1486 matches found
U.S. Dept Of Defense: ███ on https://████ enable ███ scraping, injection, stored XSS
Summary: An open ████████ at the ████████ system enables quick and easy scraping of ███ without authentication nor authorization. Description: The █████ includes an open set of ██████endpoints at https://██████████. Any individual can execute requests on these endpoints without authorization nor...
Bomb Threat, DDoS Purveyor Gets Eight Years
A 22-year-old North Carolina man has been sentenced to nearly eight years in prison for conducting bomb threats against thousands of schools in the U.S. and United Kingdom, running a service that launched distributed denial-of-service DDoS attacks, and for possessing sexually explicit images of...
Trump Fires Security Chief Christopher Krebs
President Trump on Tuesday fired his top election security official Christopher Krebs no relation. The dismissal came via Twitter two weeks to the day after Trump lost an election he baselessly claims was stolen by widespread voting fraud. Chris Krebs. Image: CISA. Krebs, 43, is a former Microsof...
Firing of CISA Chief Christopher Krebs Widely Condemned
Government officials and cybersecurity experts alike condemned President Trump’s firing of Christopher Krebs by tweet Tuesday, as the director of the Cybersecurity and Infrastructure Security Agency CISA became the latest victim of the president’s housecleaning efforts after his failed bid at a...
This Week in Security News: Ransomware Gang is Raking in Tens of Millions of Dollars and Microsoft Patch Tuesday Update Fixes 17 Critical Bugs
Welcome to our weekly roundup, where we share what you need to know about cybersecurity news and events that happened over the past few days. This week, learn about a ransomware group that walked away with 2,200 Bitcoin: More than $33 million based on the current Bitcoin exchange rate. Also, read...
southoldfd.com Cross Site Scripting vulnerability OBB-1485728
Following coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has:       a. verified the vulnerability and confirmed its existence;       b. notified the website operator about its existence...
$100M Botnet Scheme Lands Cybercriminal 8 Years in Jail
Authorities have sentenced a hacker to eight years in prison for trafficking stolen personally identifiable information PII and online banking credentials resulting in losses totaling over $100 million. Aleksandr Brovko, 36, formerly of the Czech Republic, pleaded guilty in February to conspiracy...
[SECURITY] Fedora 32 Update: lout-3.40-18.fc32
Lout is a document formatting system designed and implemented by Jeffrey Kingston at the Basser Department of Computer Science, University of Sydney, Australia. The system reads a high-level description of a document similar in style to LaTeX and produces a PostScript file which can be printed on...
Fedora: Security Advisory for lout (FEDORA-2020-869cd99560)
The remote host is missing an update for the Copyright C 2020 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...
Microsoft’s SMBGhost Flaw Still Haunts 108K Windows Systems
More than 100,000 Windows systems have not yet been updated to protect against a previously-patched, critical and wormable flaw in Windows called SMBGhost. Microsoft patched the remote code-execution RCE flaw bug tracked as CVE-2020-0796 back in March; it affects Windows 10 and Windows Server 201...
COVID-19 Vaccine-Maker Hit with Cyberattack, Data Breach
COVID-19 vaccine manufacturer Dr. Reddy’s Laboratories has shut down its plants in Brazil, India, Russia, the U.K. and the U.S. following a cyberattack, according to reports. The Indian company is the contractor for Russia’s “Sputinik V” COVID-19 vaccine, which is about to enter Phase 2 human...
US Indicts Sandworm, Russia's Most Destructive Cyberwar Unit
The Department of Justice has named and charged six men for allegedly carrying out many of the most costly cyberattacks in history...
BEC Attacks: Nigeria No Longer the Epicenter as Losses Top $26B
A study of more than 9,000 instances of business email compromise BEC attacks all over the world shows that the number has skyrocketed over the past year, and that the social-engineering scam has expanded well beyond its historic roots in Nigeria. The report from Agari’s Cyber Intelligence Divisi...
Silent Librarian Goes Back to School with Global Research-Stealing Effort
The Silent Librarian campaign has re-emerged for the fall school session, actively targeting students and faculty at universities via spear-phishing campaigns. The threat group also known as TA407 and Cobalt Dickens, which operates out of Iran, has been on the prowl since the start of the 2019...
U.S. Dept Of Defense: Access to Unclassified / FOUO Advanced Motion Platform of █████████.mil
Hey, I have recently found a website in the namespace of the Amazon Web Services cloud for the US government which exposes a classification header of Unclassified / FOUO. Hence, I thought it might be a good idea to report this vulnerability to you. Furthermore, the source code tells us that the...
U.S. Dept Of Defense: XSS Reflect to POST █████
XSS to POST URL = █████████ Good morning team DoD.. I located an XSS on the site. I hope to help team DoD more and more. Thank you html Impact If an attacker can control a script that is executed in the victim's browser, then they can typically fully compromise that user. Amongst other things, th...
Video-Game Piracy Group 'Team Xecuter' Leaders in Custody
The Department of Justice DoJ has nabbed two alleged leaders of a global, notorious video-game piracy group called Team Xecuter. The two leaders in custody, Max Louarn 48, a French national of Avignon and Gary Bowser 51, a Canadian national from Santo Domingo, Dominican Republic, allegedly led th...
Researchers Mixed on Sanctions for Ransomware Negotiators
Ransomware negotiators may have to pay up in new ways if they intercede with cybercriminals on companies’ behalf. Several researchers weighed in on the wisdom of the move, with mixed reactions. The U.S. Department of the Treasury said Thursday that companies that facilitate ransomware payments to...
Department of Treasury Releases Advisory on Potential Sanctions Risks for Facilitating Ransomware Payments
The U.S. Department of the Treasury’s Office of Foreign Assets Control OFAC has released an Advisory on Potential Sanctions Risks for Facilitating Ransomware Payments. Financial institutions, cyber insurance firms, and companies that facilitate payments on behalf of victims may be violating OFAC...
Microsoft: Attackers Exploiting ‘ZeroLogon’ Windows Flaw
Microsoft warned on Wednesday that malicious hackers are exploiting a particularly dangerous flaw in Windows Server systems that could be used to give attackers the keys to the kingdom inside a vulnerable corporate network. Microsofts warning comes just days after the U.S. Department of Homeland...