127 matches found
Sale of 4 Million Stolen Cards Tied to Breaches at 4 Restaurant Chains
On Nov. 23, one of the cybercrime underground's largest bazaars for buying and selling stolen payment card data announced the immediate availability of some four million freshly-hacked debit and credit cards. KrebsOnSecurity has learned this latest batch of cards was siphoned from four different...
A Month After 2 Million Customer Cards Sold Online, Buca di Beppo Parent Admits Breach
On Feb. 21, 2019, KrebsOnSecurity contacted Italian restaurant chain Buca di Beppo after discovering strong evidence that two million credit and debit card numbers belonging to the company's customers were being sold in the cybercrime underground. Today, Buca's parent firm announced it had...
backbone-couch (>=0.4.0, <=0.5.4), backbone-stash (0.0.4) +3 more potentially affected by CVE-2016-10537 via backbone (0.3.3)
backbone NPM version 0.3.3 is affected by a known vulnerability. The following packages have a transitive dependency on backbone and may be impacted: - backbone-couch =0.4.0, =1.1.0, =0.4.0, =0.1.0, =1.0.0 Source cves: CVE-2016-10537 Source advisory: OSV:GHSA-J6P2-CX3W-6JCP...
ThreatList: Biggest Cybercrime Developments in 2018, So Far
Despite several successful crackdowns on several cybercriminal underworld gangs, miscreants have been highly active during the first half of 2018, according Flashpoint. According to Flashpoint’s mid-year Business Risk Intelligence report, released last month, the major developments in the...
Security Bulletin: IBM Security Access Manager appliances use some weak cryptographic algorithms for stash file encryption (CVE-2016-3019)
Summary IBM Security Access Manager appliance use password stash files, which may be encrypted using a weak encryption algorithm. Vulnerability Details CVEID: CVE-2016-3019 DESCRIPTION: IBM Security Access Manager uses weaker than expected cryptographic algorithms that could allow an attacker to...
Breach at Sonic Drive-In May Have Impacted Millions of Credit, Debit Cards
Sonic Drive-In, a fast-food chain with nearly 3,600 locations across 45 U.S. states, has acknowledged a breach affecting an unknown number of store payment systems. The ongoing breach may have led to a fire sale on millions of stolen credit and debit card accounts that are now being peddled in...
CVE-2016-6668 - The HipChat plugin for various products leaks the secret key it uses to communicate with a linked HipChat instance.
The Atlassian Hipchat Integration Plugin for Bitbucket Server exposed the secret key it used to communicate with a linked HipChat service in various administration pages. For this vulnerability to affect your Bitbucket Server instance you must have a HipChat integration established. To exploit th...
stash v1. 0. 3-background SQL injection
No description provided by source...
Stash CMS 1.0.3 SQL Injection
Document Title: =============== Stash v1.0.3 CMS - SQL Injection Vulnerability References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=1899 Release Date: ============= 2016-08-10 Vulnerability Laboratory ID VL-ID: ==================================== 1899 Common...
Stash v1.0.3 CMS - SQL Injection Vulnerability
Document Title: =============== Stash v1.0.3 CMS - SQL Injection Vulnerability References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=1899 Release Date: ============= 2016-08-10 Vulnerability Laboratory ID VL-ID: ==================================== 1899 Common...
Stash v1.0.3 CMS - SQL Injection Vulnerability
Document Title: =============== Stash v1.0.3 CMS - SQL Injection Vulnerability References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=1899 Release Date: ============= 2016-08-09 Vulnerability Laboratory ID VL-ID: ==================================== 1899 Common...
IBM MQ M2000 Appliance Information Disclosure Vulnerability
The IBM MQ M2000 Appliance is an all-in-one appliance for rapid deployment of enterprise-class messaging middleware from IBM USA. A security vulnerability exists in queue manager in IBM MQ M2000 Appliance versions prior to 8.0.0.4. A local attacker can exploit this vulnerability by leveraging the...
CVE-2015-1985
The queue manager on IBM MQ M2000 appliances before 8.0.0.4 allows local users to bypass an intended password requirement and read private keys by leveraging the existence of a stash file...
Design/Logic Flaw
The queue manager on IBM MQ M2000 appliances before 8.0.0.4 allows local users to bypass an intended password requirement and read private keys by leveraging the existence of a stash file...
CVE-2015-1985
The queue manager on IBM MQ M2000 appliances before 8.0.0.4 allows local users to bypass an intended password requirement and read private keys by leveraging the existence of a stash file...
CVE-2015-1985
Affected product: IBM MQ Appliance M2000. Vulnerability: local attacker with read authority can bypass password and read private keys by exploiting the stash file in versions prior to 8.0.0.4. Root cause: stash-file presence enabling unauthorized access to key material. Impact: potential exposure...
Project avatar resource vulnerable to XSRF
The project avatar resource accepts content type of MULTIPARTFORMDATA so a malicious attacker could use javascript to submit a form from a foreign host to a stash server and trick the user into changing the project avatar in Stash. cc David Black Atlassian - is there any reason why panopticon fou...
Project avatar resource vulnerable to XSRF
The project avatar resource accepts content type of MULTIPARTFORMDATA so a malicious attacker could use javascript to submit a form from a foreign host to a stash server and trick the user into changing the project avatar in Stash. cc David Black Atlassian - is there any reason why panopticon fou...
Expired user in Active Directory do not stop user from cloning via SSH
User who is bind with a SSH key can still clone while their account has expired on the Active Directory. However, this user will not able to login to Stash. Another scenario on the same concept works where the user bind with the SSH key is disabled in AD and that user will not be able to clone or...