U.S. Dept Of Defense: ████ - Complete account takeover

Summary: ███████ ██████████ was updated today 03/04, which includes a backend rewrite. Unfortunately, the new site is insecure and allows a password to be reset given only a username. This allows access to payment records for any DoD employee given only their username, which is commonly known...

LinkedIn: Access to resumes applied through LinkedIn Jobs

Vulnerability description not provided...

Sensitive data of 80 million US households exposed online

By Uzair Amir The 24 GB database was hosted on a Microsoft cloud server. Another day, another data breach; this time researchers have discovered an unprotected cloud repository containing personal and financial information of more than 80 million US households. This incident reminds us of two...

Change your password: Docker suffers breach; 190k users affected

By Uzair Amir Microsoft says its official Microsoft images hosted in Docker Hub have not been compromised. The company behind Docker, a computer program developed to manage operating-system-level virtualization has announced that it has suffered a data breach and as a result, one of Docker Hub...

Docker Hub Hack Affects 190K Accounts, with Concerning Consequences

UPDATE Docker Hub has confirmed that it was hacked last week; with sensitive data from approximately 190,000 accounts potentially exposed. “On Thursday, April 25th, 2019, we discovered unauthorized access to a single Hub database storing a subset of non-financial user data,” Kent Lamb, director o...

Docker Hub Suffers a Data Breach, Asks Users to Reset Password

Docker Hub, one of the largest cloud-based library of Docker container images, has suffered a data breach after an unknown attacker gained access to the company's single Hub database. Docker Hub is an online repository service where users and partners can create, test, store and distribute Docker...

Docker Hub Suffers a Data Breach, Asks Users to Reset Password

Docker Hub, one of the largest cloud-based library of Docker container images, has suffered a data breach after an unknown attacker gained access to the company's single Hub database. Docker Hub is an online repository service where users and partners can create, test, store and distribute Docker...

Ride-hailing app leaks personal data of millions of Iranians

By Ryan De Souza The ride-hailing app database was hosted on an insecure MongoDB server. Another day, another data breach - This time, security researchers have identified a ride-hailing app exposing personal data of 1 to 2 million Iranian drivers, thanks to an insecure MongoDB database. The...

Bodybuilding.com suffers data breach; issues password reset for all users

By Uzair Amir Bodybuilding.com will contact all former and current users - The website has over seven million registered users. The world-renowned fitness platform Bodybuilding.com has suffered a data breach in which personal data of registered users has been accessed. The breach was identified i...

Code injection

Vulnerability in the Oracle Trade Management component of Oracle E-Business Suite subcomponent: User Interface. Supported versions that are affected are 12.1.1, 12.1.2, 12.1.3, 12.2.3, 12.2.4, 12.2.5, 12.2.6, 12.2.7 and 12.2.8. Easily exploitable vulnerability allows unauthenticated attacker with...

CVE-2019-2701

CVE-2019-2701 affects Oracle Primavera P6 Enterprise Project Portfolio Management (EPPM) Web Access in the Primavera P6 EPPM component. The vulnerability is present in the 18.8 release and allows a low-privilege, unauthenticated or weakly authenticated attacker with network access over HTTP to re...

CVE-2019-2663

CVE-2019-2663 affects Oracle E-Business Suite’s Advanced Outbound Telephony (UI) with affected versions 12.1.1–12.2.8. An unauthenticated attacker with network access over HTTP can compromise the telephony component; attacks may impact other products and could grant unauthorized access or data mo...

CVE-2019-2664

CVE-2019-2664 affects Oracle E-Business Suite, Oracle Marketing Administration subcomponent. Affected versions include 12.1.1–12.2.8; vulnerability allows unauthenticated, network-accessible HTTP exploitation with user interaction to gain access to Oracle Marketing data and perform unauthorized u...

CVE-2019-2662

CVE-2019-2662 affects Oracle E-Business Suite, Territory Management (Territory Administration). Affected versions include 12.1.1–12.1.3 and 12.2.3–12.2.8. The vulnerability allows an unauthenticated attacker with network access via HTTP to compromise Territory Management, with human interaction r...

CVE-2019-2675

CVE-2019-2675 affects Oracle E-Business Suite’s CRM Technical Foundation component (subcomponent: Preferences). Affected versions are 12.1.3, 12.2.3–12.2.8. The vulnerability allows an unauthenticated attacker with network access via HTTP, with user interaction required, to compromise data and po...

CVE-2019-2622

CVE-2019-2622 concerns the Oracle E-Business Suite Service Contracts (Renewals) component. Affected versions are listed as 12.1.1, 12.1.2, 12.1.3, 12.2.3–12.2.8. The vulnerability is exploitable by an unauthenticated attacker over HTTP with network access, and successful exploitation requires hum...

CVE-2019-2591

CVE-2019-2591 affects Oracle PeopleSoft Enterprise HRMS (subcomponent: Candidate Gateway) with affected version 9.2. The vulnerability allows unauthenticated network access via HTTP to compromise HRMS, requiring user interaction for exploitation, and may lead to unauthorized update/insert/delete ...

CVE-2019-2598

CVE-2019-2598 affects Oracle PeopleSoft Enterprise PeopleTools (SQR subcomponent) with affected versions 8.55, 8.56 and 8.57. The vulnerability enables a high-privilege attacker who can reach the system over HTTP to compromise PeopleTools, potentially enabling unauthorized creation/deletion/modif...

CVE-2019-2582

CVE-2019-2582 affects Oracle Database Server Core RDBMS. The Red Hat and NVD records describe an unauthenticated, network-accessible vulnerability via Oracle Net that can lead to read access to a subset of Core RDBMS data in affected versions 12.2.0.1 and 18c. The underlying cause and impact are ...

CVE-2019-11383

An issue was discovered in the Medha WiFi FTP Server application 1.8.3 for Android. An attacker can read the username/password of a valid user via /data/data/com.medhaapps.wififtpserver/sharedprefs/com.medhaapps.wififtpserverpreferences.xml...