CVE-2023-22248 Adobe Commerce Incorrect Authorization Security feature bypass

Adobe Commerce versions 2.4.6 and earlier, 2.4.5-p2 and earlier and 2.4.4-p3 and earlier are affected by an Incorrect Authorization vulnerability that could result in a security feature bypass. An attacker could leverage this vulnerability to leak another user's data. Exploitation of this issue...

What does it mean when ransomware actors use “double extortion” tactics?

It is no longer enough for ransomware actors to encrypt targets files, ask for money, and get out. Over the past several years, these groups are increasingly relying on "double extortion" tactics to try and coax their victims into paying the requested ransom, or else they will leak stolen data to...

PT-2023-3179 · Adobe · Commerce

Name of the Vulnerable Software and Affected Versions: Adobe Commerce versions 2.4.6 and earlier Adobe Commerce versions 2.4.5-p2 and earlier Adobe Commerce versions 2.4.4-p3 and earlier Description: The issue is related to an Incorrect Authorization vulnerability that could result in a security...

PT-2023-3710 · Unknown · Sspanel-Uim

Name of the Vulnerable Software and Affected Versions: SSPanel-Uim version 2023.3 Description: The issue is related to improper authorization in the /link/ interface of the SSPanel-Uim software. This can allow an attacker to gain access to confidential information, potentially leading to a leak o...

WordPress Plugin Metform Elementor Contact Form Builder 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A security vulnerability exists in WordPres...

CVE-2023-32550

Landscape's server-status page exposed sensitive system information. This data leak included GET requests which contain information to attack and leak further information from the Landscape API...

CVE-2023-32550

Landscape's server-status page exposed sensitive system information. This data leak included GET requests which contain information to attack and leak further information from the Landscape API...

Information disclosure

Landscape's server-status page exposed sensitive system information. This data leak included GET requests which contain information to attack and leak further information from the Landscape API...

CVE-2023-32550 Landscape's Apache server-status is accessible by default

Landscape's server-status page exposed sensitive system information. This data leak included GET requests which contain information to attack and leak further information from the Landscape API...

CVE-2023-32550 Landscape's Apache server-status is accessible by default

Landscape's server-status page exposed sensitive system information. This data leak included GET requests which contain information to attack and leak further information from the Landscape API...

CVE-2023-32550

The CVE-2023-32550 issue affects Landscape: Landscape’s server-status page exposes sensitive system information via GET requests, enabling leakage that could assist further attacks on the Landscape API. According to the sources, this data exposure is the primary vulnerability, with CVSS scores in...

Play ransomware gang compromises Spanish bank, threatens to leak files

Ransomware is creating additional work for a major Spanish bank. Globalcaja, said to have more than 300 offices in Spain and close to half a million customers, has fallen victim to the Play ransomware gang. The gang claim to have swiped both private and personal information in the attack--includi...

Raidforums Database Leak: Data of 460,000 Users Dumped Online

By Waqas An analysis by Hackread.com indicates that the database is legitimate since it contains details of the forum's founder, Omnipotent. This is a post from HackRead.com Read the original post: Raidforums Database Leak: Data of 460,000 Users Dumped Online...

AZL-26953 CVE-2023-0459 affecting package kernel for versions less than 5.15.116.1-1

Copyfromuser on 64-bit versions of the Linux kernel does not implement the uaccessbeginnospec allowing a user to bypass the "accessok" check and pass a kernel pointer to copyfromuser. This would allow an attacker to leak information. We recommend upgrading beyond...

Free VPN Service SuperVPN Exposes 360 Million User Records

By Habiba Rashid SuperVPN is the same free VPN service provider that leaked customers' data back in May 2022. This is a post from HackRead.com Read the original post: Free VPN Service SuperVPN Exposes 360 Million User Records...

CVE-2023-2703

Exposure of Private Personal Information to an Unauthorized Actor vulnerability in Finex Media Competition Management System allows Retrieve Embedded Sensitive Data, Collect Data as Provided by Users.This issue affects Competition Management System: before 23.07...

SUSE CVE-2023-28319

A use after free vulnerability exists in curl v8.1.0 in the way libcurl offers a feature to verify an SSH server's public key using a SHA 256 hash. When this check fails, libcurl would free the memory for the fingerprint before it returns an error message containing the now freed hash. This flaw...

CVE-2023-30281

Insecure permissions vulnerability was discovered, due to a lack of permissions’s control in scquickaccounting before v3.7.3 from Store Commander for PrestaShop, a guest can access exports from the module which can lead to leak of personnal informations from pscustomer table sush as name / surnam...

Inside Qilin Ransomware: Affiliates Take Home 85% of Ransom Payouts

Ransomware affiliates associated with the Qilin ransomware-as-a-service RaaS scheme earn anywhere between 80% to 85% of each ransom payment, according to new findings from Group-IB. The cybersecurity firm said it was able to infiltrate the group in March 2023, uncovering details about the...

Inside Qilin Ransomware: Affiliates Take Home 85% of Ransom Payouts

Ransomware affiliates associated with the Qilin ransomware-as-a-service RaaS scheme earn anywhere between 80% to 85% of each ransom payment, according to new findings from Group-IB. The cybersecurity firm said it was able to infiltrate the group in March 2023, uncovering details about the...