PT-2019-6510

Name of the Vulnerable Software and Affected Versions pixelpost versions 1.7.1 through 1.7.1-5 Description The issue is related to Cross-Site Scripting XSS. XSS is a type of security vulnerability that allows an attacker to inject malicious scripts into a website, potentially allowing them to ste...

ThreatList: Google's Advertising Network Dominates Global Data Collection

When it comes to data collection, Google’s combined arsenal of advertising tools and services continue to help it dominate at a global level. Close behind are AOL Advertising, Moat and AppNexus. Each are singled out by researchers in new report that brings to mind the privacy-busting quote, “If...

Data collectors

Who owns data owns the world. And with the Internet taking over much of our daily lives, it has become far easier and faster to receive, collect, and analyze data. The average user cannot even imagine how much data gets collected on them. Besides technical information for example, about a...

CVE-2019-16698

The CVE-2019-16698 issue affects the TYPO3 Direct Mail extension (direct_mail) up to version 5.2.2. A missing access check in the backend module allows a user with restricted permissions (to fe_users) to view and export data of frontend newsletter subscribers. The condition is an information-disc...

WordPress ThemeMakers Goodnex Premium Responsive theme Information Disclosure Vulnerability

WordPress is a blogging platform developed by the WordPress Foundation using the PHP language. The platform supports setting up personal blog sites on PHP and MySQL servers.ThemeMakers Goodnex Premium Responsive theme is a responsive website theme plugin used in it. A security vulnerability exist...

WordPress ThemeMakers GamesTheme Premium theme information leakage vulnerability

WordPress is a blogging platform developed by the WordPress Foundation using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.ThemeMakers GamesTheme Premium theme is a responsive website theme plugin used in it. A security vulnerability exists in WordPress...

WordPress ThemeMakers SmartIT Premium Responsive theme Information Disclosure Vulnerability

WordPress is a blogging platform developed by the WordPress Foundation using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.ThemeMakers SmartIT Premium Responsive theme is a responsive website theme plugin used in it. A security vulnerability exists in...

WordPress ThemeMakers Blessing Premium Responsive theme Information Disclosure Vulnerability

WordPress is a blogging platform developed by the WordPress Foundation using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.ThemeMakers Blessing Premium Responsive theme is a religious website theme plugin used in it. A security vulnerability exists in...

Information Disclosure in extension "Direct Mail" (direct_mail)

A missing access check in the backend module of the extension allows a backend user without access to configured tables e.g. feusers, ttaddress to view and export data of users subscribed to a newsletter...

PT-2019-13547

Name of the Vulnerable Software and Affected Versions OX App Suite versions 7.10.1 through 7.10.2 Description The issue allows for cross-site scripting XSS, which is a type of attack where an attacker can inject malicious scripts into a website, potentially allowing them to steal user data or tak...

PT-2019-14937

Name of the Vulnerable Software and Affected Versions Client Dash plugin version 2.1.4 Description The issue allows for cross-site scripting XSS, which is a type of attack that can be used to steal user data or take control of user sessions. Recommendations For Client Dash plugin version 2.1.4,...

You Gave Your Phone Number to Twitter for Security and Twitter Used it for Ads

After exposing private tweets, plaintext passwords, and personal information for hundreds of thousands of its users, here is a new security blunder social networking company Twitter admitted today. Twitter announced that the phone numbers and email addresses of some users provided for two-factor...

Acronis: Delete any user's added Email,Telephone,Fax,Address,Skype via csrf in (https://academy.acronis.com/)

The vulnerability allowed an attacker to delete any user's added email, telephone, fax, address, and Skype via CSRF in a GET method without any CSRF protection on the Academy Acronis website. This could be exploited by an attacker to delete sensitive information of any user. The issue was fixed b...

Malicious Package

Overview Version 2.0.10 of json-serializer contained malicious code. The code when executed in the browser would enumerate password, cvc, cardnumber fields from forms and send the extracted values to https://js-metrics.com/minjs.php?pl= Recommendation Remove the package from your environment and...

Malicious Package

Overview Version 1.0.3 of bmap contained malicious code. The code when executed in the browser would enumerate password, cvc, cardnumber fields from forms and send the extracted values to https://js-metrics.com/minjs.php?pl= Recommendation If version 1.0.3 of this module is found installed you wi...

ns.borzasiasociatii.ro Improper Access Control vulnerability

Open Bug Bounty ID: OBB-984875 Security Researcher onuratali Helped patch 99 vulnerabilities Received 3 Coordinated Disclosure badges , a holder of 3 badges for responsible and coordinated disclosure, found a security vulnerability affecting ns.borzasiasociatii.ro website and its users. Following...

Comodo Forums Hack Exposes 245,000 Users' Data — Recent vBulletin 0-day Used

If you have an account with the Comodo discussion board and support forums, also known as ITarian Forum, you should change your password immediately. Cybersecurity company Comodo has become one of the major victims of a recently disclosed vBulletin 0-day vulnerability, exposing login account...

Exclusive — Hacker Steals Over 218 Million Zynga 'Words with Friends' Gamers Data

A Pakistani hacker who previously made headlines earlier this year for selling almost a billion user records stolen from nearly 45 popular online services has now claimed to have hacked the popular mobile social game company Zynga Inc. With a current market capitalization of over $5 billion, Zyng...

Exclusive — Hacker Steals Over 218 Million Zynga 'Words with Friends' Gamers Data

A Pakistani hacker who previously made headlines earlier this year for selling almost a billion user records stolen from nearly 45 popular online services has now claimed to have hacked the popular mobile social game company Zynga Inc. With a current market capitalization of over $5 billion, Zyng...

CVE-2019-11747

The "Forget about this site" feature in the History pane is intended to remove all saved user data that indicates a user has visited a site. This includes removing any HTTP Strict Transport Security HSTS settings received from sites that use it. Due to a bug, sites on the pre-load list also have...