Latest Information Disclosure news

GitHub.com rotates its exposed private SSH key

GitHub has rotated its private SSH key for GitHub.com after the secret was was accidentally published in a public GitHub repository. The software development and version control service says, the private RSA key was only "briefly" exposed, but that it took action out of "an abundance of caution."
- Ax Sharma
- March 24, 2023
- 04:33 AM
- 0
Money Lover for Android & iOS leaked email addresses, transactions

A flaw in the Money Lover financial app for Android, iOS, and Windows allowed any logged-in member to see the email addresses and live transaction metadata for other users' shared wallets.
- Bill Toulas
- February 08, 2023
- 10:57 AM
- 0
VMware fixes critical ESXi and vRealize security flaws

VMware released security updates to address a critical-severity vulnerability impacting ESXi, Workstation, Fusion, and Cloud Foundation, and a critical-severity command injection flaw affecting vRealize Network Insight.
- Bill Toulas
- December 14, 2022
- 12:46 PM
- 0
Security advisory accidentally exposes vulnerable systems

A security advisory for a vulnerability (CVE) published by MITRE has accidentally been exposing links to remote admin consoles of over a dozen vulnerable IP devices since at least April 2022.
- Ax Sharma
- July 06, 2022
- 03:20 PM
- 0
DPD Group parcel tracking flaw may have exposed customer data

An unauthenticated API call vulnerability in DPD Group's package tracking system could have been exploited to access the personally identifiable details of its clients.
- Bill Toulas
- February 07, 2022
- 05:30 PM
- 0
Safari bug leaks your Google account info, browsing history

There's a problem with the implementation of the IndexedDB API in Safari's WebKit engine, which could result in leaking browsing histories and even user identities to anyone exploiting the flaw.
- Bill Toulas
- January 17, 2022
- 08:47 AM
- 0
Firmware attack can drop persistent malware in hidden SSD area

Korean researchers have developed a set of attacks against some solid-state drives (SSDs) that could allow planting malware in a location that's beyond the reach of the user and security solutions.
- Bill Toulas
- December 30, 2021
- 09:55 AM
- 0
Researchers discover 14 new data-stealing web browser attacks

IT security researchers from Ruhr-Universität Bochum (RUB) and the Niederrhein University of Applied Sciences have discovered 14 new types of 'XS-Leak' cross-site leak attacks against modern web browsers, including Google Chrome, Microsoft Edge, Safari, and Mozilla Firefox.
- Bill Toulas
- December 03, 2021
- 10:34 AM
- 0
Misconfigured Apache Airflow servers leak thousands of credentials

Researchers discovered many misconfigured or outdated Apache Airflow instances over the web leaking sensitive information, including credentials, from well-known tech companies. Apache Airflow is a popular open-source workflow management platform for organizing and managing tasks.
- Ax Sharma
- October 04, 2021
- 10:00 AM
- 0
RaidForums data marketplace accidentally exposes private staff page

Underground marketplace and hacker forum, Raidforums, recently exposed internal pages from its website, meant for staff members only. Raidforums is a data breach marketplace where threat actors often sell or leak illicitly obtained data dumps.
- Ax Sharma
- September 22, 2021
- 08:05 AM
- 1
Chase bank accidentally leaked customer info to other customers

Chase Bank has admitted to the presence of a technical bug on its online banking website and app that allowed accidental leakage of customer banking information to other customers.
- Ax Sharma
- August 17, 2021
- 01:37 AM
- 1
Ford bug exposed customer and employee records from internal systems

A bug on Ford's website allowed for accessing sensitive systems and obtaining proprietary data, such as customer databases, employee records, internal tickets, etc. The data exposure stemmed from a misconfigured instance of Pega customer engagement system running on Ford's servers.
- Ax Sharma
- August 15, 2021
- 09:15 AM
- 0
Bugs in gym management software let hackers wipe fitness history

Security researchers found vulnerabilities in the Wodify fitness platform that allows an attacker to view and modify user workouts from any of the more than 5,000 gyms that use the solution worldwide.
- Ionut Ilascu
- August 13, 2021
- 10:18 AM
- 0
Northern Ireland suspends vaccine passport system after data leak

Northern Ireland's Department of Health (DoH) has temporarily halted its COVID-19 vaccine certification web service and mobile apps following a data exposure incident.
- Ax Sharma
- July 28, 2021
- 06:50 AM
- 1
Twitter Tip Jar may expose PayPal address, sparks privacy concerns

This week Twitter has begun experimenting with a new feature called 'Tip Jar,' which lets Twitter users tip select profiles to support their work.. But the feature has sparked multiple concerns among Twitter users: from the sender's PayPal shipping address getting exposed, to how are disputes handled.
- Ax Sharma
- May 07, 2021
- 09:11 AM
- 0
Twilio discloses impact from Codecov supply-chain attack

Cloud communications company Twilio has now disclosed that the recent Codecov supply-chain attack exposed a small number of Twilio's customer email addresses.
- Ax Sharma
- May 04, 2021
- 12:39 PM
- 0
Codecov starts notifying customers affected by supply-chain attack

Codecov has now started notifying the maintainers of software repositories affected by the recent supply-chain attack. These notifications, delivered via both email and the Codecov application interface, state that the company believes the affected repositories were downloaded by threat actors.
- Ax Sharma
- April 30, 2021
- 02:43 AM
- 0
Intel fixes vulnerabilities in Windows, Linux graphics drivers

Intel addressed 57 vulnerabilities during this month's Patch Tuesday, including high severity ones impacting Intel Graphics Drivers.
- Sergiu Gatlan
- February 11, 2021
- 10:02 AM
- 0
Typeform fixes Zendesk Sell form data hijacking vulnerability

Online survey and form creator Typeform has quietly patched a data hijacking vulnerability in its Zendesk Sell integration. If exploited, the vulnerability could let attacks redirect the form submissions containing potentially sensitive information to themselves.
- Ax Sharma
- January 11, 2021
- 10:46 AM
- 0
United Nations data breach exposed over 100k UNEP staff records

This week, researchers have responsibly disclosed a vulnerability by exploiting which they could access over 100K private records of United Nations Environmental Programme (UNEP). The data breach stemmed from exposed Git directories which let researchers clone Git repositories and gather PII of a large number of employees.
- Ax Sharma
- January 11, 2021
- 01:52 AM
- 5