AD Starter Scan - Kerberos Pre-authentication Validation

Binary data adsikerberospreauth.nbin...

AD Starter Scan - Blank passwords

Binary data adsiblankpwd.nbin...

Mail.ru: Read-only user can edit user segments.

Domain -- https://tracker.my.com/segment/list Testing environment -- Open two separate browsers with two independent accounts created at https://tracker.my.com/ Steps to reproduce -- In browser A 1. Log in to your account at https://tracker.my.com/ as user 1. 2. Create a new account at...

NCH Reflect CRM 信息泄露漏洞

An information disclosure vulnerability exists in NCH Reflect CRM, a customer relationship management software. The vulnerability stems from a failure to add valid access to configuration files and a failure to validate user permissions, which could be exploited by a local attacker to discover...

Busted! Fraud-as-a-Service gang that sold 2FA-proof phishing arrested

The Dutch police announced that they arrested two Dutch citizens, aged 24 and 15, for developing and selling phishing panels. The police also searched the house of another suspect, an 18 year old who was not arrested. The people behind this illegal business called themselves the Fraud Family and...

in kestasjk/webdiplomacy

✍️ Description According to previous explanation about weak cryptographic tokens, you also send the same weak token to users that forgot their passwords. here an attacker can also do Bruteforce attacks to take control of users accounts. 🕵️‍♂️ Proof of Concept...

CVE-2019-20467

An issue was discovered on Sannce Smart HD Wifi Security Camera EAN 2 950004 595317 devices. The device by default has a TELNET interface available which is not advertised or functionally used, but is nevertheless available. Two backdoor accounts root and default exist that can be used on this...

Default credentials

An issue was discovered on Sannce Smart HD Wifi Security Camera EAN 2 950004 595317 devices. The device by default has a TELNET interface available which is not advertised or functionally used, but is nevertheless available. Two backdoor accounts root and default exist that can be used on this...

CVE-2019-20467

The CVE-2019-20467 entry concerns the Sannce Smart HD Wifi Security Camera EAN 2 950004 595317. A TELNET interface is available by default (not advertised), with two backdoor accounts (root and default) whose credentials are identical across devices. Attackers can use these accounts to obtain roo...

CVE-2019-20467

An issue was discovered on Sannce Smart HD Wifi Security Camera EAN 2 950004 595317 devices. The device by default has a TELNET interface available which is not advertised or functionally used, but is nevertheless available. Two backdoor accounts root and default exist that can be used on this...

PT-2021-9032 · Sannce · Sannce Smart Hd Wifi Security Camera

Name of the Vulnerable Software and Affected Versions: Sannce Smart HD Wifi Security Camera affected versions not specified Description: An issue was discovered on Sannce Smart HD Wifi Security Camera devices, where a TELNET interface is available by default, although not advertised or functional...

CVE-2021-2364

Vulnerability in the Oracle iSupplier Portal product of Oracle E-Business Suite component: Accounts. Supported versions that are affected are 12.1.1-12.1.3 and 12.2.3-12.2.10. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle iSuppli...

Instagram Launches 'Security Checkup' to Help Users Recover Hacked Accounts

Instagram earlier this week introduced a new "Security Checkup" feature that aims to keep accounts safe and help users—whose accounts may have been compromised—to recover them. In order to gain access to accounts, users will be prompted to perform a series of steps, which include checking recent...

in ampache/ampache

✍️ Description According to PHP official documents 1 we have for mtrand function an security issue that says "This function does not generate cryptographically secure values, and should not be used for cryptographic purposes" and as we see in permalinks you use the mtrand function for generate...

ThinkCMF Cross-site Request Forgery Vulnerability

ThinkCMF is a CMS Content Management System based on ThinkPHP. thinkCMF v5.1.0 is vulnerable to cross-site request forgery, which allows attackers to add administrator accounts. No details of the vulnerability are currently available...

Bad bot activity on sports betting websites rises during Euro 2020

Across Europe, the EURO 2020 tournament captivated fans over the past month, with Italy ultimately defeating England to take home the cup on July 11. As fans eagerly watched the matches, Imperva Research Labs was busy monitoring activity that wasn’t happening on the playing field -- but across a...

ThinkCMF 跨站请求伪造漏洞

ThinkCMF is a CMS Content Management System based on ThinkPHP. thinkCMF v5.1.0 is vulnerable to cross-site request forgery, which allows attackers to add administrator accounts. No details of the vulnerability are currently available...

A week in security (July 5 – July 11)

Last week on Malwarebytes Labs: Racing against a real-life ransomware attack. Podcast with Ski Kacoroski. Kaseya CEO: “The impact of this incredibly sophisticated attack is very minimal” Patch now! Emergency fix for PrintNightmare released by Microsoft. Game over: Apex Legends players locked out ...

#NoFilter: Exposing the Tactics of Instagram Account Hackers

What tactics do Instagram account hackers use? What do these cybercriminals do with stolen accounts? How can users protect their accounts? We look into Instagram account hacking incidents from a security researcher’s perspective and share recommendations for users of Instagram and other social...

How Fake Accounts and Sneaker-Bots Took Over the Internet

Recently, one of my friends from my submarine days sent me a friend request on Facebook. The weird thing is, I was already connected with this friend. Looking further at the profile, I noticed a few of the same pictures but only 11 friends. So I knew this was some scammer and, being me, I message...