Thinking about the balance between compliance and security

Today, many organizations still struggle to adhere to General Data Protection Regulation GDPR mandates even though this landmark regulation took effect nearly two years ago. A key learning for some: being compliant does not always mean you are secure. Shifting privacy regulations, combined with...

CVE-2019-16522

CVE-2019-16522 affects the WordPress plugin eu-cookie-law (versions up to 3.0.6). The issue is a Stored XSS caused by improper encoding of several admin/config and cookie message fields (Font Color, Background Color, Disable Cookie text). An attacker with high privileges can target other users. R...

ftp.metu.edu.tr GDPR PII Exposure vulnerability

Security Researcher h1yusuf Helped patch 3 vulnerabilities Received 0 Coordinated Disclosure badges , found a security vulnerability affecting ftp.metu.edu.tr website and its users. Following coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bount...

Can ordinary companies keep up with data compliance regulations?

By Waqas For many companies, data compliance regulations GDPR are a huge burden, and one that’s only getting heavier. This is a post from HackRead.com Read the original post: Can ordinary companies keep up with data compliance regulations?...

Zendesk Exposes 10,000 Accounts to Unknown Third Party

Cloud-based customer service company Zendesk notified customers that account information for 10,000 users was accessed prior to November 2016. In a note posted Wednesday, Zendesk said email addresses, user names, and phone numbers were accessed for customers and users of its Support and Chat...

UNICEF Leaks Personal Data of 8,000 Users via Email Blunder

The charity organization UNICEF inadvertently leaked the personal details of thousands of people who use its online learning portal Agora by way of an errant email sent to 20,000 inboxes. The email was accidentally sent on August 26 by UNICEF and included the names, email addresses, gender and...

Understanding CCPA: It's Time to Action a Plan for Compliance

Notice to all procrastinators: The final countdown to the California Consumer Privacy Act CCPA has begun. On January 1, 2020, companies or organizations that do business in California will be required to comply with the state's strict new privacy legislation that establishes a legal and enforceab...

WordPress WP DSGVO Tools (GDPR) plugin <= 2.2.18 - Authenticated Reflected Cross-Site Scripting (XSS) vulnerability

Authenticated Reflected Cross-Site Scripting XSS vulnerability found in WordPress WP DSGVO Tools GDPR plugin versions = 2.2.18. Solution Update the WordPress WP DSGVO Tools GDPR plugin to the latest available version at least 2.2.19...

vyfakturuj.cz GDPR PII Exposure vulnerability

Security Researcher DakkarKey Helped patch 406 vulnerabilities Received 6 Coordinated Disclosure badges Received 14 recommendations , a holder of 6 badges for responsible and coordinated disclosure, found a security vulnerability affecting vyfakturuj.cz website and its users. Following coordinate...

Hostinger Suffers Data Breach – Resets Password For 14 Million Users

Popular web hosting provider Hostinger has been hit by a massive data breach, as a result of which the company has reset passwords for all customers as a precautionary measure. In a blog post published on Sunday, Hostinger revealed that "an unauthorized third party" breached one of its servers an...

Your Business is Compliant with Data Security Regulations. It’s Still not Safe.

There has been plenty of discussion about the impact of global data regulations on data security practices. Particularly with the implementation of the EU’s GDPR last year, organizations in every industry have been scrambling to develop new security practices to avoid fines and the associated bad...

Facebook Records User Audio, Sparking Privacy Questions

Facebook has admitted that it has been transcribing audio chats between its users on its Messenger platform. Sources said that it’s paying hundreds to third-party outside contractors to do so. The latter calls into question Facebook’s data-handling practices when it comes to being open with its...

Exploiting GDPR to Get Private Information

A researcher abused the GDPR to get information on his fiancee: It is one of the first tests of its kind to exploit the EU's General Data Protection Regulation GDPR, which came into force in May 2018. The law shortened the time organisations had to respond to data requests, added new types of...

CVE-2019-14950

The wp-live-chat-support plugin before 8.0.27 for WordPress has XSS via the GDPR page...

Design/Logic Flaw

The wp-live-chat-support plugin before 8.0.27 for WordPress has XSS via the GDPR page...

CVE-2019-14950

The wp-live-chat-support plugin before 8.0.27 for WordPress has XSS via the GDPR page...

CVE-2019-14950

The wp-live-chat-support plugin for WordPress is affected by an XSS flaw in the GDPR page for versions prior to 8.0.27. The issue arises from insufficient sanitization, enabling execution of arbitrary scripts in the victim’s browser (per 2019 CVE entry and corroborated by the 2025–2026 connected ...

PT-2019-13887 · WordPress · Wp-Live-Chat-Support

Name of the Vulnerable Software and Affected Versions: wp-live-chat-support plugin versions prior to 8.0.27 Description: The issue is related to a security problem where an attacker can exploit the GDPR page to execute malicious scripts, potentially leading to unauthorized access or data theft...

No summer break for Magecart as web skimming intensifies

This summer, you are more likely to find the cybercriminal groups Magecart client-side rather than poolside. Web skimming, which consists of stealing payment information directly from within the browser, is one of today's top web threats. Magecart, the group behind many of these attacks, gained...

Countdown to Black Hat: Top 10 Sessions to Attend — #8

Black Hat kicks off in a few days, and for Qualys customers still planning their schedule we have our weekly recommendation from among the conference’s many training courses and research briefings: The Enemy Within: Modern Supply Chain Attacks. Speaker Eric Doerr, General Manager of the Microsoft...