4665 matches found
CVE-2024-3500 ElementsKit Pro <= 3.6.0 - Authenticated (Contributor+) Local File Inclusion via Price Menu, Hotspot, and Advanced Toggle Widgets
The ElementsKit Pro plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 3.6.0 via the Price Menu, Hotspot, and Advanced Toggle widgets. This makes it possible for authenticated attackers, with contributor-level access and above, to include and execute...
The Breach of a Face Recognition Firm Reveals a Hidden Danger of Biometrics
Outabox, an Australian firm that scanned faces for bars and clubs, suffered a breach that shows the problems with giving companies your biometric data...
Psychotherapy practice hacker gets jail time after extorting patients, publishing personal therapy notes online
On October 30, 2020, I started a article with the words: “Hell is too nice a place for these people.” The subject of this outrage focused on the cybercriminals behind an attack on Finnish psychotherapy practice Vastaamo. Because it was a psychotherapy practice, the records contained extremely...
Dropbox Discloses Breach of Digital Signature Service Affecting All Users
Cloud storage services provider Dropbox on Wednesday disclosed that Dropbox Sign formerly HelloSign was breached by unidentified threat actors, who accessed emails, usernames, and general account settings associated with all users of the digital signature product. The company, in a filing with th...
Kaiser health insurance leaked patient data to advertisers
Health insurance giant Kaiser has announced it will notify millions of patients about a data breach after sharing patients’ data with advertisers. Kaiser said that an investigation led to the discovery that “certain online technologies, previously installed on its websites and mobile applications...
SQL Injection Vulnerability in Electronic Document Security Management System (CDG) of Beijing Yisetong Technology Development Co.
Yisetong Document Security Management System is the earliest document encryption and decryption product in China based on file filtering and driving technology. The protection scope covers terminal computers Windows, Mac, and Linux system platforms, smart terminals Android, IOS, and all kinds of...
Okta Warns of Unprecedented Surge in Proxy-Driven Credential Stuffing Attacks
Identity and access management IAM services provider Okta has warned of a spike in the "frequency and scale" of credential stuffing attacks aimed at online services. These unprecedented attacks, observed over the last month, are said to be facilitated by "the broad availability of residential pro...
A week in security (April 15 – April 21)
Last week on Malwarebytes Labs: Law enforcement reels in phishing-as-a-service whopper Mental health company Cerebral failed to protect sensitive personal data, must pay $7 million Cannabis investment scam JuicyFields ends in 9 arrests Should you share your location with your partner? Giant Tiger...
Hyperledger: Code exec on Github runner via Pull request name
A command injection vulnerability was discovered in the GitHub Actions workflow of the Hyperledger Cacti repository. The vulnerability allowed an attacker to inject arbitrary commands and execute them on the GitHub runner by crafting a malicious pull request title. The vulnerability was present i...
Mental health company Cerebral failed to protect sensitive personal data, must pay $7 million
The Federal Trade Commission FTC has reached a settlement with online mental health services company Cerebral after the company was charged with failing to secure and protect sensitive health data. Cerebral has agreed to an order that will restrict how the company can use or disclose sensitive...
TotalCloud Insights: Safeguarding Your Cloud Database from SQL Server Threats and Lateral Movement Risks
Introduction In todays tech-driven world, cloud computing has completely changed how businesses store and manage their data. It offers many advantages, like flexibility, scalability, and cost savings, making it a go-to choice for organizations of all sizes. Keeping your data secure, especially in...
Improper Authentication
org.keycloak:keycloak-services is vulnerable to Improper Authentication. This vulnerability is due to improperly enforcement of token types, allowing an authenticated attacker to exchange a logout token for an access token, potentially accessing data beyond permitted permissions...
CVE-2024-21020
Vulnerability in the Oracle Complex Maintenance, Repair, and Overhaul product of Oracle E-Business Suite component: LOV. Supported versions that are affected are 12.2.3-12.2.13. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle...
CVE-2024-21089
Oracle E-Business Suite vulnerability CVE-2024-21089 affects Oracle Concurrent Processing, specifically the Request Submission and Scheduling component in versions 12.2.3–12.2.13. The issue stems from insufficient input validation, allowing a low-privileged, network-accessing attacker over HTTP t...
CVE-2024-21076
Oracle E-Business Suite — Oracle Trade Management (Offer LOV) is affected in 12.2.3–12.2.13 due to insufficient input validation. An unauthenticated, network-access attacker can exploit via HTTP to gain unauthorized access to Oracle Trade Management data. The issue is described in external adviso...
CVE-2024-21038
This CVE (CVE-2024-21038) affects Oracle E-Business Suite, specifically the Complex Maintenance, Repair, and Overhaul component (LOV). Affected versions are 12.2.3–12.2.13. The flaw enables an unauthenticated attacker with network access over HTTP to compromise the LOV component, with required us...
CVE-2024-21007
CVE-2024-21007 affects Oracle WebLogic Server (Core) in Oracle Fusion Middleware, impacting versions 12.2.1.4.0 and 14.1.1.0.0. The vulnerability allows an unauthenticated attacker with network access via T3 or IIOP to compromise the server, potentially leading to unauthorized access to critical ...
Change Healthcare’s New Ransomware Nightmare Goes From Bad to Worse
A cybercriminal gang called RansomHub claims to be selling highly sensitive patient information stolen from Change Healthcare following a ransomware attack by another group in February...
Giant Tiger breach sees 2.8 million records leaked
Someone has posted a database of over 2.8 million records to a hacker forum, claiming they originated from a March 2024 hack at Canadian retail chain Giant Tiger. When asked, they posted a small snippet as proof. The download of the full database is practically free for other active members of th...
EleForms – All In One Form Integration including DB for Elementor < 2.9.9.8 - Missing Authorization to Sensitive Information Exposure
Description The EleForms – All In One Form Integration including DB for Elementor plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check when downloading form submissions in all versions up to, and including, 2.9.9.7. This makes it possible for...