. Meyer filed a notice with the state of Maine disclosing the breach, which it discovered ...

DNA contractor data breach exposed OKC Police’s rape kit information

By Deeba Ahmed The data breach took place in November 2021 but the details of it have only been revealed this… This is a post from HackRead.com Read the original post: DNA contractor data breach exposed OKC Police’s rape kit information...

Croatian Police arrests minor over A1 Telecom data breach & ransom demand

By Waqas The 14-year-old schoolboy was accused of stealing data of 100,000 Tele Operator A1 customers and demanding 150 Ethereum… This is a post from HackRead.com Read the original post: Croatian Police arrests minor over A1 Telecom data breach & ransom demand...