A Bluetooth Flaw Leaves Billions of Devices Vulnerable

Indictments against Iranian hackers, a Veterans Affairs data breach, and more of the week's top security news...

CVE-2020-8225

CVE-2020-8225 affects Nextcloud Desktop Client 2.6.4, where proxy parameters and authentication credentials are stored in plaintext. This plaintext storage constitutes the root cause and enables disclosure of used proxies and their credentials, impacting confidentiality. The published advisory NC...

SecOps Teams Wrestle with Manual Processes, HR Gaps

Only about half of enterprises are satisfied with their ability to detect cybersecurity threats, according to a survey from Forrester Consulting – with respondents painting a picture of major resource and technology gaps hamstringing their efforts to block cyberattacks. According to the...

This Week in Security News: AWS Outposts Ready Launches With 32 Validated Partners and Staples Hit by a Data Breach

Welcome to our weekly roundup, where we share what you need to know about the cybersecurity news and events that happened over the past few days. This week, learn about how solutions from 32 Amazon Web Services partners – including Trend Micro – are now available for AWS customers to use with the...

Popular shopping site leaks miners’ data in 6TB of database mess up

By Waqas The database belonging to windeln.de's production server was left exposed on a misconfigured server. This is a post from HackRead.com Read the original post: Popular shopping site leaks miners data in 6TB of database mess up...

Cloud Leak Exposes 320M Dating-Site Records

Users of 70 different adult dating and e-commerce websites have had their personal information exposed, thanks to a misconfigured, publicly accessible Elasticsearch cloud server. In all, 320 million individual records were leaked online, researchers said. All of the impacted websites have one thi...

CVE-2020-16218

CVE-2020-16218 affects Philips PICiX (Patient Information Center iX) versions B.02, C.02, C.03. Root cause: improper neutralization/incorrect neutralization of user-controlled input when generating web pages, enabling potential cross-site scripting that could lead to unauthorized access to patien...

fairway-golfreisen.de Cross Site Scripting vulnerability OBB-1323846

Following coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: &nbsp&nbsp&nbsp&nbsp&nbsp&nbspa. verified the vulnerability and confirmed its existence; &nbsp&nbsp&nbsp&nbsp&nbsp&nbspb. notified the website operator about its existence...

Web Application and API Protection -- From SQL Injection to Magecart

SQL injections were first discovered in 1998, and over 20 years later, they remain an unsolved challenge and an ongoing threat for every web application and API. The Open Web Application Security Project OWASP highlighted injection flaws in its Top 10 lists for both web application security risks...

Hackers stole 738 GB of data from Australian government agency

By Waqas Nearly 47 Service NSW staff email accounts were hacked after a ‘criminal attack’ in April, affecting the data of 186,000 customers. This is a post from HackRead.com Read the original post: Hackers stole 738 GB of data from Australian government agency...

GHSA-8Q2C-2396-HF7J Malicious Package in appx-compiler

All versions of appx-compiler contain malicious code. The package uploads system information to a remote server, downloads a file and executes it. Recommendation Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that...

September is National Preparedness Month

September is National Preparedness Month, which promotes family and community disaster planning. This year’s theme is “Disasters Don’t Wait. Make Your Plan Today.” The Cybersecurity and Infrastructure Security Agency CISA recommends users and administrators use this month as an opportunity to...

Insider Attack on the Carnegie Library

Greg Priore, the person in charge of the rare book room at the Carnegie Library, stole from it for almost two decades before getting caught. Its a perennial problem: trusted insiders have to be trusted...

U.S. Voter Databases Offered for Free on Dark Web, Report

UPDATE Personal information for several million American voters has turned up on a Russian underground cybercrime forum, according to reports – and users are purportedly looking to monetize it using a recently launched State Department program meant to prevent election-meddling. The personal...

Paytm Mall data breach – Hackers gain ‘unrestricted access’ into database

By Waqas A report that hackers are demanding ransom from Paytm Mall and selling its data on hacker forums. This is a post from HackRead.com Read the original post: Paytm Mall data breach - Hackers gain unrestricted access into database...

CVE-2020-14729

The CVE-2020-14729 issue affects the SuiteCommerce Advanced (SCA) Sites component of Oracle NetSuite . Affected are versions before 2020.1.4. The vulnerability allegedly allows a low-privileged attacker with network access over HTTP to compromise NetSuite SCA, leading to unauthorized creation, de...

Russian Arrested After Offering $1 Million to U.S. Company Employee for Planting Malware

Hackers always find a way in, even if there's no software vulnerability to exploit. The FBI has arrested a Russian national who recently traveled to the United States and offered $1 million in bribe to an employee of a targeted company for his help in installing malware into the company's compute...

Freepik and Flaticon suffer data breach; 8.3 million users affected

By Waqas For your information, Flaticon claims to be the largest database of free icons and is owned by Freepik company. This is a post from HackRead.com Read the original post: Freepik and Flaticon suffer data breach; 8.3 million users affected...

Ex-Uber CSO Joseph Sullivan charged over 2016 data breach cover up

By Zara Khan Joseph Sullivan also paid hackers $100,000 in Bitcoin. This is a post from HackRead.com Read the original post: Ex-Uber CSO Joseph Sullivan charged over 2016 data breach cover up...

FBI, CISA Echo Warnings on ‘Vishing’ Threat

The Federal Bureau of Investigation FBI and the Cybersecurity and Infrastructure Security Agency CISA on Thursday issued a joint alert to warn about the growing threat from voice phishing or "vishing" attacks targeting companies. The advisory came less than 24 hours after KrebsOnSecurity publishe...