CVE-2021-2373

CVE-2021-2373 is a vulnerability in Oracle JD Edwards EnterpriseOne Tools, specifically the Web Runtime component. Affected products/versions include JD Edwards EnterpriseOne Tools 9.2.5.3 and earlier. The issue enables a low-privileged, network-accessible attacker (HTTP) to compromise data in th...

CVE-2021-2359

CVE-2021-2359 affects Oracle E-Business Suite’s Marketing Administration. The vulnerability exists in affected Oracle Marketing components for versions 12.1.1–12.1.3 and 12.2.3–12.2.10 . An unauthenticated attacker with network access over HTTP can compromise Oracle Marketing, with attacks potent...

Law Firm to the Fortune 500 Breached with Ransomware

Campbell Conroy & O’Neil, P.C. – U.S. law firm to a dazzling array of huge companies – told its star-studded clientele that an intruder may have groped their data. It was hit with ransomware in February and is now suffering the data-breach fallout. That client list spans a slew of industries and...

Why Your Business Needs a Long-Term Remote Security Strategy

When COVID-19 first emerged, companies across all sectors of the economy were forced to rapidly transition to remote work. The goal was simple: Ensuring business continuity in the face of an unprecedented challenge — a challenge that most assumed would come and go in short order. As vaccines...

Zero-Day Attacks on Critical WooCommerce Bug Threaten Databases

A critical SQL-injection security vulnerability in the WooCommerce e-commerce platform and a related plugin has been under attack as a zero-day bug, researchers have disclosed. The exploitation prompted WooCommerce to release an emergency patch for the issue late on Wednesday. The bug could allow...

CVE-2021-33671

SAP NetWeaver Guided Procedures Administration Workset, versions - 7.10, 7.20, 7.30, 7.31, 7.40, 7.50, does not perform necessary authorization checks for an authenticated user, resulting in escalation of privileges. The impact of missing authorization could result to abuse of functionality...

Guess Fashion Deals With Data Loss, Post-Ransomware

A February ransomware attack on fashion label Guess linked to Colonial Pipeline attackers DarkSide is still causing damage. Guess has started sending letters to 1,300 employees and contractors who had their personal and banking data exposed during the breach. The letter, published by...

Crafting a Custom Dictionary for Your Password Policy

Modern password policies are comprised of many different elements that contribute to its effectiveness. One of the components of an effective current password policy makes use of what is known as a custom dictionary that filters out certain words that are not allowed as passwords in the...

Unauthorized Access Vulnerability in Various Printers at Ricoh (China) Investment Co.

Ricoh China Investment Co., Ltd. provides services and solutions such as document output management services and IT solutions such as office image processing equipment e.g., MFPs, printers, etc., production digital printers, and more. An unauthorized access vulnerability exists in a number of Ric...

Hackers leak scraped data of 87,000 GETTR users

By Deeba Ahmed GETTR has been attacked twice since its launch on July 4th, 2021. Here's what Hackread.com's exclusive analysis reveals. This is a post from HackRead.com Read the original post: Hackers leak scraped data of 87,000 GETTR users...

Racing against a real-life ransomware attack, with Ski Kacoroski: Lock and Code S02E12

At 11:37 pm on the night of September 20, 2019, cybercriminals launched a ransomware attack against Northshore School District in Washington state. Early the next morning, Northshore systems administrator Ski Kacoroski arrived on scene. As Kacoroski soon found out, he and his team were on a race...

Simple Client Management System 1.0 - Remote Code Execution Exploit

Exploit Title: Simple Client Management System 1.0 - Remote Code Execution RCE Exploit Author: Ishan Saha Vendor Homepage: https://www.sourcecodester.com/ Software Link: https://www.sourcecodester.com/sites/default/files/download/oretnom23/client-details.zip Version: 1.0 Tested on: Windows 10 Hom...

Spanish telecom giant MasMovil hit by Revil ransomware gang

By Waqas Revil ransomware gang is claiming to have downloaded databases and other important data belonging to the MasMovil group. This is a post from HackRead.com Read the original post: Spanish telecom giant MasMovil hit by Revil ransomware gang...

Online learning provider New Skills Academy alerts users of data breach

By Waqas According to the data breach notification email sent by New Skills Academy, the number of victims impacted by the breach is yet unknown. This is a post from HackRead.com Read the original post: Online learning provider New Skills Academy alerts users of data breach...

What is an Insider Threat❓ Examples of Threats and Defenses

An insider threat is a vulnerability danger that originates from inside the affected organization, according to a clear description. The root of the problem would be someone with enough internal knowledge of the business to cause damage. This is not to say that the threat is being made by a curre...

GHSA-RPXH-VG2X-526V List of order ids, number, items total and token value exposed for unauthorized uses via new API

Impact Part of the details order ID, order number, items total, and token value of all placed orders were exposed to unauthorized users. If exploited properly, a few additional information like the number of items in the cart and the date of the shipping may be fetched as well. This data seems to...

Data for 700M LinkedIn Users Posted for Sale

A new posting with 700 million LinkedIn records has appeared on a popular hacker forum, according to researchers. Analysts from Privacy Sharks stumbled across the data put up for sale on RaidForums by a hacker calling himself “GOD User TomLiner.” The advertisement, posted June 22, claims that 700...

GHSA-7P8H-86P5-WV3P Cross-site scripting

Two kinds of XSS were found: 1. As mentioned in https://github.com/mongo-express/mongo-express/issues/577 when the content of a cell grows larger than supported size, clicking on a row will show full document unescaped, however this needs admin interaction on cell. 2. Data cells identified as med...

A week in security (June 21 – June 27)

Last week on Malwarebytes Labs: Want to stop ransomware attacks? Send the cybercriminals to jail, says Brian Honan: Lock and Code S02E11 Atomic research institute breached via VPN vulnerability Hotel staff bust Hermes SMS scammer with suspiciously large number of cables City of Liège hit by...

Urban Company: Exposed data of credit card details to hacker or attacker.

NOTE! Thanks for submitting a report! Please replace all the square sections below with the pertinent details. Remember, the more detail you provide, the easier it is for us to verify and then potentially issue a bounty, so be sure to take your time filling out the report! Name of Vulnerability:...