Private Details of 240,000 DHS Employees Accessed after Data Breach

By Uzair Amir A data breach targeted towards the Department of Homeland Security This is a post from HackRead.com Read the original post: Private Details of 240,000 DHS Employees Accessed after Data Breach...

justice.gov.dnstree.com XSS vulnerability

On the 29.12.2017 security researcher reported a XSS vulnerability affecting the justice.gov.dnstree.com website via the Open Bug Bounty coordinated vulnerability disclosure program. Coordinated Disclosure Timeline: Description| Value ---|--- Vulnerability submitted via Open Bug Bounty| 29...

Two Romanians Charged With Hacking Police CCTV Cameras Before Trump Inauguration

Remember how some cybercriminals shut down most of Washington D.C. police's security cameras for four days ahead of President Donald Trump's inauguration earlier this year? Just a few days after the incident, British authorities arrested two people in the United Kingdom, identified as a British m...

CVE-2017-17057

There is a reflected XSS vulnerability in ZKTime Web 2.0.1.12280. The vulnerability exists due to insufficient filtration of user-supplied data in the 'Range' field of the 'Department' module in a Personnel Advanced Query. A remote attacker can execute arbitrary HTML and script code in the browse...

Cross site scripting

There is a reflected XSS vulnerability in ZKTime Web 2.0.1.12280. The vulnerability exists due to insufficient filtration of user-supplied data in the 'Range' field of the 'Department' module in a Personnel Advanced Query. A remote attacker can execute arbitrary HTML and script code in the browse...

CVE-2017-17057

There is a reflected XSS vulnerability in ZKTime Web 2.0.1.12280. The vulnerability exists due to insufficient filtration of user-supplied data in the 'Range' field of the 'Department' module in a Personnel Advanced Query. A remote attacker can execute arbitrary HTML and script code in the browse...

CVE-2017-17057

There is a reflected XSS vulnerability in ZKTime Web 2.0.1.12280. The vulnerability exists due to insufficient filtration of user-supplied data in the 'Range' field of the 'Department' module in a Personnel Advanced Query. A remote attacker can execute arbitrary HTML and script code in the browse...

ZKTeco ZKTime Web Personnel Advanced Query Department Module Cross-Site Scripting Vulnerability

ZKTeco ZKTime Web is a time and attendance management system from ZKTeco, Inc.The Department module in Personnel Advanced Query is one of the departmental personnel advanced query modules. A cross-site scripting vulnerability exists in the Range field of the Department module in Personnel Advance...

Former NSA Employee Pleads Guilty to Taking Classified Data

A former employee for the National Security Agency pleaded guilty on Friday to taking classified data to his home computer in Maryland. According to published reports, U.S. intelligence officials believe the data was then stolen from his computer by hackers working for the Russian government. Ngh...

Feds Seize Over 20,500 Domain Names For Selling Counterfeit Products

In a coordinated International cyber operation, law enforcement agencies have seized over 20,520 website domains for illegally selling counterfeit products, including luxury products, sportswear, electronics, pharmaceuticals and online piracy on e-commerce platforms and social networks...

Name+DOB+SSN=FAFSA Data Gold Mine

KrebsOnSecurity has sought to call attention to online services which expose sensitive consumer data if the user knows a handful of static details about a person that are broadly for sale in the cybercrime underground, such as name, date of birth, and Social Security Number. Perhaps the most...

Fund Targets Victims Scammed Via Western Union

If you, a friend or loved one lost money in a scam involving Western Union, some or all of those funds may be recoverable thanks to a more than half-billion dollar program set up by the U.S. Federal Trade Commission. In January 2017, Englewood, Colo.-based Western Union settled a case with the FT...

R.I.P. root9B? We Hardly Knew Ya!

root9B Holdings, a company that many in the security industry consider little more than a big-name startup aimed at cashing in on the stock market's insatiable appetite for cybersecurity firms, surprised no one this week when it announced it was ceasing operations at the end of the year. Founded ...

Threat Outbreak Alert RuleID30923: Email Messages Distributing Malicious Software on November 13, 2017

Medium Alert ID: 55882 First Published: 2017 November 13 12:31 GMT Version: 1 Summary Cisco Security has detected significant activity related to spam email messages distributing malicious software. Email messages that are related to this threat RuleID30923 may contain the following files: Name |...

US-CERT Warns of Crypto Bugs in IEEE Standard

Recent academic work focused on weak cryptographic protections in the implementation of the IEEE P1735 standard has been escalated to an alert published Friday by the Department of Homeland Security. DHS’ US-CERT warned the IEEE P1735 standard for encrypting electronic-design intellectual propert...

International Islamic University Chittagong: SQL injection in http://119.18.148.140/hrd/js/makeemployeeid.php

Hello, The mentioned page takes at least two GET parameters, namely q and departmentname. The two parameters are vulnerable to SQL injection as both are placed into SQL query strings without proper sanitization. It seems like the PHP script uses the affected parameters into two SQL queries, since...

Mail.ru: Stored XSS and html injection in biz.mail.ru

Domain, site, application: biz.mail.ru Testing environment: Latest chrome Steps to reproduce 1 go to biz.mail.ru, login 2 go to "My company" 3 create a department named as "alert 4 add an employee in that department 5 create a new subdepartment 6 add the employee from step 4 in our subdepartment...

Court Orders DreamHost to handover data on anti-Trump site

By Waqas About a week ago, it was reported that the Department This is a post from HackRead.com Read the original post: Court Orders DreamHost to handover data on anti-Trump site...

Qingdao government affairs APP Android version has information leakage vulnerability

Qingdao Government APP is a government service assistant that facilitates citizens to know the latest news and information anytime and anywhere, grasp the latest government decision-making information, and facilitate direct dialogue and communication between citizens and the government. There is ...

17-years-old kid hacks US air force for the good

By Uzair Amir In April 2017, it was reported that the US Department of Defence This is a post from HackRead.com Read the original post: 17-years-old kid hacks US air force for the good...