Privilege escalation

The HR Portal of Soar Cloud System fails to filter specific parameters. Remote attackers can inject SQL syntax and obtain all data in the database without privilege...

PT-2021-15226 · Unknown · Soar Cloud System

Name of the Vulnerable Software and Affected Versions: Soar Cloud System affected versions not specified Description: The HR Portal of Soar Cloud System fails to manage access control, allowing remote attackers to access sensitive data via a specific data packet, such as a user's login informatio...

Yandex Employee Caught Selling Access to Users' Email Inboxes

Russian Dutch-domiciled search engine, ride-hailing and email service provider Yandex on Friday disclosed a data breach that compromised 4,887 email accounts of its users. The company blamed the incident on an unnamed employee who had been providing unauthorized access to the users' mailboxes for...

Yandex Data Breach Exposes 4K+ Email Accounts

Yandex – one of Europe’s largest internet companies – is warning of a data breach that compromised 4,887 email accounts. The breach stems from an insider threat. Yandex is the most-used search engine in Russia – and the fifth most-popular search engine worldwide. Beyond its search engine, Yandex’...

Florida Water Plant Hack: Leaked Credentials Found in Breach Database

Researchers say they found several stolen and leaked credentials for a Florida water-treatment plant, which was hacked last week. Researchers at CyberNews said they found 11 credential pairs linked to the Oldsmar water plant, in a 2017 compilation of stolen breach credentials. Meanwhile, they als...

Privilege escalation

Dell EMC PowerScale OneFS versions 8.1.0-9.1.0 contain a Backup/Restore Privilege implementation issue. A user with the BackupAdmin role may potentially exploit this vulnerability resulting in the ability to write data outside of the intended file system location...

Cyberpunk 2077 Publisher Hit with Hack, Ransomware

UPDATE CD Projekt Red, the videogame-development company behind Cyberpunk 2077 and the wildly popular Witcher series, has suffered a ransomware attack that could soon result in troves of company data being dumped online – including game source code. The Warsaw-based company tweeted out a notice o...

Code injection

Clustered Data ONTAP versions prior to 9.3P20 and 9.5P15 are susceptible to a vulnerability which could allow unauthorized tenant users to discover the existence of data on other Storage Virtual Machines SVMs...

Hackers leak millions of Airtel India user data with Aadhaar numbers

By Waqas Airtel India claims it did not suffer a data breach and there are inaccuracies in claims made by the hackers. This is a post from HackRead.com Read the original post: Hackers leak millions of Airtel India user data with Aadhaar numbers...

Data Breach Exposes 1.6 Million Jobless Claims Filed in the Washington State

The Office of the Washington State Auditor SAO on Monday said it's investigating a security incident that resulted in the compromise of personal information of more than 1.6 million people who filed for unemployment claims in the state in 2020. The SAO blamed the breach on a software vulnerabilit...

Data Breach Exposes 1.6 Million Jobless Claims Filed in the Washington State

The Office of the Washington State Auditor SAO on Monday said it's investigating a security incident that resulted in the compromise of personal information of more than 1.6 million people who filed for unemployment claims in the state in 2020. The SAO blamed the breach on a software vulnerabilit...

Wind River ‘Security Incident’ Affects SSNs, Passport Numbers

Wind River Systems, which develops embedded system software, on Friday warned of a “security incident” that had exposed personnel records. One or more files were downloaded from the company’s network on or around September 29, it said. Affected data included information maintained within the...

CVE-2021-2032

Vulnerability in the MySQL Server product of Oracle MySQL component: Information Schema. Supported versions that are affected are 5.7.32 and prior and 8.0.22 and prior. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL...

BYKEA data breach: Pakistani ride-hailing app exposed 400m records

By Waqas According to researchers, BYKEA's 200 GB worth of database was exposed on an Elasticsearch server. This is a post from HackRead.com Read the original post: BYKEA data breach: Pakistani ride-hailing app exposed 400m records...

Why Data Security and Privacy in the digital age are crucial

Privacy is considered a basic human right but, with so much of our personal data now ‘out there’ in cyberspace, how private can it really be? Data is everywhere, and with rising internet usage, an increase in cloud technologies, and our growing reliance on IoT devices, it continues to grow...

Database of 176 million Pakistani mobile phone users sold online

By Waqas The database contains personal data including full names, physical addresses, and phone numbers. This is a post from HackRead.com Read the original post: Database of 176 million Pakistani mobile phone users sold online...

In the Wake of the SolarWinds Hack, Here's How Businesses Should Respond

Throughout 2020, businesses, in general, have had their hands full with IT challenges. They had to rush to accommodate a sudden shift to remote work. Then they had to navigate a rapid adoption of automation technologies. And as the year came to a close, more businesses began trying to assemble th...

23M Gamer Records Exposed in VIPGames Leak

VIPGames.com, a free platform with a total of 56 available classic board and card games like Hearts, Crazy Eights, Euchre, Dominoes, Backgammon and others, has exposed the personal data of tens of thousands of users. In all, more than 23 million records for more than 66,000 users were left expose...

Massive Brazilian Data Breach

I think this is the largest data breach of all time: 220 million people. Lots more stories are in Portuguese...

Targeted Phishing Attacks Strike High-Ranking Company Executives

An evolving phishing campaign observed at least since May 2020 has been found to target high-ranking company executives across manufacturing, real estate, finance, government, and technological sectors with the goal of obtaining sensitive information. The campaign hinges on a social engineering...