4570 matches found
CVE-2024-24309
The CVE-2024-24309 affects the Ecomiz Survey TMA module for PrestaShop, up to version 2.0.0. The Red Hat/NVD entries and related advisories describe a design/logic flaw in the Survey TMA that allows a guest to download personal information without restriction, constituting an information disclosu...
CVE-2024-1053
CVE-2024-1053 affects the WordPress plugin “Event Tickets and Registration.” A missing capability check on the email action in versions up to and including 5.8.1 allows authenticated users with contributor-level access and above to email the attendees list to themselves. Impact is listed as data ...
Event Tickets and Registration < 5.8.2 - Missing Authorization
Description The Event Tickets and Registration plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the 'email' action in all versions up to, and including, 5.8.1. This makes it possible for authenticated attackers, with contributor-level access a...
CVE-2024-1340
CVE-2024-1340 affects the WordPress plugin Login Lockdown – Protect Login Form (
Cyber security for Credit Unions 101
American consumers have two clear yet vastly differing choices when it comes to banking. Many opt for a large-sized national or regional bank. Folks select this option for a variety of reasons, typically due to the vast services and ease of use these powerhouses provide. Roughly 60% of Americans...
LockBit, the world’s worst ransomware, is down
For the last two years the absolute worst, most prolific, most globally significant "big game" ransomware gang has been LockBit. This evening its position as ransomwares biggest beast is suddenly in doubt, following some non-consensual website redecoration at the hands of the UKs National Crime...
Simple Job Board < 2.11.0 - Missing Authorization to Unauthenticated Information Disclosure
Description The Simple Job Board plugin for WordPress is vulnerable to unauthorized access of data| due to insufficient authorization checking on the fetchquickjob function in all versions up to, and including, 2.10.8. This makes it possible for unauthenticated attackers to fetch arbitrary posts,...
CVE-2024-25635 IDOR Vulnerability: Allowing Organization Owner to view the other Organizations API KEY and USERS
alf.io is an open source ticket reservation system. Prior to version 2.0-Mr-2402, organization owners can view the generated API KEY and USERS of other organization owners using the http://192.168.26.128:8080/admin/api/users/ endpoint, which exposes the details of the provided user ID. This may...
Why keeping track of user accounts is important
CISA the Cybersecurity & Infrastructure Security Agency has issued a cybersecurity advisory after the discovery of documents containing host and user information of a state government organization’s network environment—including metadata—on a dark web brokerage site. An attacker managed to...
A week in security (February 12 – February 18)
Last week on Malwarebytes Labs: GoldPickaxe Trojan steals your face! Microsoft Exchange vulnerability actively exploited Massive utility scam campaign spreads via online ads Facebook Marketplace users’ stolen data offered for sale How ransomware changed in 2023 Malwarebytes crushes malware all th...
Hackers Claim Data Breach at Staffing Giant Robert Half, Sell Sensitive Data
By Waqas Deja vu at Robert Half? Notorious hackers claim responsibility as the staffing giant makes headlines for yet another alleged data breach in two years. This is a post from HackRead.com Read the original post: Hackers Claim Data Breach at Staffing Giant Robert Half, Sell Sensitive Data...
Buffer overflow
Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Analytics component: BI Platform Security. The supported version that is affected is 12.2.1.4.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle...
CVE-2024-20921
The CVE-2024-20921 issue is in Oracle Java SE (Hotspot) and related Oracle GraalVM offerings. Affected products/versions identified in sources: Oracle Java SE 8u391, 8u391-perf, 11.0.21, 17.0.9, 21.0.1; Oracle GraalVM for JDK 17.0.9 and 21.0.1; Oracle GraalVM Enterprise Edition 20.3.12, 21.3.8, 2...
Facebook Marketplace users’ stolen data offered for sale
Personal data belonging to Facebook Marketplace users has been published online, according to BleepingComputer. A cybercriminal was allegedly able to steal a partial database after hacking the systems of a Meta contractor. The leak consists of around 200,000 records that contain names, phone...
CVE-2023-6408
CWE-924: Improper Enforcement of Message Integrity During Transmission in a Communication Channel vulnerability exists that could cause a denial of service and loss of confidentiality, integrity of controllers when conducting a Man in the Middle attack...
U.S. Internet Leaked Years of Internal, Customer Emails
The Minnesota-based Internet provider U.S. Internet Corp. has a business unit called Securence, which specializes in providing filtered, secure email services to businesses, educational institutions and government agencies worldwide. But until it was notified last week, U.S. Internet was publishi...
CVE-2023-46186
CVE-2023-46186 affects IBM Jazz for Service Management 1.1.3.20. The root cause is improper access controls that enable an unauthorized user to obtain sensitive file information via forced browsing. Impact details from sources indicate a high confidentiality risk (NVD CVSS v3.1 base 7.5; IBM CNA ...
Infosys Data Breach Impacts 57,000 Bank of America Customers
By Waqas Bank of America customers participating in deferred compensation plans are the main victims of this data breach. This is a post from HackRead.com Read the original post: Infosys Data Breach Impacts 57,000 Bank of America Customers...
Hackers Leak Alleged Partial Facebook Marketplace Database
By Waqas The alleged data breach took place on October 2023. However, the database was only made public earlier today, on Sunday, February 11, 2024. This is a post from HackRead.com Read the original post: Hackers Leak Alleged Partial Facebook Marketplace Database...
PT-2024-11764 · Unknown +4 · Cpanel::Json::Xs +4
Name of the Vulnerable Software and Affected Versions: Cpanel::JSON::XS versions prior to 4.33 Description: The issue allows attackers to perform out-of-bounds accesses, potentially obtaining sensitive information or causing a denial of service. Recommendations: For versions prior to 4.33, update...