MobiKwik Suffers Major Breach — KYC Data of 3.5 Million Users Exposed

Popular Indian mobile payments service MobiKwik on Monday came under fire after 8.2 terabytes TB of data belonging to millions of its users began circulating on the dark web in the aftermath of a major data breach that came to light earlier this month. The leaked data includes sensitive personal...

Why do companies fail to stop breaches despite soaring IT security investment?

Let's first take a look back at 2020! Adding to the list of difficulties that surfaced last year, 2020 was also grim for personal data protection, as it has marked a new record number of leaked credentials and PI data. A whopping 20 billion records were stolen in a single year, increasing 66% fro...

Amazon Fixes Alexa Glitch That Could Have Divulged Personal Data

UPDATE Vulnerabilities in Amazon’s Alexa virtual assistant platform could allow attackers to access users’ personal information, like home addresses – simply by persuading them to click on a malicious link. Researchers with Check Point found several web application flaws on Amazon Alexa subdomain...

PT-2020-7995

Name of the Vulnerable Software and Affected Versions: Mattermost Server versions prior to 3.2.0 Description: An issue was discovered in the Mattermost Server where the initial load API endpoint disclosed unnecessary personal information. Recommendations: For versions prior to 3.2.0, update to...

SUSE-SU-2020:0721-1 Security update for MozillaThunderbird

This update for MozillaThunderbird fixes the following issues: MozillaThunderbird was updated to 68.6.0 ESR MFSA 2020-10 bsc1166238 - CVE-2020-6805: Fixed a use-after-free when removing data about origins - CVE-2020-6806: Fixed improper protections against state confusion - CVE-2020-6807: Fixed a...

U.S. Charges 4 Chinese Military Hackers Over Equifax Data Breach

The United States Department of Justice today announced charges against 4 Chinese military hackers who were allegedly behind the Equifax data breach that exposed the personal and financial data of nearly 150 million Americans. In a joint press conference held today with the Attorney General Willi...

PT-2020-10396 · WordPress · Give Wordpress Plugin

Name of the Vulnerable Software and Affected Versions: Give versions prior to 2.5.5 Description: A flaw in the Give WordPress plugin allowed unauthenticated users to bypass API authentication methods, accessing personally identifiable user information PII, including names, addresses, IP addresses...

Over 100 Million JustDial Users' Personal Data Found Exposed On the Internet

An unprotected database belonging to JustDial , India's largest local search service, is leaking personally identifiable information of its every customer in real-time who accessed the service via its website, mobile app, or even by calling on its fancy "88888 88888" customer care number, The...

It’s Not Daddy Calling

How I found vulnerabilities that could put the safety of children in jeopardy How it started A friend recently showed me a tracker watch that he’d purchased for his son. It offered useful functionality such as two-way calling, and the accompanying app allowed him to track the location of his son...

CVE-2017-5425

The Gecko Media Plugin sandbox allows access to local files that match specific regular expressions. On OS OX, this matching allows access to some data in subdirectories of "/private/var" that could expose personal or temporary data. This has been updated to not allow access to "/private/var" and...

Passwords For 540,000 Car Tracking Devices Leaked Online

Another day, another news about a data breach, though this is something disconcerting. Login credentials of more than half a million records belonging to vehicle tracking device company SVR Tracking have leaked online, potentially exposing the personal data and vehicle details of drivers and...

PaulShop Stored Cross-Site Scripting Vulnerability

PaulShop is a shopping cart web system. PaulShop firstname, lastname, address, city, state, zipcode, phone, fax, deliveryaddress, deliverycity, deliverystate, deliveryzipcode Parameter-stored cross-site scripting vulnerability. An attacker can insert malicious js code into a page to obtain user...

Novel Attack Tricks Servers to Cache And Expose Personal Data

LAS VEGAS—Researcher Omer Gil has devised a way to trick a web server into caching pages and exposing personal data. The so-called web caching attack targets sites that use content delivery network CDN services such as Akamai and Cloudflare. These services act as traffic load balancers and revers...

Database of Over 198 Million U.S. Voters Left Exposed On Unsecured Server

Information on more than 198 Million United States citizens, that's over 60% of the US population, was exposed in what's believed to be the largest ever known exposure of voter-related to date. This blunder was caused by Deep Root Analytics DRA, a data analytics firm employed by the US Republican...

AIO AIO in-car Android App CAPTCHA has design flaws

Shenzhen Dudu Intelligent Technology Co., Ltd. is an innovative technology enterprise focusing on intelligent in-vehicle systems, high-end in-vehicle wearable devices and the construction of car networking ecosystem. AIO AIO in-vehicle Android App verification code has design flaws, attackers can...

The vulnerability of the Moodle learning management system allows a hacker to gain access to personal contact information and details about unread messages.

The vulnerability of the Moodle learning management system’s sub-component message/index.php is related to the lack of protection for administrative data. Exploiting this vulnerability could allow a malicious actor, operating remotely, to gain access to personal contact information and details...

SquirrelMail 1.x - Email Header HTML Injection

source: https://www.securityfocus.com/bid/10439/info SquirrelMail is reported to be prone to an email header HTML injection vulnerability. This issue is due to a failure of the application to properly sanitize user-supplied email header strings. An attacker can exploit this issue to gain access t...

Security Advisory - MyTaxexpress 2003

Original Advisory: Tuesday, March 25, 2003 Severity: Medium - High Description: Unencrypted tax-return information saved in C:My Documents by default can pose security risks, and may disclose financial/personal information to the Internet via peer-to-peer P2P networks. Version: Tested on the...

eBay web site allows intruders to login to gain unauthorized access to user's information

Overview Ebay www.ebay.comis a popular online auction site. A vulnerability in the ebay web site prior to April 24, 2002, could have allowed an intruder to gain access to a victim's personal data. Description Prior to April 24, 2002, an intruder may have been able to gain access to certain person...