Air India Hack Exposes Credit Card and Passport Info of 4.5 Million Passengers

India's flag carrier airline, Air India, has disclosed a data breach affecting 4.5 million of its customers over a period stretching nearly 10 years after its Passenger Service System PSS provider SITA fell victim to a cyber attack earlier this year. The breach involves personal data registered...

4 Android Bugs Being Exploited in the Wild

Google updated its May 3 Android security bulletin on Wednesday to say that there are “indications” that four of the 50 vulnerabilities “may be under limited, targeted exploitation.” That was mostly confirmed by Maddie Stone, a member of Google’s Project Zero exploit research group, who clarified...

CVE-2021-32028

A flaw was found in postgresql. Using an INSERT ... ON CONFLICT ... DO UPDATE command on a purpose-crafted table, an authenticated database user could read arbitrary bytes of server memory. The highest threat from this vulnerability is to data confidentiality...

CVE-2021-1487

A vulnerability in the web-based management interface of Cisco Prime Infrastructure and Evolved Programmable Network EPN Manager could allow an authenticated, remote attacker to execute arbitrary commands on an affected system. The vulnerability is due to insufficient validation of user-supplied...

Bug Exposes Eufy Camera Private Feeds to Random Users

Owners of Eufy home security cameras were warned this week of an internal server bug that allowed strangers to view, pan and zoom in on their home-video feeds for approximately one day. Inversely, customers were also suddenly given access to do the same to other users. The SNAFU, according to...

A Simple 1-Click Compromised Password Reset Feature Coming to Chrome Browser

Google on Tuesday announced a new feature to its password manager that could be used to change a stolen password automatically with a single tap. Automated password changes build on the tool's ability to check the safety of saved passwords. Thus when Chrome finds a password that may have been...

Unsuccessful Conti Ransomware Attack Still Packs Costly Punch

Ireland’s department of health services continues to grapple with a ransomware attack that occurred last week by the Conti gang. Officials state the attack will cost tens of millions to repair, even though attackers were not successful in their attempt to encrypt systems on Ireland’s Department o...

CVE-2021-29590

TensorFlow/TFLite Minimum and Maximum operators are vulnerable to a heap-based out-of-bounds read when either input tensor is empty, due to broadcasting code indexing both tensors without bounds validation. The issue affects TF/TFLite, with fixes planned for TensorFlow 2.5.0 and cherry-picked bac...

Verizon: Pandemic Ushers in ⅓ More Cyber Misery

Thanks for just showing up, said the team that cranked out the Verizon 2021 Data Breach Investigations Report DBIR. It’s quite the accomplishment that we all made it through the “often frightening and always unpredictable dystopian wasteland that was 2020,” the carrier noted, with cybersecurity...

Ransomware Is Getting Ugly

Modern ransomware has two dimensions: pay to get your data back, and pay not to have your data dumped on the Internet. The DC police are the victims of this ransomware, and the criminals have just posted personnel records -- "including the results of psychological assessments and polygraph tests;...

200K Veterans’ Med Records May Have Been Stolen by Ransomware Gang

UPDATE A database filled with the medical records of nearly 200,000 U.S. military veterans was exposed online by a vendor working for the Veterans Administration, according to an analyst, who also presented evidence the data might have been exfiltrated by ransomware attackers. The VA for it’s par...

Alleviating ransomware’s legal headaches with Jake Bernstein: Lock and Code S02E08

This week on Lock and Code, we speak to cybersecurity and privacy attorney Jake Bernstein about ransomware attacks that dont just derail a companys reputation and productivity, but also throw them into potential legal peril. In 2020, the cybersecurity community noticed a worrying trend from...

Weak password vulnerability in NETGEAR WGR614v7 router

The NETGEAR WGR614v7 router is a wireless router device. The NETGEAR WGR614v7 router suffers from a weak password vulnerability that can be exploited by an attacker to compromise the device, obtain sensitive information and perform unauthorized operations...

Pax Technology PAXSTORE Information Disclosure Vulnerability (CNVD-2021-34507)

PAX Technology PAXSTORE is an application from China PAX PAX Inc. An ecosystem that connects 2.5 million terminals, thousands of application developers and 180+ markets in 80+ countries worldwide. An information disclosure vulnerability exists in Pax Technology PAXSTORE version v7.0.8202005111715...

ShinyHunters leak database of Indian wedding portal WedMeGood

By Waqas The leaked WedMeGood database contains 41.5 GB worth of data which is another massive data leak from ShinyHunters. ShinyHunters, the notorious hacker known for leaking databases of firms like Animal Jam, Mashable, Upstox, and 123RF, etc., is back with yet another high-profile data breach...

New Qualcomm Chip Bug Could Let Hackers Spy On Android Devices

Cybersecurity researchers have disclosed a new security vulnerability in Qualcomm's mobile station modems MSM that could potentially allow an attacker to leverage the underlying Android operating system to slip malicious code into mobile phones, undetected. "If exploited, the vulnerability would...

Anti-Spam WordPress Plugin Could Expose Website User Data

An SQL-injection vulnerability discovered in a WordPress plugin called “Spam protection, AntiSpam, FireWall by CleanTalk” could expose user emails, passwords, credit-card data and other sensitive information to an unauthenticated attacker. Spam protection, AntiSpam, FireWall by CleanTalk is...

They Told Their Therapists Everything. Hackers Leaked It All

A mental health startup built its business on easy-to-use technology. Patients joined in droves. Then came a catastrophic data breach...

U.S. Dept Of Defense: SSRF due to CVE-2021-27905 in www.████████

Apache Solr is vulnerable to SSRF using the parameter "masterUrl". This issue is registered as CVE-2021-27905. Impact A successful SSRF attack can often result in unauthorized actions or access to data within the organization, either in the vulnerable application itself or on other back-end syste...

Benefits of Building a Multi-prong Mousetrap for WAF Policies with ML

The reason behind buying a market-leading Web Application Firewall WAF is to protect your website and web applications from malicious attacks, plus complying with industry or regional data and privacy standards. In addition to the typical OWASP Top 10 vulnerabilities, WAFs need to address a litan...