CVE-2022-31134

The CVE concerns Zulip Server exports: versions 2.1.0 and above expose a public data export that administrators can generate. The export incorrectly includes attachment contents from private messages and private streams, despite access controls. Root cause is a flaw in the public-export flow that...

Insecure password leads to Mangatoon data breach

The hugely popular Manga comics platform Mangatoon has fallen victim to a data breach. No fewer than 23 million user accounts could be at risk, thanks to a poorly secured database. Worse still, Mangatoon doesnt seem to be responding to messages from the breacher, or people notifying it that the...

CVE-2022-33138

A vulnerability has been identified in SIMATIC MV540 H All versions V3.3, SIMATIC MV540 S All versions V3.3, SIMATIC MV550 H All versions V3.3, SIMATIC MV550 S All versions V3.3, SIMATIC MV560 U All versions V3.3, SIMATIC MV560 X All versions V3.3. Affected devices do not perform authentication f...

CVE-2022-29512

CVE-2022-29512 affects Cybozu Garoon 4.0.0–5.9.1. The issue is an information disclosure where a remote authenticated attacker may obtain data without the viewing privilege, through an exposure in multiple Garoon applications. Root cause details indicate improper handling that allows exporting or...

4 ways businesses can save money on cyber insurance

So, your business has just suffered a data breach and it’s time to dig deep in your pockets to pay all the resulting expenses. Without cyber insurance, you can expect to pay a dizzying amount of cash. In 2022 alone, the average cost of a data breach for businesses under 1,000 employees was close ...

MAL-2022-6376 Malicious code in swiper-bundie (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware b5e1b659b47e3a72ea3f7e5f575acb49c0035c7a26095e57423c15e594d0161d Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Human Error Blamed for Leak of 1 Billion Records of Chinese Citizens

A prominent Chinese tech CEO has cited human error as the likely reason hackers got their hands on the personal data of 1 billion people in China from a Shanghai police database and then put some of it up for sale on illicit online markets. A government developer wrote a blog post on the China...

U.S. Dept Of Defense: SQL injection at [█████████] [HtUS]

Hello, Summary while doing test on █████ I’ve found that the endpoint at /olc/set/m101/leasib.php is vulnerable with SQL injection vulnerability Vulnerable parameters - scn - SUBJECT - COURSEID POC 1. using sqlmap run command python3 sqlmap.py --level=5 --risk=3 --tamper=space2comment...

PT-2022-7131 · Unknown +8 · X.Org Server +8

Name of the Vulnerable Software and Affected Versions: X.org Server affected versions not specified Description: A critical vulnerability was found in X.org Server, affecting the GetCountedString function of the xkb/xkb.c file. The manipulation leads to a buffer overflow. This issue can be...

Hacker Selling Shanghai Police Database with Billions of Chinese Citizen Data

By Waqas As seen by Hackread.com, the database is currently being sold for 10 Bitcoin around $200,000 at the time… This is a post from HackRead.com Read the original post: Hacker Selling Shanghai Police Database with Billions of Chinese Citizen Data...

U.S. Dept Of Defense: Broken access discloses users and PII at https://███████ [HtUS]

Good morning, I was able to register at https://████/ and get the list of users. 1- Go to https://██████████/OAHTML/ibeCAcpSSOReg.jsp and register. 2- Go to https://███/OAHTML/AppsLocalLogin.jsp with the created user and login. 3- On the homepage, click on vacations rules, create, and search user...

5 pro-freedom technologies that could change the Internet

In the digital era, freedom is inextricably linked to privacy. After a good start, the Internet-enabled, technological revolution we are living through has hit some bumps in the road. We have already lost a lot of control over who and what has access to our data, and there are further threats to...

CVE-2022-28713

Improper authentication vulnerability in Scheduler of Cybozu Garoon 4.10.0 to 5.5.1 allows a remote attacker to obtain some data of Facility Information without logging in to the product...

HackerOne Employee Caught Stealing Vulnerability Reports for Personal Gains

Vulnerability coordination and bug bounty platform HackerOne on Friday disclosed that a former employee at the firm improperly accessed security reports submitted to it for personal gain. "The person anonymously disclosed this vulnerability information outside the HackerOne platform with the goal...

NFT Marketplace OpenSea Suffers Data Breach- Users’ Email IDs Leaked

By Deeba Ahmed In a blog post published Wednesday, OpenSea said the issue was caused by an employee of Customer.io, which is… This is a post from HackRead.com Read the original post: NFT Marketplace OpenSea Suffers Data Breach- Users Email IDs Leaked...

The vulnerability of the kernel-level driver nvlddmkm.sys of the NVIDIA GPU Display Driver allows a attacker to cause a system failure and compromise data integrity.

The vulnerability of the kernel-level driver nvlddmkm.sys of the NVIDIA GPU Display Driver is related to insufficient input data validation. Exploiting this vulnerability can allow attackers to cause system failures and compromise data integrity...

Why a “Lift-and-shift” Cloud Migration Strategy Doesn’t Support Data Security

The classic 1982 Steven Spielberg horror film “Poltergeist” chronicles disturbing, unexplained paranormal activity happening in a suburban family’s idyllic home. As the activity becomes more sinister and terrifying, the family learns that their neighborhood was built on an old burial ground. It...

City worker loses USB stick containing data on every resident after day of drinking

A person working in the city of Amagasaki, in Western Japan, has mislaid a USB stick which contained data on the citys 460,000 residents. The USB drive was in a bag that went missing during a reported day of drinking and dining at a restaurant last Tuesday. The person reported it to the police th...

Log4Shell Still Being Exploited to Hack VMWare Servers to Exfiltrate Sensitive Data

The U.S. Cybersecurity and Infrastructure Security Agency CISA, along with the Coast Guard Cyber Command CGCYBER, on Thursday released a joint advisory warning of continued attempts on the part of threat actors to exploit the Log4Shell flaw in VMware Horizon servers to breach target networks...

PT-2022-18657

Name of the Vulnerable Software and Affected Versions Autodesk Navisworks version 2022 Description The issue arises from the application's failure to properly handle maliciously crafted PDF files, leading to an unhandled exception. This can be exploited by an attacker to cause a crash, read...