Numbas Remote Code Execution

Exploit Title: Numbas v7.3 - Remote Code Execution Google Dork: N/A Date: March 7th, 2024 Exploit Author: Matheus Boschetti Vendor Homepage: https://www.numbas.org.uk/ Software Link: https://github.com/numbas/Numbas Version: 7.2 and below Tested on: Linux CVE: CVE-2024-27612 import sys, requests,...

Hacker Claims Breaching US Federal Contractor Acuity, Selling ICE, USCIS Data

By Waqas The teasure trove of highly sentisive data is being sold for just $3,000 in Monero XMR cryptocurrency on Breach Forums. This is a post from HackRead.com Read the original post: Hacker Claims Breaching US Federal Contractor Acuity, Selling ICE, USCIS Data...

PetSmart warns customers of credential stuffing attack

Pet retail company PetSmart has emailed customers to alert them to a recent credential stuffing attack. Credential stuffing relies on the re-use of passwords. Take this example: User of Site A uses the same email and password to login to Site B. Site A gets compromised and those login details are...

TeraWallet – Best WooCommerce Wallet System With Cashback Rewards, Partial Payment, Wallet Refunds < 1.4.11 - Missing Authorization to Authenticated (Subscriber+) User Email Export

Description The TeraWallet – Best WooCommerce Wallet System With Cashback Rewards, Partial Payment, Wallet Refunds plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the terawalletexportusersearch function in all versions up to, and including,...

BIT-GITLAB-2022-2227

Improper access control in the runner jobs API in GitLab CE/EE affecting all versions prior to 14.10.5, 15.0 prior to 15.0.4, and 15.1 prior to 15.1.1 allows a previous maintainer of a project with a specific runner to access job and project meta data under certain conditions...

BlackCat Ransomware Group Implodes After Apparent $22M Payment by Change Healthcare

There are indications that U.S. healthcare giant Change Healthcare has made a $22 million extortion payment to the infamous BlackCat ransomware group a.k.a. "ALPHV" as the company struggles to bring services back online amid a cyberattack that has disrupted prescription drug services nationwide f...

American Express warns customers about third party data breach

American Express has sent affected customers a warning that “a third party service provider engaged by numerous merchants experienced unauthorized access to its system.” In a subsequent update, American Express explained that it was not a service provider, but a merchant processor that suffered t...

American Express Cardholders Impacted by Third-Party Vendor Data Breach

By Waqas Another day, another third-party data breach! This is a post from HackRead.com Read the original post: American Express Cardholders Impacted by Third-Party Vendor Data Breach...

Design/Logic Flaw

The NextMove Lite – Thank You Page for WooCommerce and Finale Lite – Sales Countdown Timer & Discount for WooCommerce plugins for WordPress are vulnerable to unauthorized access of data due to a missing capability check on the downloadtoolssettings function in all versions up to, and including,...

CVE-2024-1120

The NextMove Lite – Thank You Page for WooCommerce and Finale Lite – Sales Countdown Timer & Discount for WooCommerce plugins for WordPress are vulnerable to unauthorized access of data due to a missing capability check on the downloadtoolssettings function in all versions up to, and including,...

CutOut.Pro AI Tool Data Breach: Hacker Leak 20 Million User Info

By Waqas In an exclusive statement to Hackread.com, CutOut.Pro denied the breach and labeled the leak as a 'clear scam.' This is a post from HackRead.com Read the original post: CutOut.Pro AI Tool Data Breach: Hacker Leak 20 Million User Info...

Fulton County, Security Experts Call LockBit’s Bluff

The ransomware group LockBit told officials with Fulton County, Ga. they could expect to see their internal documents published online this morning unless the county paid a ransom demand. LockBit removed Fulton Countys listing from its victim shaming website this morning, claiming the county had...

CVE-2024-1908

CVE-2024-1908 concerns GitHub Enterprise Server. The issue is an improper privilege management flaw that allowed an attacker with a non-default GitHub Connect setting and an account on the server to use the Enterprise Actions GitHub Connect download token to fetch private repository data. Affecte...

Design/Logic Flaw

The Login Lockdown – Protect Login Form plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the generateexportfile function in all versions up to, and including, 2.08. This makes it possible for authenticated attackers, with subscriber access and...

Change Healthcare outages reportedly caused by ransomware

On Wednesday February 21, 2024, Change Healthcare—a subsidiary of UnitedHealth Group—experienced serious system outages due to a cyberattack. In a Form 8-K filing the company said it: “identified a suspected nation-state associated cyber security threat actor had gained access to some of the Chan...

CVE-2023-48678

CVE-2023-48678 affects Acronis Cyber Protect 16 (Linux and Windows) before build 37391. Root cause: insecure folder permissions leading to sensitive information disclosure. CVSS 3.1/3.0 base metrics indicate high confidentiality impact with local, low-complexity access and low privileges required...

Identity theft is number one threat for consumers, says report

The German Federal Office for Information Security BSI has published a report on The State of IT Security in Germany in 2023, and the number one threat for consumers is… identity theft. The thing is, you can protect your devices and your online privacy as much as possible, but what happens when...

EUVD-2024-24560

An issue was discovered on certain GL-iNet devices. Attackers can download files such as logs via commands, potentially obtaining critical user information. This affects MT6000 4.5.5, XE3000 4.4.4, X3000 4.4.5, MT3000 4.5.0, MT2500 4.5.0, AXT1800 4.5.0, AX1800 4.5.0, A1300 4.5.0, S200 4.1.4-0300,...

LoanDepot Ransomware Attack Leads to Data Breach; 17 Million Impacted

By Waqas LoanDepot identified the ransomware attack on January 4, 2024 This is a post from HackRead.com Read the original post: LoanDepot Ransomware Attack Leads to Data Breach; 17 Million Impacted...

Hackers Leak 2.5M Private Plane Owners’ Data Linked to LA Intl. Airport Breach

By Waqas The IntelBroker hacker has claimed responsibility for the breach. This is a post from HackRead.com Read the original post: Hackers Leak 2.5M Private Plane Owners Data Linked to LA Intl. Airport Breach...