CVE-2018-2849

CVE-2018-2849 affects Oracle Primavera P6 EPPM (Oracle Construction and Engineering Suite) Web Access subcomponent. Affected versions include 16.2 and 17.1–17.12. The vulnerability exists in Primavera P6 EPPM and can be exploited by a low-privileged attacker with network access via HTTP to gain u...

CVE-2018-2833

The CVE-2018-2833 entry concerns Oracle Hospitality Simphony, specifically the Enterprise Management Console subcomponent, affecting versions 2.7–2.10. The vulnerability is exploitable over HTTP from a low-privilege network-access attacker and can lead to unauthorized creation, deletion, or modif...

5 cybersecurity questions retailers must ask to protect their businesses

The Target breach in 2013 may not be the biggest retail breach in history, but for many retailers, it was their watershed moment. Point-of-sale PoS terminals were compromised for more than two weeks. 40 million card details and 70 million records of personal information swiped—part of which was...

Passit: Insecure Account Removal

Hi Team, The removal of account is one of the sensitive part of a web application that needs to protect, therefor removing an account should validate the authenticity of the legitimate user. Scenario: =============== The user logins to a shared computer office, library, cafe Left the account open...

Ransomware Dominates Verizon DBIR

Ransomware has become the most prevalent malicious software as hackers cash in on locking up expensive business critical systems and demanding a ransom, researchers warn. Verizon’s 2018 Data Breach Investigations Report DBIR, released Tuesday, said that ransomware attacks have doubled over the pa...

Impact Of Chat Service Breach Expands To Best Buy, Kmart

The number of companies coming forward as victims of a data breach – that potentially exposed hundreds of thousands of credit card payment information – has expanded to include Best Buy and Kmart. Last week, software service provider 247.ai, a company that provides online chat services for Delta,...

Finland's 3rd Largest Data Breach Exposes 130,000 Users' Plaintext Passwords

Over 130,000 Finnish citizens have had their credentials compromised in what appears to be third largest data breach ever faced by the country, local media reports. Finnish Communications Regulatory Authority FICORA is warning users of a large-scale data breach in a website maintained by the New...

Delta, Sears Breaches Blamed on Malware Attack Against a Third-Party Chat Service

Security researchers are pinning a recent data breach – that potentially exposed the credit card information of hundreds of thousands of Delta Air Lines and Sears Holdings customers – on weak third-party security policies. The cyberattack hit software service provider 247.ai, a company that...

Improper access control

An exploitable access control vulnerability exists in the data, program, and function file permissions functionality of Allen Bradley Micrologix 1400 Series B FRN 21.2 and before. A specially crafted packet can cause a read or write operation resulting in disclosure of sensitive information,...

Insecure SCADA Systems Blamed in Rash of Pipeline Data Network Attacks

After a cyberattack shut down numerous pipeline communication networks this week, experts are stressing the importance of securing third-party systems in supervisory control and data acquisition SCADA environments. Over the past two days, various major U.S. pipelines across the country reported...

Vulnerability Spotlight: Natus NeuroWorks Multiple Vulnerabilities

Vulnerabilities discovered by Cory Duplantis from Talos Overview Talos has discovered multiple vulnerabilities in Natus NeuroWorks software. This software is used in the Natus Xltek EEG medical products from Natus Medical Inc. The vulnerable devices contain an ethernet connection for data...

Microsoft Misfires with Meltdown Patch, while WannaCry Pops Up at Boeing

In our weekly roundup of InfoSec happenings, we start, as has often been the case this year, with concerning Meltdown / Spectre news -- this time involving Microsoft -- and also touch on a password hack at Under Armour, a WannaCry infection at Boeing, and a severe Drupal vulnerability. Microsoft...

Credit Data Stolen From 5M Saks, Lord & Taylor Customers

Hackers stole credit and debit card information from millions of consumers who have shopped at Saks Fifth Avenue and Lord & Taylor stores. Parent company, Hudson’s Bay Company, confirmed the security breach on Sunday, stating that customer payment card data at certain Saks Fifth Avenue, Saks Off...

Lord & Taylor & Saks customers payment cards stolen, sold on Dark Web

By Carolina Apparently, FIN7 hackers are behind the breach - The same This is a post from HackRead.com Read the original post: Lord & Taylor & Saks customers payment cards stolen, sold on Dark Web...

Under Armour says hackers stole 150 million MyFitnessPal user accounts

By Carolina Another day, another data breach - This time, hackers have This is a post from HackRead.com Read the original post: Under Armour says hackers stole 150 million MyFitnessPal user accounts...

Under Armour Reports Massive Breach of 150 Million MyFitnessPal Accounts

UPDATE Fitness apparel firm Under Armour said 150 million users of its MyFitnessPal app are victims in a breach exposing user names, email addresses and hashed passwords. The company said personal identifiable information such as credit card numbers and social security numbers were not part of th...

The data breach epidemic: no info is safe

By now it’s obvious that data security technology and protocols haven’t kept pace with the needs of consumers. Even as more people trust their most sensitive personal information to online apps and services, databases are routinely exposed. In 2017 alone, we learned about massive data breaches fr...

A week in security (March 19 – March 25)

Last week, we looked at the growing problem of smartphone addiction, how link rot is continually slicing down portions of the web, and the theft of our intellectual property. We also explored the landscape of DDoS problems, and tackled a Stephen Hawking 419 scam. Other news What can only really b...

Feds Take On Foreign Hackers, While 880K Orbitz Customers “Likely” Affected by Data Breach

In this edition of Qualys’ infosec news digest, we look at Orbitz’s data breach, AMD’s vulnerabilities controversy, and recent actions by the U.S. government against alleged Russian and Iranian cyber spies. Orbitz was kinda, sorta, maybe hacked Orbitz disclosed last week that personal information...

What Facebook’s Cambridge Analytica problem means for your data

As you may already know, there's been a security meltdown at Facebook, thanks to a company called Cambridge Analytica and Donald Trump. Facebook CEO Mark Zuckerberg insists it wasn't a breach, which is technically true. But that doesn't change the fact that the data of 50 million users was obtain...