The vulnerability of VMware vCloud Director, a platform for managing cloud storage, stems from insufficient neutralization of certain elements in requests. This allows an attacker to execute arbitrary code.

The vulnerability of the VMware vCloud Director platform for managing cloud storage repositories is related to insufficient neutralization of specific elements in the request. Exploiting this vulnerability could allow a malicious actor to execute arbitrary code remotely...

Traffic Analysis of Home Security Cameras

Interesting research on home security cameras with cloud storage. Basically, attackers can learn very basic information about what's going on in front of the camera, and infer when there is someone home. News article. Slashdot thread...

e-Commerce Site Hackers Now Hiding Credit Card Stealer Inside Image Metadata

In what's one of the most innovative hacking campaigns, cybercrime gangs are now hiding malicious code implants in the metadata of image files to covertly steal payment card information entered by visitors on the hacked websites. "We found skimming code hidden within the metadata of an image file...

Joomla Resources Directory Users Exposed in Leaky AWS Bucket

An Amazon Web Services AWS cloud storage bucket that was left open to the public internet has exposed thousands of Joomla users’ personal information. About 2,700 individuals who signed up to use the Joomla Resources Directory JRD – a community forum for finding developers and service providers...

Joomla Resources Directory (JRD) Portal Suffers Data Breach

Joomla, one of the most popular Open-source content management systems CMS, last week announced a new data breach impacting 2,700 users who have an account with its resources directory JRD website, i.e., resources.joomla.org. The breach exposed affected users' personal information, such as full...

Crooks Tap Google Firebase in Fresh Phishing Tactic

A series of phishing campaigns using Google Firebase storage URLs have surfaced, showing that cybercriminals continue to leverage the reputation of Google’s cloud infrastructure to dupe victims and skate by secure email gateways. Google Firebase is a mobile and web application development platfor...

Ansible: modules which use files encrypted with vault are not properly cleaned up

A flaw was found on Ansible Engine when using modules which decrypts vault files such as assemble, script, unarchive, wincopy, awss3 or copy modules. The temporary directory is created in /tmp leaves the secrets unencrypted. On Operating Systems which /tmp is not a tmpfs but part of the root...

L'Oréal L'Oréal Finance app has unauthorized access vulnerability

L'Oréal Finance app is the news app of L'Oréal Group, which allows users to browse the latest L'Oréal Group financial information in English and French on L'Oréal Finance. An unauthorized access vulnerability exists in the L'Oréal L'Oréal Finance app. An attacker could exploit the vulnerability t...

Malicious Package

Overview acmesmithgoogle-cloud-storage is a malicious package. Affected versions of this package were found to be a Malicious Package, as it utilised typosquatting to run Malicious 3rd party scripts. It replaced genuine packages using an and replaced it with - and vice versa Remediation Avoid usi...

Sandcastle - A Python Script For AWS S3 Bucket Enumeration

Inspired by a conversation with Instacart's @nickelser on HackerOne, I've optimised and published Sandcastle – a Python script for AWS S3 bucket enumeration, formerly known as bucketCrawler. The script takes a target's name as the stem argument e.g. shopify and iterates through a file of bucket...

CACAGOO Cloud Storage Intelligent Camera TV-288ZD-2MP Access Control Error Vulnerability

CACAGOO Cloud Storage Intelligent Camera TV-288ZD-2MP is a baby surveillance camera. A security vulnerability exists in the CACAGOO Cloud Storage Intelligent Camera TV-288ZD-2MP using firmware version 3.4.2.0919. The vulnerability can be exploited by an attacker to access the RTSP service without...

CACAGOO Cloud Storage Intelligent Camera TV-288ZD-2MP Authorization Issues Vulnerability

CACAGOO Cloud Storage Intelligent Camera TV-288ZD-2MP is a baby surveillance camera. A security vulnerability exists in the CACAGOO Cloud Storage Intelligent Camera TV-288ZD-2MP with firmware version 3.4.2.0919, which stems from the program's use of weak authentication for accessing TELNET...

CVE-2020-6852

CACAGOO Cloud Storage Intelligent Camera TV-288ZD-2MP with firmware 3.4.2.0919 has weak authentication of TELNET access, leading to root privileges without any password required...

Authentication flaw

CACAGOO Cloud Storage Intelligent Camera TV-288ZD-2MP with firmware 3.4.2.0919 has weak authentication of TELNET access, leading to root privileges without any password required...

Design/Logic Flaw

The CACAGOO Cloud Storage Intelligent Camera TV-288ZD-2MP with firmware 3.4.2.0919 allows access to the RTSP service without a password...

CVE-2020-9349

The CVE-2020-9349 entry concerns the CACAGOO Cloud Storage Intelligent Camera TV-288ZD-2MP with firmware 3.4.2.0919, where the RTSP service can be accessed without a password. This is documented across multiple sources in the connected data set (NVD, Red Hat, CNVD, etc.). The provided documents d...

CVE-2020-9349

The CACAGOO Cloud Storage Intelligent Camera TV-288ZD-2MP with firmware 3.4.2.0919 allows access to the RTSP service without a password...

CVE-2020-6852

CVE-2020-6852 affects CACAGOO Cloud Storage Intelligent Camera TV-288ZD-2MP with firmware version 3.4.2.0919, where TELNET access uses weak authentication, allowing root privileges without a password. This vulnerability is documented across multiple sources (NVD, Red Hat, CNVD, CVE lists) with th...

CVE-2020-6852

CACAGOO Cloud Storage Intelligent Camera TV-288ZD-2MP with firmware 3.4.2.0919 has weak authentication of TELNET access, leading to root privileges without any password required...

“Secure” cloud storage provider exposes customer data in plain-text

By Waqas A "secure" cloud storage provider not so "secure" for customers after all. Here's what happened and how it puts customers at risk. This is a post from HackRead.com Read the original post: "Secure" cloud storage provider exposes customer data in plain-text...