This Week in Security News: Air Canada and Cryptojacking

Welcome to our weekly roundup, where we share what you need to know about the cybersecurity news and events that happened over the past few days. This week, Air Canada reported a data breach that exposed passport details for more than 20,000 customers on their mobile app. Also, Trend Micro’s...

CVE-2018-6598

An issue was discovered on Orbic Wonder Orbic/RC555L/RC555L:7.1.2/N2G47H/329100b:user/release-keys devices. Any app co-located on the device can send an intent to factory reset the device programmatically because of com.android.server.MasterClearReceiver. This does not require any user interactio...

CVE-2018-6598

The CVE-2018-6598 entry concerns Orbic Wonder devices (Orbic/RC555L/RC555L:7.1.2/N2G47H/329100b:user/release-keys). A local-privilege-level issue exists where any app co-located on the device can send an intent to trigger a factory reset through com.android.server.MasterClearReceiver, without use...

artsupplywarehouse.com XSS vulnerability

Open Bug Bounty ID: OBB-660931 Description| Value ---|--- Affected Website:| artsupplywarehouse.com Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

TSMC Chip Maker Blames WannaCry Malware for Production Halt

Taiwan Semiconductor Manufacturing Company TSMC—the world's largest makers of semiconductors and processors—was forced to shut down several of its chip-fabrication factories over the weekend after being hit by a computer virus. Now, it turns out that the computer virus outbreak at Taiwan chipmake...

Unspecified Vulnerability in Oracle Supply Chain Products Suite Agile Product Lifecycle Management for Process Component

Oracle Supply Chain Products Suite is the United States Oracle Oracle company's set of supply chain solutions, the program provides value chain planning, value chain execution, product lifecycle management and other functions.Agile Product Lifecycle Management PLM for Process is one of the...

Bevy of Android Apps Harbor Hidden Malicious Windows Executables

Researchers have found up to 145 Android apps on the Google Play store infected by malicious Microsoft Windows executable files capable of planting key-loggers on Windows systems. Researchers at Palo Alto Networks’ Unit 42 said Monday that they suspect that the Android app developers involved wer...

Attack inception: Compromised supply chain within a supply chain poses new risks

A new software supply chain attack unearthed by Windows Defender Advanced Threat Protection Windows Defender ATP emerged as an unusual multi-tier case. Unknown attackers compromised the shared infrastructure in place between the vendor of a PDF editor application and one of its software vendor...

Leaky Backup Spills 157 GB of Automaker Secrets

An insecure backup protocol used by robotics firm Level One is to blame for leaking 157 gigabytes of sensitive data belonging major automakers, including Ford, Tesla and Toyota. The data included 10 years of assembly-line schematics and control settings for robotics used to build the cars, along...

ThreatList: Supply-Chain Defenses Need Improvement

Although nearly 80 percent of respondents in a recent survey believe software supply-chain attacks have the potential to become one of the biggest cyber threats over the next three years, few organizations are prepared to mitigate the risks. This state of affairs comes as businesses lose millions...

The danger of third parties: ads, pipelines, and plugins

It may or may not be comforting to know that, ultimately, bulletproof security is out of your hands. You can have the most locked down PC on Earth, have two-factor authentication 2FA set up across the board, take sensible actions to protect your personal information, and read all the EULAs under...

canadianhotelsupply.com XSS vulnerability

Open Bug Bounty ID: OBB-650126 Description| Value ---|--- Affected Website:| canadianhotelsupply.com Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

CVE-2018-3069

CVE-2018-3069 affects Oracle Agile Product Lifecycle Management for Process (Installation) within Oracle Supply Chain Products Suite. Affected version is 6.2.0.0. The vulnerability permits a high-privilege attacker with network access via HTTP to read a subset of data from Oracle Agile PLM for Pr...

CVE-2018-3069

Vulnerability in the Oracle Agile Product Lifecycle Management for Process component of Oracle Supply Chain Products Suite subcomponent: Installation. The supported version that is affected is 6.2.0.0. Easily exploitable vulnerability allows high privileged attacker with network access via HTTP t...

school-supply-list.com XSS vulnerability

Open Bug Bounty ID: OBB-649439 Description| Value ---|--- Affected Website:| school-supply-list.com Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

GDPR Is Here: How GDPR Readiness Can Boost Your Business

Most discussions about the EU’s General Data Protection Regulation GDPR have naturally focused on best practices for achieving compliance and avoiding penalties. With GDPR now a reality for all companies that store and process personal data of EU residents, an often overlooked aspect has been the...

Unspecified Vulnerability in GOAL Bonanza tradeTrap

GOAL Bonanza GOAL is a tradable Ether ERC20 token. A security vulnerability exists in the GOAL Bonanza tradeTrap. The vulnerability stems from the fact that GOAL Bonanza's smart contract implementation of the mintToken function has no expiration date constraints. The vulnerability can be exploite...

Unspecified Vulnerability in BitAsean tradeTrap

BitAsean BAS is a tradable Ether ERC20 token. A security vulnerability exists in BitAsean tradeTrap. The vulnerability stems from the fact that the mintToken function of BitAsean BAS's smart contract implementation has no expiration date constraints. The vulnerability could be exploited by an own...

Unspecified Vulnerability in Fujinto tradeTrap

Fujinto NTO is a tradable Ether ERC20 token. A security vulnerability exists in Fujinto tradeTrap. The vulnerability stems from the fact that Fujinto's smart contract implementation of the mintToken function does not have an expiration date. The vulnerability can be exploited by the owner to...

Code injection

The mintToken function of a smart contract implementation for PolyAI AI, a tradable Ethereum ERC20 token, has no period constraint, which allows the owner to increase the total supply of the digital assets arbitrarily so as to make profits, aka the "tradeTrap" issue...