This Week in Security News: Over 2,000 WordPress Accounts Compromised and Facebook to Pay $550M to Settle Class Action Case Over Facial Recognition

Welcome to our weekly roundup, where we share what you need to know about the cybersecurity news and events that happened over the past few days. This week, over two thousand WordPress sites were compromised using a malicious script that redirects visitors to scam websites. Also, read about how...

Avast acknowledges collecting user data; shuts down Jumpshot

By Waqas The anti-virus firm Avast has announced shutting down one of its subsidiaries called Jumpshot. This is a post from HackRead.com Read the original post: Avast acknowledges collecting user data; shuts down Jumpshot...

CVE-2019-4636

IBM Security Secret Server 10.7 could disclose sensitive information to an authenticated user from generated error messages. IBM X-Force ID: 170013...

New report suggests anti-virus firm Avast is selling user data to 3rd parties

By Sudais Asif It turns out Avast is using your browsing data to make big bucks. Here is what the new documents have revealed... This is a post from HackRead.com Read the original post: New report suggests anti-virus firm Avast is selling user data to 3rd parties...

Google, Mozilla Ban Hundreds of Browser Extensions in Chrome, Firefox

UPDATE Both the Google Chrome and Mozilla Firefox teams are cracking down on web browser extensions that steal user data and execute remote code, among other bad actions. Browser extensions are add-ons that users can install to enhance their web surfing experience – they offer the ability to do...

A week in security (January 20 – 26)

Last week on Malwarebytes Labs, we reported on a Ryuk ransomware attack on The Tampa Bay Times, a newspaper in Florida; unmasked an elaborate browser locking scheme behind the more advanced tech support operations that are currently active; and looked at the latest laws on regulating deepfakes...

CVE-2020-7964

An issue was discovered in Mirumee Saleor 2.x before 2.9.1. Incorrect access control in the checkoutCustomerAttach mutations allows attackers to attach their checkouts to any user ID and consequently leak user data e.g., name, address, and previous orders of any other customer...

Design/Logic Flaw

An issue was discovered in Mirumee Saleor 2.x before 2.9.1. Incorrect access control in the checkoutCustomerAttach mutations allows attackers to attach their checkouts to any user ID and consequently leak user data e.g., name, address, and previous orders of any other customer...

CVE-2020-7964

An issue was discovered in Mirumee Saleor 2.x before 2.9.1. Incorrect access control in the checkoutCustomerAttach mutations allows attackers to attach their checkouts to any user ID and consequently leak user data e.g., name, address, and previous orders of any other customer...

epj.ee Cross Site Scripting vulnerability

Open Bug Bounty ID: OBB-1073374 Security Researcher error404 Helped patch 534 vulnerabilities Received 8 Coordinated Disclosure badges Received 20 recommendations , a holder of 8 badges for responsible and coordinated disclosure, found a security vulnerability affecting epj.ee website and its...

Nord Security: User data not anonymized is sent to analytics server

A good report from @martinbydefault. Although we have never received the IDs and they could not be linked with any specific events, we have removed the connection events altogether. While, even prior to the fix, it was impossible to tie the ID with the username or activity, the reporter's concern...

The vulnerabilities of PDF viewing and editing programs such as Adobe Acrobat Document Cloud and Adobe Acrobat Reader Document Cloud, as well as Adobe Acrobat 2017 and Adobe Acrobat Reader 2017, stem from incorrect path name restrictions for restricted access catalogs. This allows attackers to disclose protected information within the context of the current user.

The vulnerability of PDF viewing and editing programs like Adobe Acrobat Document Cloud, Adobe Acrobat Reader Document Cloud, Adobe Acrobat 2017, and Adobe Acrobat Reader 2017 exists due to a flawed limitation regarding the path name to the restricted catalog. Exploiting this vulnerability can...

California's Tough New Privacy Law and Its Biggest Challenges

The California Consumer Privacy Act is being touted as one of the strongest privacy regulations in the U.S. enacted so far. However, though the CCPA was adopted on January 1, 2020, the act still has several loose ends and privacy loopholes that need to be fleshed out. At a high level ,the CCPA...

Outlook profile fails to load with Error: "Your Outlook data file cannot be configured."

Outlook profile fails to load with error "Your Outlook data file cannot be configured. C:\Users\AppData\Local\Microsoft\Outlook\ - OFFICE365.OST...

CVE-2019-19985

The WordPress plugin, Email Subscribers & Newsletters, before 4.2.3 had a flaw that allowed unauthenticated file download with user information disclosure...

WordPress Email Subscribers & Newsletters Unauthenticated File Download Vulnerability

WordPress is a blogging platform developed by the WordPress Foundation using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.Email Subscribers & Newsletters is an email subscription and newsletter plugin used in it. An unauthenticated file download vulnerabili...

The vulnerability of the S Pip content management system, related to the disclosure of user information, allows a violator to gain unauthorized access to this information.

The vulnerability of the Scribunto content management system is related to the disclosure of user information. Exploiting this vulnerability could allow a malicious actor, operating remotely, to gain unauthorized access to information...

Cross site scripting

A reflected XSS issue was discovered in DAViCal through 1.1.8. It echoes the action parameter without encoding. If a user visits an attacker-supplied link, the attacker can view all data the attacked user can view, as well as perform all actions in the name of the user. If the user is an...

PT-2019-15358 · Siemens · Sinvr/Sivms Video Server

Name of the Vulnerable Software and Affected Versions: SiNVR/SiVMS Video Server versions prior to V5.0.0 Description: A vulnerability has been identified in the HTTP service of the SiVMS/SiNVR Video Server, which contains an authentication bypass issue. This allows a remote attacker with network...

studio.focus.tv Cross Site Scripting vulnerability

Open Bug Bounty ID: OBB-1031851 Security Researcher devl00p Helped patch 2974 vulnerabilities Received 10 Coordinated Disclosure badges Received 15 recommendations , a holder of 10 badges for responsible and coordinated disclosure, found a security vulnerability affecting studio.focus.tv website...