CVE-2023-49371

RuoYi up to v4.6 was discovered to contain a SQL injection vulnerability via /system/dept/edit...

RuoYi Security Breach

RuoYi is a backend management system for individual developers of RuoYi in China. A security vulnerability exists in RuoYi v4.6 and earlier versions, which originates from a SQL injection vulnerability in /system/dept/edit...

U.S. Treasury Sanctions Sinbad Cryptocurrency Mixer Used by North Korean Hackers

The U.S. Treasury Department on Wednesday imposed sanctions against Sinbad, a virtual currency mixer that has been put to use by the North Korea-linked Lazarus Group to launder ill-gotten proceeds. "Sinbad has processed millions of dollars' worth of virtual currency from Lazarus Group heists,...

OPSEC failures when threat hunting

Over the last few years I’ve carried out a lot of phishing, and have some interesting observations on how organisations respond. However, the purpose of this blog is to highlight a worrying and amusing trend in response actions taken by the blue team and researchers when threat hunting a phishing...

Exploit for Uncontrolled Resource Consumption in Siemens 6Bk1602-0Aa12-0Tp0_Firmware

Log4Shell CVE-2021-44228 minecraft demo This demo is used at...

Error: "HdxSdkErrorDomain_Session error 8" when launching desktop from iPad device.

Error: "HdxSdkErrorDomainSession error 8" when launching desktop from iPad device. Error message in Japanese: 「接続エラー サーバエラー。サーバはセッションを切断しました。」 「継続的なエラー 次の情報をIT部門にお知らせください：操作を完了できませんでした。HdxSdkErrorDomainSessionエラー8」...

CVE-2023-5928

A vulnerability was found in Campcodes Simple Student Information System 1.0 and classified as critical. Affected by this issue is some unknown functionality of the file /admin/departments/managedepartment.php. The manipulation of the argument id leads to sql injection. The exploit has been...

PT-2023-32426 · Campcodes · Campcodes Simple Student Information System

Name of the Vulnerable Software and Affected Versions: Campcodes Simple Student Information System version 1.0 Description: A critical issue was found in the system, affecting some unknown functionality of the file /admin/departments/manage department.php. The manipulation of the id argument lead...

Contractor Database Leak Exposes 500K Irish Police Vehicle Seizure Records

By Waqas This marks the fourth data security incident to affect a UK police department in 2023. This is a post from HackRead.com Read the original post: Contractor Database Leak Exposes 500K Irish Police Vehicle Seizure Records...

NSA AI Security Center

The NSA is starting a new artificial intelligence security center: The AI security centers establishment follows an NSA study that identified securing AI models from theft and sabotage as a major national security challenge, especially as generative AI technologies emerge with immense...

U.S. Dept Of Defense: Subdomain Takeover via Host Header Injection on www.█████

The vulnerability was a subdomain takeover due to a CNAME record pointing to an unclaimed domain. This allowed malicious individuals to potentially take control of the affected subdomain and use it for malicious purposes...

Chinese Hackers Are Hiding in Routers in the US and Japan

Plus: Stolen US State Department emails, $20 million zero-day flaws, and controversy over the EU’s message-scanning law...

Chinese Hackers Stole 60,000 US State Department Emails from Microsoft

By Deeba Ahmed Chinese hackers have struck again! This is a post from HackRead.com Read the original post: Chinese Hackers Stole 60,000 US State Department Emails from Microsoft...

US and UK Mount Aggressive Crackdown on Trickbot and Conti Ransomware Gangs

Authorities have sanctioned 11 alleged members of the cybercriminal groups, while the US Justice Department unsealed three federal indictments against nine people accused of being members...

U.S. Hacks QakBot, Quietly Removes Botnet Infections

The U.S. government today announced a coordinated crackdown against QakBot, a complex malware family used by multiple cybercrime groups to lay the groundwork for ransomware infections. The international law enforcement operation involved seizing control over the botnets online infrastructure, and...

Tornado Cash Founders Charged in Billion-Dollar Crypto Laundering Scandal

The U.S. Justice Department DoJ on Wednesday unsealed an indictment against two founders of the now-sanctioned Tornado Cash cryptocurrency mixer service, charging them with laundering more than $1 billion in criminal proceeds. Both the individuals, Roman Storm and Roman Semenov, have been charged...

Gallagher Command Centre Server 安全漏洞

Gallagher Command Center Server is a management system from Gallagher New Zealand for monitoring and managing infrastructure in buildings. A security vulnerability exists in Gallagher Command Centre Server versions v8.80 through v8.80.1192 MR2, v8.70 through v8.70.2185 MR4, v8.60 through v8.60.23...

fldep.dep.state.fl.us Cross Site Scripting vulnerability OBB-3534740

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

Microsoft Expands Cloud Logging to Counter Rising Nation-State Cyber Threats

Microsoft on Wednesday announced that it's expanding cloud logging capabilities to help organizations investigate cybersecurity incidents and gain more visibility after facing criticism in the wake of a recent espionage attack campaign aimed at its email infrastructure. The tech giant said it's...

VirusTotal Data Leak Exposes Some Registered Customers' Details

Data associated with a subset of registered customers of VirusTotal, including their names and email addresses, were exposed after an employee inadvertently uploaded the information to the malware scanning platform. The security incident, which comprises a database of 5,600 names in a 313KB file,...