1486 matches found
U.S. Dept Of Defense: stored cross site scripting in https://βββββββ
It was observed that the application is vulnerable to cross-site scripting XSS. XSS is a type of attack that involves running a malicious scripts on a victimβs browser. poc attached another parameter at 1636345 q13787 payload: %22%27%3e%3csvg%2fonload%3dconfirm666%3e Impact Cookie Stealing - A...
Sql injection
A vulnerability was found in SourceCodester Simple Student Information System. It has been rated as critical. This issue affects some unknown processing of the file admin/departments/managedepartment.php. The manipulation of the argument id with the input...
U.S. Dept Of Defense: stored cross site scripting in https://βββ
It was observed that the application is vulnerable to cross-site scripting XSS. XSS is a type of attack that involves running a malicious scripts on a victimβs browser. poc attached another parameter at 1636345 Year Group Military Only Impact Cookie Stealing - A malicious user can steal cookies a...
U.S. Offers $10 Million Reward for Information on North Korean Hackers
The U.S. State Department has announced rewards of up to $10 million for any information that could help disrupt North Korea's cryptocurrency theft, cyber-espionage, and other illicit state-backed activities. "If you have information on any individuals associated with the North Korean...
Another ransomware payment recovered by the Justice Department
The Justice Department today announced a complaint filed in the District of Kansas to forfeit cryptocurrency paid as ransom to North Korean hackers or otherwise used to launder such ransom payments. The seized funds amounting to half a million US dollars, include ransoms paid by health care...
U.S. Dept Of Defense: Open Redirect at βββββ
Open Redirect on https://βββ User can be redirect to malicious site POC: ββββββββ/texis/search/redir.html?query=1234&pr=External+Meta&prox=page&rorder=500&rprox=500&rdfreq=500&rwfreq=250&rlead=500&rdepth=62&sufs=3&order=r&u=http://evil.com&m=0&p=2 I hope you know the impact of open redirect and...
North Korean APT targets US healthcare sector with Maui ransomware
State-sponsored North Korean threat actors have been targeting the US Healthcare and Public Health HPH sector for the past year using the Maui ransomware, according to a joint cybersecurity advisory CSA from the FBI, Cybersecurity and Infrastructure Security Agency CISA, and the Department of the...
U.S. Dept Of Defense: SQL injection at [https://βββββββββ] [HtUS]
Hello, Summary while doing test on www.βββ Iβve found that the endpoint at /olc/βββcomments/commentpost.php is vulnerable with SQL injection vulnerability Vulnerable parameters - staffstudent POC - using sqlmap run command jsx python3 sqlmap.py --level=5 --risk=3 --tamper=space2comment...
When good-faith hacking gets people arrested, with Harley Geiger: Lock and Code S03E14
When Lock and Code host David Ruiz talks to hackersβespecially good-faith hackers who want to dutifully report any vulnerabilities they uncover in their day-to-day workβhe often hears about one specific law in hushed tones of fear: the Computer Fraud and Abuse Act. The Computer Fraud and Abuse Ac...
U.S. Dept Of Defense: .git folder exposed [HtUS]
Heyy there, I have found a exposed .git folder on https://βββββ https://ββββββββ/.git/config core repositoryformatversion = 0 filemode = true bare = false logallrefupdates = true remote "origin" url = https://ββββ fetch = +refs/heads/:refs/remotes/origin/ Using gitdumper...
Report Claims Coinbase Selling User Geolocation Data to ICE
By Deeba Ahmed Tech Inquiryβs Jack Paulson has shared startling details about a 3-year contract between the US Department of Homelandβ¦ This is a post from HackRead.com Read the original post: Report Claims Coinbase Selling User Geolocation Data to ICE...
What is Shadow IT and why is it so risky?
Shadow IT refers to the practice of users deploying unauthorized technology resources in order to circumvent their IT department. Users may resort to using shadow IT practices when they feel that existing IT policies are too restrictive or get in the way of them being able to do their jobs...
What Counts as βGood Faith Security Research?β
The U.S. Department of Justice DOJ recently revised its policy on charging violations of the Computer Fraud and Abuse Act CFAA, a 1986 law that remains the primary statute by which federal prosecutors pursue cybercrime cases. The new guidelines state that prosecutors should avoid charging securit...
DOJ Seizes 3 Web Domains Used to Sell Stolen Data and DDoS Services
The U.S. Department of Justice DoJ on Wednesday announced the seizure of three domains used by cybercriminals to trade stolen personal information and facilitate distributed denial-of-service DDoS attacks for hire. This includes weleakinfo.to, ipstress.in, and ovh-booter.com, the first of which...
New York Man Sentenced to 4 Years in Transnational Cybercrime Scheme
A 37-year-old man from New York has been sentenced to four years in prison for buying stolen credit card information and working in cahoots with a cybercrime cartel known as the Infraud Organization. John Telusma, who went by the alias "Peterelliot," had previously pleaded guilty to one count of...
Twitter Fined $150 Million for Misusing Users' Data for Advertising Without Consent
Twitter, which is in the process of being acquired by Tesla CEO Elon Musk, has agreed to pay $150 million to the U.S. Federal Trade Commission FTC to settle allegations that it abused non-public information collected for security purposes to serve targeted ads. In addition to the monetary penalty...
The Justice Department Will No Longer Charge Security Researchers with Criminal Hacking
Following a recent Supreme Court ruling, the Justice Department will no longer prosecute "good faith" security researchers with cybercrimes: The policy for the first time directs that good-faith security research should not be charged. Good faith security research means accessing a computer solel...
U.S. Warns Against North Korean Hackers Posing as IT Freelancers
Highly skilled software and mobile app developers from the Democratic People's Republic of Korea DPRK are posing as "non-DPRK nationals" in hopes of landing freelance employment in an attempt to enable the regime's malicious cyber intrusions. That's according to a joint advisory from the U.S...
Cardiologist Charged for Developing Jigsaw v.2 and Thanos Ransomware
By Deeba Ahmed The multi-tasking physician ran a Ransomware-as-a-Service and rented dangerous ransomware to cybercriminals. The US Department of Justice has unsealed a⦠This is a post from HackRead.com Read the original post: Cardiologist Charged for Developing Jigsaw v.2 and Thanos Ransomware...
Surveillance by Driverless Car
San Francisco police are using autonomous vehicles as mobile surveillance cameras. Privacy advocates say the revelation that police are actively using AV footage is cause for alarm. βThis is very concerning,β Electronic Frontier Foundation EFF senior staff attorney Adam Schwartz told Motherboard...