██████: AWS Credentials leaked: access to production database backups, SSL certs and more

I found a public accessible Jenkins instance: https://██████jenkins.██████.com This instance requires login, however, it is possible to register an account using the signup page: https://██████jenkins.██████.com/signup Arbitrary file reads From there it is possible to use the Jenkins Script Conso...

Oracle VM VirtualBox 4.3.28 - '.ovf' Crash (PoC)

Exploit Title: Oracle VM VirtualBox 4.3.28 Crash Author: sultan albalawi Tested on:win7 open viryualbox --ctrl+i--choose file --double+double+double next ban= '\x0d\x0a\x20\x20\x20\x20\x20\x20\x20\x5c\x20\x20\x20\x2d\x20\x20' ban+='\x2d\x20\x20\x2d\x20\x3c\x73\x65\x72\x76\x65\x72\x3e\x20\x20\x2d'...

Over 43 Million Weebly Accounts Hacked; Foursquare Also Hit By Data Breach

2016 is the year of data breaches that has made almost every major companies victims to the cyber attacks, resulting in compromise of over billion of online users accounts. Weebly and Foursquare are the latest victims of the massive data breach, joining the list of "Mega-Breaches" revealed in...

Massive ATM Hack Hits 3.2 Million Indian Debit Cards — Change Your PIN Now!

India is undergoing the biggest data breaches to date with as many as 3.2 Million debit card details reportedly stolen from multiple banks and financial platforms. The massive financial breach has hit India's biggest banks including State Bank of India SBI, HDFC Bank, Yes Bank, ICICI Bank and Axi...

Unspecified Vulnerability in Oracle Fusion Middleware BI Publisher Component (CNVD-2016-10064)

Oracle Fusion Middleware Oracle Fusion Middleware is a set of Oracle's Oracle business innovation platform for enterprise and cloud environments, which provides middleware, software collections, etc. BI Publisher formerly known as XML Publisher is one of the reporting components. A remote securit...

Unspecified Vulnerability in Oracle Supply Chain Products Suite Oracle Agile PLM Component (CNVD-2016-10084)

Oracle Supply Chain Products Suite is a set of supply chain solutions from Oracle, which provides value chain planning, value chain execution, product lifecycle management, etc. Oracle Agile PLM Product Lifecycle Management is one of the lifecycle management components. Oracle Agile PLM Product...

Unspecified Vulnerability in Oracle Financial Services Applications FLEXCUBE Universal Banking Component (CNVD-2016-09689)

Oracle FLEXCUBE Universal Banking is the United States Oracle Oracle company's set of real-time, online coverage of retail, group, investment banking, a comprehensive solution. The program supports multi-currency, multi-language and multi-entity operations. A remote security vulnerability exists ...

Adult FriendFinder Vulnerability Leaves Millions Exposed, Report Claims

Adult website Adult FriendFinder may have been compromised by a hacker who said he has gained access to the site’s backend servers and posted allegedly compromised data to his Twitter feed. The breach has not been confirmed by the site’s parent company FriendFinder Networks, which says it is...

Breaking — Russian Hacker Responsible for LinkedIn Data Breach Arrested by FBI

The alleged Russian hacker arrested by the FBI in collaboration with the Czech police is none other than the hacker who was allegedly responsible for massive 2012 data breach at LinkedIn, which affected nearly 117 Million user accounts. Yevgeniy N, 29-year-old Russian hacker was arrested in Pragu...

Russian Hacker who was wanted by FBI arrested in Prague

UPDATE — It Turns out that the Russian Hacker arrested by the FBI is responsible for 2012 LinkedIn Data Breach. Read latest update here Czech police, in cooperation with the FBI, has arrested a Russian citizen in Prague suspected of participating in conducting cyber-attacks against the United...

ManageEngine ServiceDesk Plus 9.2 Build 9207 - Unauthorized Information Disclosure

ManageEngine ServiceDesk Plus 9.2 Build 9207 - Unauthorized Information Disclosure Title: ManageEngine ServiceDesk Plus Low Privileged User View All Tickets Date: 18 October 2016 Author: p0z Vendor: ManageEngine Vendor Homepage: https://www.manageengine.com/ Product: ServiceDesk Plus Version: 9.2...

U.S. Reps Requesting Further Intelligence Around Yahoo Surveillance Story

Nearly 50 representatives from 27 different states are still looking to clear the air around this month’s Yahoo surveillance story. In a letter on Friday addressed to Attorney General Loretta Lynch and Director of National Intelligence James Clapper, government officials asked for clarity around...

JVN#39619137: Toshiba FlashAir does not require authentication in "Internet pass-thru Mode"

FlashAir by Toshiba Corporation is a SDHC memory card which provides "Internet pass-thru Mode", allowing devices to access the internet while connecting to FlashAir. When configured in "Internet pass-thru Mode", FlashAir acts both as a station and as an access point. When "Internet pass-thru Mode...

Verizon wants $1 Billion Discount on Yahoo Acquisition Deal after Recent Scandals

It seems like it is not all over for Yahoo yet. Another day, another bad news for Yahoo! Verizon, which has agreed to purchase Yahoo for $4.8 Billion, is now asking for a $1 Billion discount, according to recent reports. The request comes after Verizon Communications learned about the recent...

Cloud, IoT Big Factors in Annual BSIMM 7 Report

Bad software equals insecure software, and companies don’t have to accept this status quo. That’s both the takeaway and goal of Cigital’s seventh annual Building Security in Maturity Model report released Tuesday. The report reveals that the cloud, application containers, and agile software...

Yahoo Built a Secret Tool to Scan Your Email Content for US Spy Agency

Users are still dealing with the Yahoo's massive data breach that exposed over 1 Billion Yahoo accounts and there’s another shocking news about the company that, I bet, will blow your mind. Yahoo might have provided your personal data to United States intelligence agency when required. Yahoo...

Download: 68 Million Hacked Dropbox Accounts are Just a Click Away!

Over a month ago, The Hacker News reported about the Dropbox Hack, where hackers had managed to steal more than 68 Million Dropbox accounts in a data breach that was initially disclosed by the online cloud storage platform in 2012. Although the initial announcement failed to reveal the true scale...

Uh oh, Yahoo! Data Breach May Have Hit Over 1 Billion Users

The massive data breach that Yahoo! confirmed to the world last week is claimed by the company to have been carried out by a "state-sponsored actor" in 2014, which exposed the accounts of at least 500 Million Yahoo users. But, now it seems that Yahoo has downplayed a mega data breach and trying t...

Yahoo Challenged on Claims Breach Was State-Sponsored Attack

As challenges mount against Yahoo’s attribution of a massive 2014 data breach to state-sponsored hackers, CISO Bob Lord yesterday confirmed that a cache of 200 million Yahoo accounts marketed this summer in an underground forum is unrelated to the breach. Speaking at the Structure Security...

Congressional Leaders Demand Answers on Yahoo Breach

Vermont Senator Patrick Leahy, along with a number of his Democratic congressional colleagues, has demanded answers from Yahoo CEO Marissa Mayer about what is now the biggest data breach in history. Leahy called the two years between the intrusion of Yahoo’s network and the discovery and disclosu...