CVE-2022-2921

Exposure of Private Personal Information to an Unauthorized Actor in GitHub repository notrinos/notrinoserp prior to v0.7. This results in privilege escalation to a system administrator account. An attacker can gain access to protected functionality such as create/update companies, install/update...

CVE-2024-34706

Valtimo is an open source business process and case management platform. When opening a form in Valtimo, the access token JWT of the user is exposed to api.form.io via the the x-jwt-token header. An attacker can retrieve personal information from this token, or use it to execute requests to the...

CVE-2024-29184

FreeScout is a self-hosted help desk and shared mailbox. A Stored Cross-Site Scripting XSS vulnerability has been identified within the Signature Input Field of the FreeScout Application prior to version 1.8.128. Stored XSS occurs when user input is not properly sanitized and is stored on the...

CVE-2024-2472

The LatePoint Plugin plugin for WordPress is vulnerable to unauthorized access of data and modification of data due to a missing capability check on the 'startorusesessionforcustomer' function in all versions up to and including 4.9.9. This makes it possible for unauthenticated attackers to view...

Valley News Live exposed more than a million job seeker’s resumes

Making your own bad news is not what Valley News Live had in mind, but negligence comes at a price. Cybernews researchers found an unprotected AWS S3 bucket that belongs to Take Valley News Live, a North Dakota-based television station. Gray Television, the owner of Valley News Live, makes for th...

Social Engineering to Disable iMessage Protections

I am always interested in new phishing tricks, and watching them spread across the ecosystem. A few days ago I started getting phishing SMS messages with a new twist. They were standard messages about delayed packages or somesuch, with the goal of getting me to click on a link and entering some...

Avery had credit card skimmer stuck on its site for months

The consequences of a wave of credit card skimmers—which is normal around the holidays—are starting to show. Label maker Avery has filed a data breach notification, saying 61,193 people may have had their credit card details stolen. On December 9, Avery said it became aware of an attack on its...

The vulnerability of the integrated environment for managing the development lifecycle of IBM Jazz Foundation lies in its lack of access control for personal information, allowing attackers to disclose protected information.

The vulnerability of the integrated environment for managing the development lifecycle of IBM Jazz Foundation is related to deficiencies in restricting access to personal information. Exploiting this vulnerability could allow attackers to disclose protected information...

BayMark Health Services sends breach notifications after ransomware attack

BayMark Health Services, Inc. BayMark notified an unknown number of patients that attackers stole their personal and health information. BayMark profiles itself as North America’s largest provider of medication-assisted treatment MAT for substance use disorders helping tens of thousands of...

Out With the Old, In With the New: Securely Disposing of Smart Devices

So, what did you get for Christmas this year? Hopefully you received some cool smart technology, or maybe you just upgraded your smart camera or voice assistant to a newer model or version. If you upgraded to a new model or version, what is your plan for the old device? Is it still working or is ...

Our Santa wishlist: Stronger identity security for kids

Sorry for the headline, but we have to get creative to get anyone to read an article on a Friday like this one, even if it is an important story. As we enter the holidays and parents begin to rest after another hectic year of shopping for their kids, Malwarebytes Labs wants to draw some attention...

Google Calendar Phishing Scam Targets Users with Malicious Invites

Protect yourself from sophisticated phishing attacks that leverage Google Calendar to steal your personal information...

The vulnerability of the Ruijie Reyee OS operating system, related to deficiencies in access control to personal information, allows attackers to disclose protected information.

The vulnerability of the Ruijie Reyee OS is related to deficiencies in access control for personal information. Exploiting this vulnerability can allow a malicious actor to disclose protected information...

5 million payment card details stolen in painful reminder to monitor Christmas spending

Another day, another exposed S3 bucket. This time, 5 million US credit cards and personal details were leaked online. The Leakd.com security team discovered that 5 terabytes of sensitive screenshots were exposed in a freely accessible Amazon S3 bucket. An S3 bucket is like a virtual file folder i...

CVE-2024-10476

Default credentials are used in the above listed BD Diagnostic Solutions products. If exploited, threat actors may be able to access, modify or delete data, including sensitive information such as protected health information PHI and personally identifiable information PII. Exploitation of this...

Hackers Demand Ransom in Rhode Island Health System Data Breach

In a major cyberattack, the state of Rhode Island has fallen victim to a security breach potentially exposing the personal information of thousands of residents...

FBI Busts Rydox Marketplace with 7,600 PII Sales, Cryptocurrency Worth $225K Seized

The U.S. Department of Justice DoJ on Thursday announced the shutdown of an illicit marketplace called Rydox "rydox.ru" and "rydox.cc" for selling stolen personal information, access devices, and other tools for conducting cybercrime and fraud. In tandem, three Kosovo nationals and administrators...

Scammers Exploit Fake Domains in Dubai Police Phishing Scams

BforeAI has discovered a surge in phishing attacks targeting the Dubai Police, a government-run entity. Learn how cybercriminals are exploiting the Dubai Police name to steal personal information and money...

CVE-2024-12306

Multiple access control vulnerabilities in Unifiedtransform version 2.0 and potentially earlier versions allow unauthorized access to personal information of students and teachers. The vulnerabilities include both function-level access control issues in list viewing endpoints and object-level...

CVE-2024-12306

CVE-2024-12306 concerns multiple access control vulnerabilities in Unifiedtransform, affecting version 2.0 and earlier. The issues include function-level access controls in list endpoints and object-level access controls in profile endpoints, enabling a malicious student to view personal informat...