CVE-2019-0018

The CVE-2019-0018 entry documents a persistent cross-site scripting (XSS) vulnerability in the file upload menu of Juniper ATP, affecting Juniper ATP 5.0 versions prior to 5.0.3. The issue allows an authenticated attacker to inject arbitrary scripts and potentially steal sensitive data or credent...

Live Call Support Widget 1.5 - Remote Code Execution / SQL Injection

Exploit Title: Live Call Support 1.5 - Remote Code Execution / SQL Injection Dork: N/A Date: 2019-01-13 Exploit Author: Ihsan Sencan Vendor Homepage: http://ranksol.com/ Software Link: https://codecanyon.net/item/live-call-support-widget-software-online-calling-web-application/22532799 Version: 1...

Hyatt Hotels: Hyatt WeChat Secret, Baidu AK Secret, and mysql db credentials inadvertantly made publicly available

This one is slightly odd, so I've rated it a low, as I'm not able to confirm whether or not these are active creds/secrets it's late and I don't speak/read Chinese. During recon for hyatt.com, I stumbled across this github.com repo that seems to be for hyatt's wechat setup:...

This Week in Security News: Adware and Ransomware

Welcome to our weekly roundup, where we share what you need to know about the cybersecurity news and events that happened over the past few days. This week, learn about an adware that disguised itself as different apps and monitors mobile devices. Also, learn more about the different ransomware...

Over 202 Million Chinese Job Seekers' Details Exposed On the Internet

Cybersecurity researcher has discovered online a massive database containing records of more than 202 million Chinese citizens that remained accessible to anyone on the Internet without authentication until last week. The unprotected 854.8 gigabytes of the database was stored in an instance of...

Over 202 Million Chinese Job Seekers' Details Exposed On the Internet

Cybersecurity researcher has discovered online a massive database containing records of more than 202 million Chinese citizens that remained accessible to anyone on the Internet without authentication until last week. The unprotected 854.8 gigabytes of the database was stored in an instance of...

Town of Salem data breach: Personal data of 7.6M gamers stolen

By Uzair Amir Over 7.6 million players have been impacted by a massive data breach suffered by the well-known browser-based role-playing game “Town of Salem.” BlankMediaGames, the owner of the game, has confirmed on its online forum that the breach did occur. A copy of the compromised database fr...

Town of Salem Data Breach Exposes 7.6 Million Gamers' Accounts

A massive data breach at the popular online role-playing game 'Town of Salem' has reportedly impacted more than 7.6 million players, the game owner BlankMediaGames BMG confirmed Wednesday on its online forum. With the user base of more than 8 million players, Town of Salem is a browser-based game...

Town of Salem Data Breach Exposes 7.6 Million Gamers' Accounts

A massive data breach at the popular online role-playing game 'Town of Salem' has reportedly impacted more than 7.6 million players, the game owner BlankMediaGames BMG confirmed Wednesday on its online forum. With the user base of more than 8 million players, Town of Salem is a browser-based game...

Marriott Revises Breach Scope to 383M Records

Marriott has revised downward its estimate on the number of guests whose passport numbers and payment card data were impacted in its recent data breach. After the hospitality giant confirmed in November that there had been unauthorized access to its Starwood guest reservations database from 2014 ...

Wide-Ranging German Doxxing Incident Hits Hundreds of Politicians

Hundreds of German politicians, including Chancellor Angela Merkel, have been doxxed in a puzzling incident, with their private information and political documents dumped online. At least one local reporter is claiming the information is explosive. According to a report from German public...

Hackers steal credit card data of 14,579 BevMo customers

By Uzair Amir A warning has been issued by the Concord, California-based alcoholic beverages retailer BevMo informing its customers about a data breach that its online store experienced between 2 August and 26 September. During the attack, credit card data of its customers was exposed. “BevMo tak...

Hackers steal personal details of 1,000 North Korean Defectors

By Uzair Amir The data breach against North Korean Defectors came after hackers targeted computer at Resettling agency. Private data of approx. 1,000 North Korean Defectors present in the South have been exposed in a data breach which makes them vulnerable to all sorts of threats from the North,...

postgresql-common PostgreSQL Data Compromise

The vulnerability of the postgresql-common package in the Astra Linux operating system is related to an error in the package update script, which causes a violation of the indexing of the list of installed deb packages in the operating system. Exploiting this vulnerability allows an attacker to...

SQL Injection Vulnerability in PHPSHE B2C Mall System v1.7ad***.php Page

PHPSHE B2C mall system is an online shopping mall system. The system supports express tracking, online chat, order evaluation and statistics. PHPSHE B2C Mall System v1.7ad.php page SQL injection vulnerability, attackers can use the vulnerability to obtain database sensitive information...

San Diego School District Data Breach Hits 500k Students

A phishing attack against California’s San Diego Unified School District has led to hackers scooping up Social Security numbers and addresses of more than 500,000 students and staff. The district became aware of the breach Oct. 2018. The actual breach occurred between January 2001 and November...

Nokia exposes passwords & secret access keys to its internal systems

By Waqas Another day, another data breach - This time, multinational tech giant Nokia has been caught exposing highly sensitive data of industrial nature that would have put its internal security at risk. The data was discovered by the director of the cyber risk research team at Hacken and...

This Week in Security News: Deep Dives and NASA Data

Welcome to our weekly roundup, where we share what you need to know about the cybersecurity news and events that happened over the past few days. This week, learn about the span of a NASA hack that leaked data for current and former employees. Also, Trend Micro dives deep into the underground...

Caribou Coffee, Bruegger’s Bagels Bitten by Breach

Hundreds of Caribou Coffee and Bruegger’s Bagels stores have been targeted in a point-of-sale POS system data breach that attempted to steal customers’ payment cards. Hackers gained unauthorized access to the company’s POS systems, exposing some customers’ data – including name and credit-card...

Amazon Sends 1,700 Alexa Voice Recordings to a Random Person

UPDATE Amazon inadvertently sent 1,700 audio files containing recordings of Alexa interactions by a customer to a random person – and after a newspaper investigation exposed the snafu, characterized it as a “mishap” that came down to one employee’s mistake. In August, an Amazon customer in German...