CVE-2025-41685 SMA: Sunny Portal limited disclosure of personal data of registered users to an authenticated user

A low-privileged remote attacker can obtain the username of another registered Sunny Portal user by entering that user's email address...

Azure Stack Hub Information Disclosure Vulnerability

Exposure of private personal information to an unauthorized actor in Azure Stack allows an authorized attacker to disclose information locally...

CVE-2025-7020

An incorrect encryption implementation vulnerability exists in the system log dump feature of BYD's DiLink 3.0 OS e.g. in the model ATTO3. An attacker with physical access to the vehicle can bypass the encryption of log dumps on the In-Vehicle Infotainment IVI unit's storage. This allows the...

Online portal exposed car and personal data, allowed anyone to remotely unlock cars

A carmaker’s online dealership portal has been found leaking the private information and vehicle data of its customers. This also meant that anyone with access could remotely break into a car. Researcher Eaton Zveare shared his discovery with TechCrunch. Although he said he has chosen not to...

CVE-2025-7020

An incorrect encryption implementation vulnerability exists in the system log dump feature of BYD's DiLink 3.0 OS e.g. in the model ATTO3. An attacker with physical access to the vehicle can bypass the encryption of log dumps on the In-Vehicle Infotainment IVI unit's storage. This allows the...

CVE-2025-7020

CVE-2025-7020 affects BYD DiLink 3.0 OS (e.g., ATTO3) on the In-Vehicle Infotainment storage. The issue is an incorrect encryption implementation in the system log dump feature, introduced in a patch intended to fix CVE-2024-54728. A attacker with physical access can bypass log-dump encryption an...

AI Tools Fuel Brazilian Phishing Scam While Efimer Trojan Steals Crypto from 5,000 Victims

Cybersecurity researchers are drawing attention to a new campaign that's using legitimate generative artificial intelligence AI-powered website building tools like DeepSite AI and BlackBox AI to create replica phishing pages mimicking Brazilian government agencies as part of a financially motivat...

Privacy Risk Predictions Based on Fundamental Understanding of Personal Data and an Evolving Threat Landscape

It is difficult for individuals and organizations to protect personal information without a fundamental understanding of relative privacy risks. By analyzing over 5,000 empirical identity theft and fraud cases, this research identifies which types of personal data are exposed, how frequently...

A week in security (July 21 – July 27)

A list of topics we covered in the week of July 21 to July 27 of 2025 Last week on Malwarebytes Labs: Steam games abused to deliver malware once again Watch out: Instagram users targeted in novel phishing campaign Age verification: Child protection or privacy risk? iPhone vs. Android: iPhone user...

Startup takes personal data stolen by malware and sells it on to other companies

A tech startup is using personal data stolen by infostealer malware that it has found on the dark web, and then selling access to that data. And it claims to be working within the law. According to 404 Media, for as little as $50, Farnsworth Intelligence will give companies a look at records from...

Exploit for CVE-2025-53640

CVE-2025-53640 – Authenticated User Enumeration in CERN's Indi...

Better Call routing bug can lead to Cache Deception

Summary Using a CDN that caches //.png, //.json, //.css, etc... requests, a cache deception can emerge. This could lead to unauthorized access to user sessions and personal data when cached responses are served to other users. Details The vulnerability occurs in the request processing logic where...

PT-2025-30365 · Npm · Better-Call

Summary Using a CDN that caches //.png, //.json, //.css, etc... requests, a cache deception can emerge. This could lead to unauthorized access to user sessions and personal data when cached responses are served to other users. Details The vulnerability occurs in the request processing logic where...

FBI Warns of Health Insurance Scam Stealing Personal and Medical Data

The Federal Bureau of Investigation FBI has issued a warning about a scam where criminals pretend to be…...

Many data brokers are failing to register with state consumer protection agencies

Hundreds of data brokers haven't registered with state consumer protection agencies, according to The Electronic Frontier Foundation EFF and Privacy Rights Clearinghouse PRC. There are different kinds of data brokers, but what they all have in common is that they gather personally identifiable...

Yealink RPS Information Disclosure / Man-In-The-Middle

Yealink RPS contains several vulnerabilities that can lead to leaking of PII and/or man-in-the-middle attacks. Some vulnerabilities remain unpatched even after disclosure to the manufacturer...

A Common Pool of Privacy Problems: Legal and Technical Lessons from a Large-Scale Web-Scraped Machine Learning Dataset

We investigate the contents of web-scraped data for training AI systems, at sizes where human dataset curators and compilers no longer manually annotate every sample. Building off of prior privacy concerns in machine learning models, we ask: What are the legal privacy implications of web-scraped...

The vulnerability of the Dynamics 365 FastTrack Implementation software for resource planning in Microsoft Dynamics 365 allows a hacker to disclose sensitive information.

The vulnerability of the Dynamics 365 FastTrack Implementation software for resource planning in Microsoft Dynamics 365 is related to deficiencies in access control for personal information. Exploiting this vulnerability could allow an attacker, operating remotely, to disclose protected informati...

Omise: PII Exposure via Email Confirmation Link – Email Embedded in Token & Leaked via Wayback Machine

The vulnerability involved the exposure of personally identifiable information PII, specifically email addresses, through an email confirmation link used by Omise. The email address was embedded directly in a token that was visible in the URL. This token was subsequently archived by the Wayback...

Microsoft Dynamics 365 FastTrack Implementation 安全漏洞

Microsoft Dynamics 365 FastTrack Implementation is a planning software from Microsoft Corporation USA that helps in the successful implementation of large and complex Dynamics 365 projects. A security vulnerability exists in Microsoft Dynamics 365 FastTrack Implementation that stems from the...