OPAC EasyWeb Five 5.7 - biblio SQL Injection

OPAC EasyWeb Five 5.7 - biblio SQL Injection Exploit Title: OPAC EasyWeb Five 5.7 - 'biblio' SQL Injection Dork: inurl:"index.php?scelta=campi" Date: 2018-10-02 Exploit Author: Dino Barlattani Vendor Homepage: http://www.nexusfi.it/ Software Link: http://www.nexusfi.it/easyweb.php Version: 5.7...

Shopify: H1514 CSRF in Domain transfer allows adding your domain to other user's account

Summary: Shopify allows users to buy their own domain from the Shopify system. One of the facility on this is that if you buy the domain through Shopify, you can do an inter-store transfers. This means: You can only transfer your domain to a Shopify store owned by you. It can take up to 24 hours ...

Facebook Hacked — 10 Important Updates You Need To Know About

If you also found yourself logged out of Facebook on Friday, you are not alone. Facebook forced more than 90 million users to log out and back into their accounts in response to a massive data breach. On Friday afternoon, the social media giant disclosed that some unknown hackers managed to explo...

Facebook Hacked — 10 Important Updates You Need To Know About

If you also found yourself logged out of Facebook on Friday, you are not alone. Facebook forced more than 90 million users to log out and back into their accounts in response to a massive data breach. On Friday afternoon, the social media giant disclosed that some unknown hackers managed to explo...

Facebook Data Breach Impacts Almost 50 Million Accounts

Facebook on Friday said that hackers have exploited a flaw in its platform that left the access tokens of almost 50 million Facebook accounts ripe for the taking. Access tokens are the digital keys that keep users logged into Facebook so they don’t need to re-enter their password every time they...

Hackers Stole 50 Million Facebook Users' Access Tokens Using Zero-Day Flaw

Logged out from your Facebook account automatically? Well you're not alone… Facebook just admitted that an unknown hacker or a group of hackers exploited a zero-day vulnerability in its social media platform that allowed them to steal secret access tokens for more than 50 million accounts. UPDATE...

Waiting, Waiting, Waiting... Is There a Right Time for Breach Notification?

Recently, a popular online retailer revealed a month-long data breach. Card-skimming code was found capturing customer credit card data from the payment page of its website and sending that data to what appeared to be a legitimate server with a similar domain name and a valid HTTPS certificate. T...

Perimeter Defenses are Dead, So Now What?

The castle walls, moat and drawbridge have been overrun. It is obvious to all of us – the use of perimeter defense as the key cyber strategy is dead. InfoSec Insider contributor Pravin Kothari Over time, the internet has added so many new entry points into the enterprise that they are unmanageabl...

Malware on SHEIN Servers Compromises Data of 6.4M Customers

Email addresses and encrypted passwords of over 6.4 million SHEIN customers were stolen over the summer after the women’s retailer said it suffered a “concerted criminal cyberattack” on its computer network. The data breach occurred between June and August 2018, the company said in a recent...

SHEIN-Fashion Shopping Site Suffers Data Breach Affecting 6.5 Million Users

U.S. online fashion retailer SHEIN has admitted that the company has suffered a significant data breach after unknown hackers stole personally identifiable information PII of almost 6.5 million customers. Based in North Brunswick and founded in 2008, SHEIN has become one of the largest online...

SHEIN-Fashion Shopping Site Suffers Data Breach Affecting 6.5 Million Users

U.S. online fashion retailer SHEIN has admitted that the company has suffered a significant data breach after unknown hackers stole personally identifiable information PII of almost 6.5 million customers. Based in North Brunswick and founded in 2008, SHEIN has become one of the largest online...

Mac Mojave Zero-Day Allows Malicious Apps to Access Sensitive Info

A zero-day vulnerability in the brand-new version of the Apple Mojave macOS has been uncovered, which would allow an attacker to access private and confidential information by using an unprivileged app. The flaw was found by Patrick Wardle, co-founder of Digita Security and creator of Objective-S...

Joomla! Questions 1.4.3 SQL Injection

Exploit Title: Joomla! Component Questions 1.4.3 - SQL Injection Dork: N/A Date: 2018-09-24 Vendor Homepage: https://extensiondeveloper.com/ Software Link: https://extensions.joomla.org/extensions/extension/communication/question-a-answers/questions/ Version: 1.4.3 Category: Webapps Tested on:...

CVE-2018-14825

On Honeywell Mobile Computers CT60 running Android OS 7.1, CN80 running Android OS 7.1, CT40 running Android OS 7.1, CK75 running Android OS 6.0, CN75 running Android OS 6.0, CN75e running Android OS 6.0, CT50 running Android OS 6.0, D75e running Android OS 6.0, CT50 running Android OS 4.4, D75e...

Assessing the Human Element in Cyber Risk Analysis

Seventeen percent of data breaches started as social engineering attacks, mostly from email, according to the most recent Verizon Data Breach Investigations Report. In general, employee errors, such as sending an email to the wrong person, also accounted for 17 percent of breaches. Here in lies t...

CVE-2018-15615

The CVE-2018-15615 entry concerns Avaya Call Management System (CMS) Supervisor. The vulnerability is described as an information disclosure where a local administrative user can extract sensitive information from users connecting to a remote CMS host. Affected versions are CMS Supervisor R17.0.x...

Twitter Flaw Exposed Direct Messages To External Developers

Twitter on Friday said that a recently-patched bug in its platform enabled software developers to read users’ private direct messages or protected tweets. The bug ran from May 2017 until it was discovered on September 10 – after which Twitter patched the glitch to prevent data from being...

UK Regulator Fines Equifax £500,000 Over 2017 Data Breach

Atlanta-based consumer credit reporting agency Equifax has been issued a £500,000 fine by the UK's privacy watchdog for its last year's massive data breach that exposed personal and financial data of hundreds of millions of its customers. Yes, £500,000—that's the maximum fine allowed by the UK's...

UK Regulator Fines Equifax £500,000 Over 2017 Data Breach

Atlanta-based consumer credit reporting agency Equifax has been issued a £500,000 fine by the UK's privacy watchdog for its last year's massive data breach that exposed personal and financial data of hundreds of millions of its customers. Yes, £500,000—that's the maximum fine allowed by the UK's...

State Government Online Payment Service Exposes 14M Customers

Details on more than 14 million customer records have been exposed thanks to a security oversight at GovPayNow.com, which as its name implies provides a platform for online payment systems for state and local governments. The company, which according to its website “handles more than 2.1 million...