COVID-19 Results for 25% of Wyoming Accidentally Posted Online

The Wyoming Department of Health WDH said on Wednesday it accidentally posted COVID test results of state residents onto their public-facing storage buckets. The WDH said in a public advisory that an employee fumbled the health information of about 164,021 Wyoming residents and of people from oth...

Anti-Vaxxer Hijacks QR Codes at COVID-19 Check-In Sites

Quick-response QR codes used by a COVID-19 contact-tracing program were hijacked by a man who simply slapped up scam QR codes on top to redirect users to an anti-vaccination website, according to local police. He now faces two counts of “obstructing operations carried out relative to COVID-19 und...

Password manager hijacked to deliver malware in supply chain attack

In the latest example of a supply chain attack, cybercriminals delivered malware to customers of the business password manager Passwordstate by breaching its developer’s networks and then deploying a fraudulent update last week, said Passwordstate’s maker, Click Studios. Though the number of...

3.2 Billion Leaked Passwords Contain 1.5 Million Records with Government Emails

A staggering number of 3.28 billion passwords linked to 2.18 billion unique email addresses were exposed in what's one of the largest data dumps of breached usernames and passwords. In addition, the leak includes 1,502,909 passwords associated with email addresses from government domains across t...

CVE-2021-2157

Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware component: TopLink Integration. Supported versions that are affected are 10.3.6.0.0, 12.1.3.0.0, 12.2.1.3.0 and 12.2.1.4.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP...

WordPress: PII of users can be downloaded from export pages

Sensitive personally identifiable information PII of users, including their name, email, phone number, role, and organization, was exposed on the https://doaction.org/ website. The PII was found in CSV files that could be downloaded from various endpoints on the website, which could be enumerated...

CVE-2021-2306

CVE-2021-2306 affects Oracle VM VirtualBox Core before 6.1.20. Multiple connected advisories confirm this vulnerability in VirtualBox, with impacts including arbitrary code execution, information disclosure, and potential filesystem access, primarily for local/privileged attack scenarios. The pub...

CVE-2021-2283

CVE-2021-2283 affects Oracle VM VirtualBox (Core) prior to version 6.1.20. Description: an information-disclosure vulnerability that is easily exploitable and allows an unauthenticated attacker with logon to the infrastructure where VirtualBox runs to access sensitive data or all data accessible ...

CVE-2021-2285

CVE-2021-2285 is a vulnerability in Oracle VM VirtualBox (Core) affecting versions prior to 6.1.20. An unauthenticated attacker with logon to the infrastructure where VirtualBox runs can compromise the VirtualBox instance, potentially exposing data or taking over the VirtualBox data. Public refer...

CVE-2021-2276

CVE-2021-2276 affects Oracle E-Business Suite iSetup, specifically the General Ledger Update Transform and Reports components. Affected versions are 12.1.3 and 12.2.3–12.2.10. The vulnerability allows a low-privilege, network-accessible attacker (via HTTP) to compromise iSetup, potentially leadin...

CVE-2021-2266

CVE-2021-2266 affects Oracle VM VirtualBox (Core) with impact of information disclosure. Affected products are VirtualBox released before version 6.1.20; exploitation could allow a high-privilege attacker with logon to the host infrastructure to access sensitive data or, in some entries, take ove...

CVE-2021-2254

CVE-2021-2254 affects Oracle E-Business Suite, Hold Management in Oracle Project Contracts (versions 12.1.1–12.1.3). The vulnerability allows a network-based, low-privilege attacker to compromise data integrity and confidentiality (C) via HTTP, with potential unauthorized creation, deletion, or m...

CVE-2021-2242

CVE-2021-2242 affects Oracle Fusion Middleware’s Oracle Outside In Technology (Outside In Filters). The affected product is Outside In Technology within Fusion Middleware, with version 8.5.5 affected. The vulnerability is exploitable with network access via HTTP by an unauthenticated attacker and...

CVE-2021-2241

CVE-2021-2241 affects Oracle iStore in Oracle E-Business Suite (Shopping Cart component) and is listed for affected versions 12.1.1–12.1.3. The Red Hat, CNVD, CNNVD, NVD, PRION, and other feeds confirm that a low-privilege attacker with network access over HTTP can compromise Oracle iStore, enabl...

CVE-2021-2229

The CVE-2021-2229 entry describes a vulnerability in Oracle E-Business Suite (Depot Repair LOVs component) affecting 12.1.1–12.1.3. The issue allows a network-based, low-privilege attacker (via HTTP) to trigger unauthorized creation/deletion/modification of data or gain access to sensitive data w...

CVE-2021-2223

CVE-2021-2223 affects Oracle E-Business Suite with Oracle Receivables (component: Receipts) for versions 12.1.1–12.1.3. The Red Hat and NVD records describe an easily exploitable issue where a low-privilege, network-accessing attacker over HTTP can compromise Oracle Receivables, potentially causi...

CVE-2021-2185

CVE-2021-2185 affects Oracle E-Business Suite's Oracle iStore Shopping Cart. Affected versions are 12.1.1–12.1.3 and 12.2.3–12.2.10. The issue is exploitable by an unauthenticated attacker over HTTP and requires user interaction; successful exploits can grant unauthorized access to Oracle iStore ...

Backdoor Found in Codecov Bash Uploader

Developers have discovered a backdoor in the Codecov bash uploader. Its been there for four months. We dont know who put it there. Codecov said the breach allowed the attackers to export information stored in its users continuous integration CI environments. This information was then sent to a...

Unspecified Vulnerability in Oracle E-Business Suite (CNVD-2021-39948)

Oracle E-Business Suite is an extension of the original Application ERP, including ERP Enterprise Resource Planning, HR Human Resource Management, CRM Customer Relationship Management, and so on, a collection of management software, is a seamless integration of a management suite. oracle iStore i...

GEICO Alerts Customers Hackers Stole Driver License Data for Two Months

Threat actors stole driver license numbers from customers of GEICO insurance for nearly two months earlier this year due to a security flaw on its website that has since been fixed. The second-largest auto insurance provider in the United States disclosed the vulnerability in a data breach notice...