department-stores.net Cross Site Scripting vulnerability OBB-2492237

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

US Disrupts Russian Botnet

The Justice Department announced the disruption of a Russian GRU-controlled botnet: The Justice Department today announced a court-authorized operation, conducted in March 2022, to disrupt a two-tiered global botnet of thousands of infected network hardware devices under the control of a threat...

U.S. Treasury Department Sanctions Russia-based Hydra Darknet Marketplace

The U.S. Treasury Department on Tuesday sanctioned Hydra, the same day German law enforcement authorities disrupted the world's largest and longest-running dark web marketplace following a coordinated operation in partnership with U.S. officials. The sanctions are part of an "international effort...

CISA Warns of Ongoing Cyber Attacks Targeting Internet-Connected UPS Devices

The U.S. Cybersecurity and Infrastructure Security Agency CISA and the Department of Energy DoE are jointly warning of attacks against internet-connected uninterruptible power supply UPS devices by means of default usernames and passwords. "Organizations can mitigate attacks against their UPS...

DOJ Indicts Russian Gov’t Employees Over Targeting Power Sector

The U.S. Department of Justice DOJ has indicted four Russian government employees in connection to plots to cyber-fry critical infrastructure in the United States and beyond, including at least one nuclear power plant. The campaigns involved one of the most dangerous malwares ever encountered in...

U.S. Charges 4 Russian Govt. Employees Over Hacking Critical Infrastructure Worldwide

The U.S. government on Thursday released a cybersecurity advisory outlining multiple intrusion campaigns conducted by state-sponsored Russian cyber actors from 2011 to 2018 that targeted the energy sector in the U.S. and beyond. "The Federal Security Service conducted a multi-stage campaign in...

Feds Allege Destructive Russian Hackers Targeted US Refineries

The Justice Department unsealed indictments against four alleged Russian hackers said to have targeted US energy infrastructure for nearly a decade...

CVE-2022-25490

HMS v1.0 was discovered to contain a SQL injection vulnerability via the editid parameter in department.php...

HMS SQL注入漏洞

HMS is a computer or web based hospital management system by Kabir Khyrul personal developer in Bangladesh. It helps to manage the operations of a hospital or any healthcare organization. A security vulnerability exists in HMS version 1.0 which allows an attacker to perform SQL injection through...

U.S. Dept Of Defense: SQL Injection in █████

References Impact By using SQL injection, an attacker can exfiltrate the whole database, and gain RCE System Hosts ████ Affected Products and Versions ████ CVE Numbers Steps to Reproduce POC 1 - curl command injecting query, returning database version: curl https://█████████ -X POST...

Russian State-Sponsored Cyber Actors Target Cleared Defense Contractor Networks to Obtain Sensitive U.S. Defense Information and Technology

Summary Actions to Help Protect Against Russian State-Sponsored Malicious Cyber Activity: • Enforce multifactor authentication. • Enforce strong, unique passwords. • Enable M365 Unified Audit Logs. • Implement endpoint detection and response tools. From at least January 2020, through February 202...

Journalist won’t be indicted for hacking for viewing a state website’s HTML

A journalist incorrectly branded as a "hacker" by the governor of Missouri wont be prosecuted "for hacking". This was a quick and foreseen win for St. Louis Post-Dispatch reporter Josh Renaud after a prosecutor from Cole County dismissed Missouri Governor Mike Parsons criminal charges against him...

$3.6 billion worth of Bitcoin seized from crooks tied to 2016’s Bitfinex hack

By Waqas The US Department of Justice DoJ has confirmed seizing $3.6 billion worth of Bitcoin in what could be… This is a post from HackRead.com Read the original post: $3.6 billion worth of Bitcoin seized from crooks tied to 2016s Bitfinex hack...

PrinterLogic Web Stack Server-Side Request Forgery Vulnerability

PrinterLogic Web Stack PrinterLogic Printer Installer is a native Web application from PrinterLogic, Inc. Enables the It department to manage and automate the creation/propagation of PrinterObjects and printer drivers across print environments from a single management console. PrinterLogic Web...

U.S. Authorities Charge 6 Indian Call Centers Scamming Thousands of Americans

A number of India-based call centers and their directors have been indicted for their alleged role in placing tens of millions of scam calls aimed at defrauding thousands of American consumers. The indictment charged Manu Chawla, Sushil Sachdeva, Nitin Kumar Wadwani, Swarndeep Singh, Dinesh Manoh...

Senate Committee passes new antitrust bill aimed at Big Tech companies

The American Innovation and Choice Online Act AICOA, a bill that forbids Big Tech platforms like Apple, Alphabet Google’s parent company, and Amazon from generally behaving in an anti-competitive manner, was approved by the Senate Judiciary Committee late last week with a 16-6 vote. US Senator Am...

Online Project Time Management System 1.0 - SQLi (Authenticated)

Exploit Title: Online Project Time Management System 1.0 - SQLi Authenticated Date: 19/01/2022 Exploit Author: Felipe Alcantara Filiplain Vendor Homepage: https://www.sourcecodester.com/ Software Link:...

Who is the Network Access Broker ‘Wazawaka?’

In a great many ransomware attacks, the criminals who pillage the victims network are not the same crooks who gained the initial access to the victim organization. More commonly, the infected PC or stolen VPN credentials the gang used to break in were purchased from a cybercriminal middleman know...

NSO Group’s Pegasus Spyware Used Against US State Department Officials

NSO Groups descent into Internet pariah status continues. Its Pegasus spyware was used against nine US State Department employees. We dont know which NSO Group customer trained the spyware on the US. But the company does: NSO Group said in a statement on Thursday that it did not have any indicati...

Pegasus Spyware Infects U.S. State Department iPhones

An unknown assailant planted NSO Group’s Pegasus spyware on the iPhones of at least nine U.S. State Department employees, according to four of Reuters’ sources who are familiar with the matter. Two of the sources said that the attacks took place over the last several months, hitting targets eithe...