US cargo tech company publicly exposed its shipping systems and customer data to the web

Security researcher Eaton Zveare discovered five critical flaws in Bluspark Global’s Bluvoyix shipping platform — an unauthenticated API, API test functionality exposing commands, plaintext-stored user passwords, and the ability to create admin accounts — which together allowed retrieval of user and historical shipment data dating back to 2007; Bluspark has since remediated the issues and is planning a disclosure program, though the company says there is no indication of customer impact.