OESA-2021-1097 apr security update

Security Fixes: An out-of-bounds array dereference was found in aprtimeexpget. An attacker could abuse an unvalidated usage of this function to cause a denial of service or potentially lead to data leak.CVE-2017-12613...

What Really Caused Facebook's 500M-User Data Leak?

The company's explanations have been confusing and inconsistent, but there are finally some answers...

Potential sensitive information disclosed in error reports

django-registration is a user-registration application for Django. Impact The django-registration package provides tools for implementing user-account registration flows in the Django web framework. In django-registration prior to 3.1.2, the base user-account registration view did not properly...

533 Million Facebook Users' Phone Numbers and Personal Data Leaked Online

In what's likely to be a goldmine for bad actors, personal information associated with approximately 533 million Facebook users worldwide has been leaked on a popular cybercrime forum for free—which was harvested by hackers in 2019 using a Facebook vulnerability. The leaked data includes full...

533 Million Facebook Users' Phone Numbers and Personal Data Leaked Online

In what's likely to be a goldmine for bad actors, personal information associated with approximately 533 million Facebook users worldwide has been leaked on a popular cybercrime forum for free—which was harvested by hackers in 2019 using a Facebook vulnerability. The leaked data includes full...

ASB-A-174150451

In avrcprocvendorcommand of avrcapi.cc, there is a possible leak of heap data due to uninitialized data. This could lead to remote information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation...

Hacker claims stealing 8.2TB of MobiKwik data; leaks some online

By Waqas Fintech platform MobiKwik is being criticized for hiding a data breach that exposed nearly 8.2TB of data, including sensitive records. This is a post from HackRead.com Read the original post: Hacker claims stealing 8.2TB of MobiKwik data; leaks some online...

nss: Check length of inputs for cryptographic primitives

A vulnerability was discovered in nss where input text length was not checked when using certain cryptographic primitives. This could lead to a heap-buffer overflow resulting in a crash and data leak. The highest threat is to confidentiality and integrity of data as well as system availability...

Rocket.Chat: REST API gets `query` as parameter and executes it

Summary: Any user with 'view-d-room' permission can access any except users.services data from the users collection Description: The "users.list" REST endpoint gets a query parameter from JSON and runs Users.findqueryFromClientSide. This means virtually any authenticated user can access any data...

Call Center Provider Experiences Major Data Leak

By Habiba Rashid The exposed data was being updated in realtime with new logs while 1.48 million robocall logs were accessed by researchers initially. This is a post from HackRead.com Read the original post: Call Center Provider Experiences Major Data Leak...

Firm calls cops on researcher for responsibly disclosing data leak

By Habiba Rashid While white-hat hackers get paid for reporting flaws this particular researcher was reported to the police after responsibly disclosing a data leak. This is a post from HackRead.com Read the original post: Firm calls cops on researcher for responsibly disclosing data leak...

SQL Injection Vulnerability in SongCMS PHP Version of Guangdong Kegel Technology Limited (CNVD-2021-24954)

SongCMS is a PHP MySQL, ASP Access/SQL Server based development, enterprise-oriented, multi-language support, free, open source CMS to help business users to quickly build and deploy enterprise-level portals. A SQL injection vulnerability exists in the PHP version of SongCMS by Guangdong Kager...

Online trading broker FBS exposes 20TB of data with 16 billion records

By Waqas The leaked data also included unredacted credit cards and passports of millions of users around the world. This is a post from HackRead.com Read the original post: Online trading broker FBS exposes 20TB of data with 16 billion records...

REvil hackers demand $50M from Acer after threatening to leak data

By Habiba Rashid The biggest ransomware attack in history was observed on 18th March when cybercrime syndicate REvil demanded $50M from tech giant Acer. This is a post from HackRead.com Read the original post: REvil hackers demand $50M from Acer after threatening to leak data...

Security update for connman (moderate)

openSUSE Security Update: Security update for connman Announcement ID: openSUSE-SU-2021:0452-1 Rating: moderate References: 1181751 Cross-References: CVE-2021-26675 CVE-2021-26676 CVSS scores: CVE-2021-26675 NVD : 8.8 CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVE-2021-26676 NVD : 6.5...

CVE-2021-20634

CVE-2021-20634 is an improper access control vulnerability in Cybozu Office Custom App, affecting versions 10.0.0–10.8.4. An authenticated attacker can bypass access restrictions to obtain the Custom App date via unspecified vectors. The issue is documented across multiple feeds (NVD/Red Hat/CNVD...

nss: Check length of inputs for cryptographic primitives

A vulnerability was discovered in nss where input text length was not checked when using certain cryptographic primitives. This could lead to a heap-buffer overflow resulting in a crash and data leak. The highest threat is to confidentiality and integrity of data as well as system availability...

USN-4869-1 aria2 vulnerability

It was discovered that aria2 could accidentally leak authentication data. An attacker could possibly use this to gain access to sensitive information...

USN-4813-1 jackson-databind vulnerabilities

It was discovered that Jackson Databind incorrectly handled deserialization. An attacker could possibly use this issue to obtain sensitive information. CVE-2018-11307, CVE-2019-12086, CVE-2019-12814 It was discovered that Jackson Databind incorrectly handled deserialization. An attacker could...

Updated ansible packages fix security vulnerability

User data leak in snmpfacts module CVE-2021-20178. Multiple collections exposed secured values CVE-2021-20191. In basic.py, nolog with fallback option CVE-2021-20228. The ansible package has been patched to fix these issues...