The top six takeaways for user privacy

Last week, Malwarebytes Labs began closing out our data privacy and cybersecurity law blog series, a two-month long exploration spanning five continents, 50 states, just as many data breach notification laws, three non-universal definitions of personal information and personal data, five pending ...

Lenovo Watch app has multiple vulnerabilities

Shenzhen Personal Data Management Service Co., Ltd. is for analyzing and mining the value behind personal habits, preferences, and health, and becoming a scene service and content operator based on personal data. The Lenovo Watch app has multiple vulnerabilities that can be exploited by attackers...

Mysterious database exposed personal information of 80 million US households

Word has broken of yet another massive data trove exposed for anyone to see. A research team from vpnMentor discovered an exposed 24GB database hosted on a Microsoft cloud server containing the addresses, income levels, and marital statuses of users within 80 million US households. As we’ve seen...

Oversharing and safety in the age of social media

Many years ago, I worked with healthcare organizations to install infrastructure to support the modernization of their information systems. As I traversed hospitals – both in public and private sectors – I was often struck by one particular best practice: the privacy reminders were ubiquitous. If...

Amazon Employees Given 'Broad Access' to Personal Alexa Info

Employees at Amazon can access geolocation information for Alexa users, according to reports – thus uncovering their home addresses and even satellite pictures of their houses generated from a service such as Google Earth. Alexa is the built-in voice assistant shipped with devices like Amazon Ech...

Weak Password Vulnerability in Learning to Pay App

Learn to Pay is an online payment tool that specializes in serving the training industry. Provides recharge, payment, cash withdrawal and guaranteed transaction services. A weak password vulnerability exists in the Learning to Pay APP, which can be exploited by attackers to obtain users' personal...

Is Privacy Really iPhone? Researchers Weigh in on Apple's Targeted Ad Tracking

Apple has a consistent track record of implementing privacy controls, which it has been touting via a series of saturating “Privacy? That’s iPhone” television ads. Yet, though it may be deservedly capitalizing on the increasing privacy-consciousness of consumers out there and the negative headlin...

Explained: like-farming

Like-farming, aka like-harvesting, is a method used by commercial parties and scammers alike to raise the popularity of a site or domain. The ultimate dream of every like-farmer is for his post to go viral by accumulating as many likes and shares as possible from all over the world. Like-farmers...

Yahoo Offers $117.5M Settlement in Data Breach Lawsuit

Yahoo is offering to cough up $117.5 million to settle a lawsuit regarding its massive data breaches that compromised the personal information of three billion users. The new $117.5 million settlement, filed Tuesday in the U.S. District Court in San Jose, comes after the internet company’s first...

Georgia Tech Data Breach Exposes 1.3 Million Users' Personal Data

The Georgia Institute of Technology, well known as Georgia Tech, has confirmed a data breach that has exposed personal information of 1.3 million current and former faculty members, students, staff and student applicants. In a brief note published Tuesday, Georgia Tech says an unknown outside...

Synology Application Service Information Disclosure Vulnerability

Synology Application Service is a Synology NAS Network Storage Server feature extension framework from Synology, Inc. An information disclosure vulnerability exists in SYNO.Personal.Application.Info in Synology Application Service versions prior to 1.5.4-0320, which can be exploited by an...

Medical Weed Dispensary Exposes Health Data for Thousands

A data breach at a medical marijuana dispensary company operating in Canada has sent the personal health privacy of about 34,000 patients up in smoke. An electronic medical record system used by Natural Health Services – a self-described “cannabinoid medical clinic that specializes in cannabis...

CVE-2019-10027

PHPCMS 9.6.x through 9.6.3 has XSS via the mailbox aka E-mail field on the personal information screen...

CVE-2019-10027

PHPCMS 9.6.x through 9.6.3 has XSS via the mailbox aka E-mail field on the personal information screen...

Code injection

PHPCMS 9.6.x through 9.6.3 has XSS via the mailbox aka E-mail field on the personal information screen...

PHPCMS Cross-Site Scripting Vulnerability

PHPCMS is a web content management system based on PHP and Mysql architecture. The system includes modules such as news, pictures, downloads, information and products. A cross-site scripting vulnerability exists in PHPCMS versions 9.6.x through 9.6.3. A remote attacker can exploit this...

CVE-2019-10027

PHPCMS 9.6.x–9.6.3 is affected by a cross-site scripting (XSS) vulnerability in the mailbox (E-mail) field on the personal information screen. The root cause is described as XSS, but the provided documents do not specify the exact vulnerable code path, affected components, or versions beyond 9.6....

Knight Talent System has xss vulnerability

Knight Talent System is based on PHP + MYSQL as the core development of a set of free + open source professional recruitment system. Knight Talent System suffers from a cross-site scripting vulnerability. An attacker can use this vulnerability to embed malicious code in a web page to obtain users...

CVE-2018-17483

Lobby Track Desktop could allow a local attacker to obtain sensitive information, caused by an error in Reports while in kiosk mode. By visiting the kiosk and viewing the driver's license column, an attacker could exploit this vulnerability to view the driver's license number and other personal...

Information disclosure

Lobby Track Desktop could allow a local attacker to obtain sensitive information, caused by an error in Reports while in kiosk mode. By visiting the kiosk and viewing the driver's license column, an attacker could exploit this vulnerability to view the driver's license number and other personal...