www1.oab.org.br GDPR PII Exposure vulnerability

Open Bug Bounty ID: OBB-1157778 Following coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: &nbsp&nbsp&nbsp&nbsp&nbsp&nbspa. verified the vulnerability and confirmed its existence; &nbsp&nbsp&nbsp&nbsp&nbsp&nbspb. notified the website...

Data privacy law updates eyed by Singapore

In early 2019, Singapore’s data privacy regulators proposed that the country’s data privacy law could use two new updates—a data breach notification requirement and a right of data portability for the country’s residents. The proposed additions are commonplace in several data privacy laws around...

blocs.xarxanet.org GDPR PII Exposure vulnerability

Open Bug Bounty ID: OBB-1154831 Security Researcher a13h1 Helped patch 3 vulnerabilities Received 0 Coordinated Disclosure badges Received 5 recommendations , found a security vulnerability affecting blocs.xarxanet.org website and its users. Following coordinated and responsible vulnerability...

GDPR Compliance Site Leaks Git Data, Passwords

A website that gives advice on privacy regulation compliance has fixed a security issue that was exposing MySQL database settings — including passwords — to anyone on the internet. The website, GDPR.EU, is an advice site for organizations that are struggling to comply with the General Data...

WP GDPR <= 2.1.1 - Multiple Unauthenticated Issues

The plugin is affected by multiple issues, and has been closed from WP repo: - Unauthenticated Stored XSS - Unauthenticated Content spoofing - Unauthenticated Arbitrary comment deletion - Unauthenticated plugin's settings update...

WordPress WP GDPR plugin <= 2.1.1 - Unauthenticated Content Spoofing vulnerability

Unauthenticated Content Spoofing vulnerability discovered by NinTechNet in WordPress WP GDPR plugin versions = 2.1.1. Solution This plugin has been closed as of October 23, 2019 and is not available for download. Reason: Security Issue...

WordPress WP GDPR plugin <= 2.1.1 - Unauthenticated Stored Cross-Site Scripting (XSS) vulnerability

Unauthenticated Stored Cross-Site Scripting XSS vulnerability discovered by NinTechNet in WordPress WP GDPR plugin versions = 2.1.1. Solution This plugin has been closed as of October 23, 2019 and is not available for download. Reason: Security Issue...

WordPress WP GDPR plugin <= 2.1.1 - Unauthenticated Plugin Settings Update vulnerability

Unauthenticated Plugin Settings Update vulnerability discovered by NinTechNet in WordPress WP GDPR plugin versions = 2.1.1. Solution This plugin has been closed as of October 23, 2019 and is not available for download. Reason: Security Issue...

WordPress WP GDPR plugin <= 2.1.1 - Unauthenticated Arbitrary Comment Deletion vulnerability

Unauthenticated Arbitrary Comment Deletion vulnerability discovered by NinTechNet in WordPress WP GDPR plugin versions = 2.1.1. Solution This plugin has been closed as of October 23, 2019 and is not available for download. Reason: Security Issue...

Privacy by design: Building customer trust

Historically, the question of privacy has been the domain of the legal community. This makes perfect sense, because privacy has its roots almost exclusively in laws and regulations. The EU General Data Protection Regulation GDPR, the California Consumer Privacy Act CCPA, and similar regulations...

sberbank-uploads.chatbot.ba GDPR PII Exposure vulnerability

Open Bug Bounty ID: OBB-1146386 Security Researcher dubstard Helped patch 0 vulnerabilities Received 0 Coordinated Disclosure badges , found a security vulnerability affecting sberbank-uploads.chatbot.ba website and its users. Following coordinated and responsible vulnerability disclosure...

What Worries CISOs Most

From acquisitions to GDPR compliance, we interviewed a group of CISOs and IT security leaders to find out just what’s been keeping you and your peers up at night...

A week in security (March 30 – April 5)

Last week on Malwarebytes Labs, we offered readers tips for safe online shopping now that cybercriminals are ramping up Internet-based attacks, showed the impact that GDPR has around the world, and helped users understand how social media platforms mine their personal data. We also hosted our...

GDPR: An impact around the world

A little more than one month after the European Union enacted the General Data Protection Regulation GDPR to extend new data privacy rights to its people, the governor of California signed a separate, sweeping data protection law that borrowed several ideas from GDPR, sparking a torch in a...

cknuckles.com GDPR PII Exposure vulnerability

Open Bug Bounty ID: OBB-1119636 Security Researcher MrBug Helped patch 0 vulnerabilities Received 0 Coordinated Disclosure badges , found a security vulnerability affecting cknuckles.com website and its users. Following coordinated and responsible vulnerability disclosure guidelines of the ISO...

Popular ThemeREX WordPress Plugin Opens Websites to RCE

A critical vulnerability in a WordPress plugin known as “ThemeREX Addons” could open the door for remote code execution in tens of thousands of websites. According to Wordfence, the bug has been actively exploited in the wild as a zero-day. The plugin, which is installed on approximately 44,000...

Popular ThemeREX WordPress Plugin Opens Websites to RCE

A critical vulnerability in a WordPress plugin known as “ThemeREX Addons” could open the door for remote code execution in tens of thousands of websites. According to Wordfence, the bug has been actively exploited in the wild as a zero-day. The plugin, which is installed on approximately 44,000...

A week in security (March 2 – 8)

Last week on Malwarebytes Labs, we fired up part 1 of our series on child identity theft, asked how well law enforcement can deal with cybercriminals, and took a trip down the memory lane of moral panic. We also looked at the positives and negatives of VPNs and examined our own progress in the...

Facebook's Download-Your-Data Tool Is Incomplete

Privacy International has the details: Key facts: Despite Facebook claim, "Download Your Information" doesn't provide users with a list of all advertisers who uploaded a list with their personal data. As a user this means you can't exercise your rights under GDPR because you don't know which...

RSAC 2020: Blockchain is 'Garbage In', Voting Needs Paper Ballots

SAN FRANCISCO – Cryptography is at the heart of security, especially here at this week’s RSAC 2020. And during the event’s annual Cryptographer’s Panel, industry leaders broke down their top crypto-concerns, including privacy regulations, election security and blockchain. Privacy is clearly a top...