Pentagon Subcontractor Inadvertently Leaks 11 Gigs of Sensitive Data

A slew of sensitive data pertaining to psychologists, doctors and other healthcare professionals involved with an arm of the U.S. Department of Defense was recently left unsecured online. Chris Vickery, a security researcher with MacKeeper who has stumbled across unsecured internal databases...

FTC Releases Alert on Fake Apps for Mobile Devices

The Federal Trade Commission FTC has released an alert on fraudulent mobile apps designed to exploit consumers. Some fake apps may steal personal information such as credit card numbers. By taking precautions, users can protect themselves and their private data. US-CERT encourages users and...

Multiple Stored XSS Vulnerabilities in Journalx 2.0, a Remote Processing System for Journal Manuscripts

Journalx 2.0 is an independently developed platform for remote processing of journal manuscripts developed by Beijing Magtech. Journalx 2.0 contains multiple stored XSS vulnerabilities. The vulnerabilities can be exploited by an attacker to submit data with js code on the personal information pag...

U.S. Dept Of Defense: Personal information disclosure on a DoD website

A Department of Defense website was mis-configured in a manner that could have exposed personal information. Thanks for notifying us of this, @spam404! IDOR exposing PII...

eFront 3.6.15: Steal your professors password

RIPS Analysis Our SAST tool RIPS analyzed the whole application in only 1m 32s and uncovered many severe security issues. Most of them are straight-forward SQL Injections that can be used to extract confidential user data, such as passwords, private messages, course results, and personal...

Uber Portal Leaked Names, Phone Numbers, Email Addresses, Unique Identifiers

A series of vulnerabilities in UberCENTRAL, a portal Uber started during the summer to help businesses facilitate rides for customers, could have leaked the names, phone numbers, email addresses, and unique ID of all Uber users. Kevin Roh, a student who actively hunts for bugs in his spare time,...

3 Mobile UK Hacked – 6 Million Customers' Private Data at risk

Three, one of UK's biggest mobile operators, has become the latest victim of a massive data breach that reportedly left the personal information and contact details of 6 Million of its customers exposed. The company admitted the data breach late Thursday, saying that computer hackers gained acces...

Android Banking Trojan Tricks Victims into Submitting Selfie Holding their ID Card

While some payment card companies like Mastercard have switched to selfies as an alternative to passwords when verifying IDs for online payments, hackers have already started taking advantage of this new security verification methods. Researchers have discovered a new Android banking Trojan that...

OLX: Name, email, phone and more disclosure on user ID (API)

Hello, When I checked the OLX.pl app, I found out that when I click on a profile, personal information like email or phonenumber is exposed. GET https://ssl.olx.pl/api/v1/users/1/ HTTP/1.1 Host: ssl.olx.pl Cookie: PHPSESSID=hb6utlcj860nd7p2jt6ha0tu71 Connection: keep-alive Accept: / Version: v1.1...

Yahoo Reportedly to Confirm Breach of Hundreds of Millions of Credentials

Yahoo is expected to confirm a data breach that exposed hundreds of millions of credentials dating back four years. A report published today by Recode intimates that the total number of exposed credentials will be higher than the 200 million initially reported in early August. A request for comme...

FTC Releases Data Breach Recovery and Prevention Video

The Federal Trade Commission FTC has released a step-by-step video to users whose personal information may have been exposed in a data breach. This video provides instruction on how to report an incident and develop a personal recovery plan after a data breach has occurred. US-CERT encourages use...

Guccifer 2.0 Leaks Personal Info of Nearly 200 Congressional Democrats

The hacker, who recently claimed responsibility for the high-profile hack of Democratic National Committee DNC, has now taken credit for hacking into the Democratic Congressional Campaign Committee DCCC as well. To prove his claims, the hacker, going by the moniker Guccifer 2.0, dumped on Friday...

Instacart: Authentication Bypass in Updating Personal Information

Hello Instacart, Firstly, I would like to remind you that I made this report by mail 2 days ago, Sat, 16-08-2016 before I got the invite here. Although a user is expected to input password before updating their personal information. This is not so anyway as I have found that one could actually...

Breached Credentials Used to Access Github Repositories

Github is forcing a password reset on some of its users after it detected a number of successful intrusions into its repositories using credentials compromised in other breaches. “This appears to be the result of an attacker using lists of email addresses and passwords from other online services...

Github accounts Hacked in 'Password reuse attack'

Popular code repository site GitHub is warning that a number of users' accounts have been compromised by unknown hackers reusing email addresses and passwords obtained from other recent data breaches. Yes, GitHub has become the latest target of a password reuse attack after Facebook CEO Mark...

drchrono: User with no permissions can access full wdcalendar feed

Hi All, I've found a vulnerability related to access the calendar when a user has no permissions. Vulnerability I've create a doctor's account with a user who has no permission. Browsing the site, I noticed a call to...

Google Trust API plans to replace your Passwords with Trust Score

The importance of increasing online security around personal information has risen due to the increase in cyber attacks and data breaches over recent years. I find it hilarious people are still choosing terrible passwords to protect their online accounts. The massive LinkedIn hack is the latest i...

Reflective XSS Vulnerability in EasyCMS Enterprise Marketing Management System Administration Backend

EasyCMS is a web content management system based on PHP+Mysql architecture. A reflective XSS vulnerability exists in the administration backend of the EasyCMS enterprise marketing management system, which can be exploited by an attacker to submit data with js code on the personal information page...

IRS Warns Taxpayers About Scams as Tax Deadline Approaches

The Internal Revenue Service IRS has issued a press release to warn of a potential increase in scams targeting taxpayers around the April 18 tax deadline. Before and after the deadline, scammers may tempt or pressure taxpayers into revealing personal information. US-CERT and IRS recommend taxpaye...

Information on 50 Million Turkish Citizens Dumped Online

Turkey’s communications minister this week is denying reports that personally identifiable information of 50 million of the country’s citizens has been leaked online. On Monday hackers published what they claim is a Turkish citizenship database, a cache of information downloadable via BitTorrent,...