3718 matches found
Twitter Could Face $250M FTC Fine Over Improper Data Use
Twitter may be facing a Federal Trade Commission FTC fine of up to $250 million, after the social media giant last year revealed the improper use of users’ email addresses and phone numbers. In October 2019, Twitter acknowledged that user phone numbers and email addresses gathered for security...
CVE-2020-14500
The discovered bug occurs due to improper handling of some of the HTTP request headers provided by the client. This could allow an attacker to remotely exploit GateManager to achieve remote code execution without any authentication required. If carried out successfully, such an attack could resul...
GraphQL: Security breach on Viewer query
Impact An authenticated user using the viewer GraphQL query can bypass all read security on his User object and can also bypass all objects linked via relation or Pointer on his User object. Patches This vulnerability has been patched in Parse Server 4.3.0. Workarounds No References See commit...
GHSA-236H-RQV8-8Q73 GraphQL: Security breach on Viewer query
Impact An authenticated user using the viewer GraphQL query can bypass all read security on his User object and can also bypass all objects linked via relation or Pointer on his User object. Patches This vulnerability has been patched in Parse Server 4.3.0. Workarounds No References See commit...
GitLab: Ability To Delete User(s) Account Without User Interaction
Summary: Gitlab allows its user to exercise their GDPR rights Right to Access/Delete user data by sending an email to [email protected] however gitlab team doesn't ask for security questioni.e Date Of Birth before deleting the user account moreover doesn't authenticate the incoming emails...
On the Twitter Hack
Twitter was hacked this week. Not a few people's Twitter accounts, but all of Twitter. Someone compromised the entire Twitter network, probably by stealing the log-in credentials of one of Twitter's system administrators. Those are the people trusted to ensure that Twitter functions smoothly. The...
Weblate: Secret_key in GitHub
hello I have found secretkey in GitHub is public and noticed something this key have comment Make this unique, and don't share it with anybody. and it's public in GitHub also I noticed this file has coding to do the payment.db I think information like this must be private SECRETKEY =...
VPN firm that claims zero logs policy leaks 20 million user logs
By Sudais Asif The VPN company in the discussion is a Hong Kong-based UFO VPN. This is a post from HackRead.com Read the original post: VPN firm that claims zero logs policy leaks 20 million user logs...
CVE-2020-14534
The CVE-2020-14534 entry concerns Oracle E-Business Suite’s OA Framework (Popups) in version 12.2.9. A vulnerability allows an unauthenticated attacker who can reach Oracle Applications Framework over HTTP to compromise it, with human interaction required. The impact described includes potential ...
CVE-2020-15105 In Django Two-Factor Authentication, user passwords are stored in clear text in the Django session
Django Two-Factor Authentication before 1.12, stores the user's password in clear text in the user session base64-encoded. The password is stored in the session when the user submits their username and password, and is removed once they complete authentication by entering a two-factor...
Aurora DAO Security Breach
Aurora DAO AURA is a decentralized trading system for Ether ECR-20 tokens. A security vulnerability exists in AURA's Owned smart contract implementation. An attacker could exploit the vulnerability to gain ownership of the contract, causing a denial of service...
‘BlueLeaks’ Exposes Files from Hundreds of Police Departments
Hundreds of thousands of potentially sensitive files from police departments across the United States were leaked online last week. The collection, dubbed "BlueLeaks" and made searchable online, stems from a security breach at a Texas web design and hosting company that maintains a number of stat...
Google Yanks 106 ‘Malicious’ Chrome Extensions
Google removed 106 Chrome browser extensions Thursday from its Chrome Web Store in response to a report that they were being used to siphon sensitive user data. In the research, also published Thursday, Awake Security alleged millions of Chrome users have been targeted by threat actors. The...
Theft of CIA's "Vault Seven" Hacking Tools Due to Its Own Lousy Security
The Washington Post is reporting on an internal CIA report about its "Vault 7" security breach: The breach -- allegedly committed by a CIA employee -- was discovered a year after it happened, when the information was published by WikiLeaks, in March 2017. The anti-secrecy group dubbed the release...
Snake Ransomware Delivers Double-Strike on Honda, Energy Co.
The Snake ransomware has reportedly hit two high-profile companies this week: Honda and a South American energy-distribution company called Enel Argentina. In a tweet on Monday, the Honda Automobile Customer Service said it was “experiencing technical difficulties and are unavailable.” And later,...
Honda and Enel impacted by cyber attack suspected to be ransomware
Car manufacturer Honda has been hit by a cyber attack, according to a report published by the BBC, and later confirmed by the company in a tweet. Another similar attack, also disclosed on Twitter, hit Edesur S.A., one of the companies belonging to Enel Argentina which operates in the business of...
Florence, Ala. Hit By Ransomware 12 Days After Being Alerted by KrebsOnSecurity
In late May, KrebsOnSecurity alerted numerous officials in Florence, Ala. that their information technology systems had been infiltrated by hackers who specialize in deploying ransomware. Nevertheless, on Friday, June 5, the intruders sprang their attack, deploying ransomware and demanding nearly...
idnc.library.illinois.edu Cross Site Scripting vulnerability
Open Bug Bounty ID: OBB-1185566 Following coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has:       a. verified the vulnerability and confirmed its existence;       b. notified the website...
Joomla suffers security breach exposing user records
By Deeba Ahmed It total, 2,700 Joomla user records were exposed, Hackread.com has learned. This is a post from HackRead.com Read the original post: Joomla suffers security breach exposing user records...