6621 matches found
CVE-2019-15224
The rest-client gem 1.6.10 through 1.6.13 for Ruby, as distributed on RubyGems.org, included a code-execution backdoor inserted by a third party. Versions =1.6.14 are unaffected...
How much personalization is too much?
This story originally ran in The Parallax on January 25, 2019, and was written by Dan Tynan. In 2012, when Target used data analytics to identify customers who were expecting a baby, then mailed them coupons for maternity clothing and nursery furniture, it inadvertently revealed a teenage girl’s...
Semrush: Github information leaked
Researcher has found the third-party repository with test data for internal services development...
Code execution backdoor in rest-client (Contains Malicious Code)
The rest-client gem 1.6.13 for Ruby, as distributed on RubyGems.org, included a code-execution backdoor inserted by a third party...
Clickjacking Evolves to Hook Millions of Top-Site Visitors
Clickjacking, where links on a website redirect unknowing users to spam, advertising or malware, has been around for decades. However, new tactics that defy the best mitigation efforts of browsers has led to it affecting millions of internet users browsing the web’s top sites, researchers found i...
Kaspersky Antivirus Flaw Exposed Users to Cross-Site Tracking Online
In this digital era, the success of almost every marketing, advertising, and analytics company drives through tracking users across the Internet to identify them and learn their interests to provide targeted ads. Most of these solutions rely on 3rd-party cookies, a cookie set on a domain other th...
Facebook Records User Audio, Sparking Privacy Questions
Facebook has admitted that it has been transcribing audio chats between its users on its Messenger platform. Sources said that it’s paying hundreds to third-party outside contractors to do so. The latter calls into question Facebook’s data-handling practices when it comes to being open with its...
Vanilla: Stealing the ip addres from users
Hi team! Summary Pixel that steals your data. By creating an image in https://iplogger.org/ and inserting it in the forum we can steal some data ip, language, geo location of the users who see the message. Steps to reproduce + Set "wyswyg" on + Create an image from https://iplogger.org/ and use t...
Alleviating Digital Transformation Performance and Security Concerns
Businesses across the world are migrating applications to the cloud to reduce IT cost and complexity, and accelerate the pace of innovation. But when you move applications and services to the cloud you lose visibility and control over your infrastructure, increasing risk and uncertainty. That's w...
Binance KYC Data Leak — Crypto Exchange Sets $290,000 Bounty On Blackmailer
Malta-based cryptocurrency exchange Binance has become a victim of a ransom demand from a scammer who claimed to have hacked the KYC Know Your Customer data of thousands of its customers. The unknown attacker threatened the world's largest cryptocurrency exchange by volume to release KYC...
[SECURITY] Fedora 29 Update: python3-3.7.4-1.fc29
Python is an accessible, high-level, dynamically typed, interpreted program ming language, designed with an emphasis on code readability. It includes an extensive standard library, and has a vast ecosystem of third-party libraries. The python3 package provides the "python3" executable: the...
CVE-2019-7849
A defense-in-depth check was added to mitigate inadequate session validation handling by 3rd party checkout modules. This impacts Magento 1.x prior to 1.9.4.2, Magento Commerce prior to 1.14.4.2, Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9 and Magento 2.3 prior to 2.3.2...
Open Redirect
Overview Versions of serveprior to 11.3.2 are vulnerable to Open Redirect. The package redirected requests to third-party websites for URLs such as localhost:5000//example.com/index. The user would be redirected to example.com. Recommendation Upgrade to version 11.3.2 or later. References...
GHSA-RQP5-PG7W-832P datagrid contains code Injection backdoor
The datagrid gem 1.0.6 for Ruby, as distributed on RubyGems.org, included a code-execution backdoor inserted by a third party...
GHSA-WG6J-R28M-7293 Code backdoor in simple_captcha2
The simplecaptcha2 gem 0.2.3 for Ruby, as distributed on RubyGems.org, included a code-execution backdoor inserted by a third party...
Countdown to Black Hat: Top 10 Sessions to Attend — #8
Black Hat kicks off in a few days, and for Qualys customers still planning their schedule we have our weekly recommendation from among the conference’s many training courses and research briefings: The Enemy Within: Modern Supply Chain Attacks. Speaker Eric Doerr, General Manager of the Microsoft...
Node.js third-party modules: Command Injection vulnerability in kill-port-process package
I would like to report a command injection vulnerability in the kill-port-process package. It allows an attacker to inject arbitrary commands. Module module name: kill-port-process version: 1.1.0 npm page: https://www.npmjs.com/package/kill-port-process Module Stats 0 downloads in the last day 13...
CVE-2019-14282
The simplecaptcha2 gem 0.2.3 for Ruby, as distributed on RubyGems.org, included a code-execution backdoor inserted by a third party...
