75% of the 'Left to Get Hacked' Redis Servers Found Infected

Despite the continual emergence of new cyber attacks because of misconfigured servers and applications, people continue to ignore security warnings. A massive malware campaign designed to target open Redis servers, about which researchers warned almost two months ago, has now grown and already...

How connected devices put health care at risk

The health care industry is one of the most attractive sectors to hackers. Not only do hospitals, doctor offices and other facilities store and have access to an array of patients' personal information, but many organizations also have financial details on file to facilitate billing processes. On...

SCADAS "BAS920 & ISC2000" Credentials Exposed(CVE-2017-17974)

Exploit; SCADAS "BAS920 & ISC2000"; Credentials Exposed BA System “Improper Access Control Authorization” Exploit Title: "SCADAS "BAS920 & ISC2000"; Credentials Exposed” CVE: CVE-2017-17974 Date: 29/12/2017 Exploit Author: Fernandez Ezequiel @capitanalfa && Bertin Jose @bertinjoseb Vendor: BA...

TBK DVR4104 / DVR4216 Credential Disclosure

-- coding: utf-8 -- import json import requests import argparse import tableprint as tp class Colors: BLUE = '\03394m' GREEN = '\03332m' RED = '\0330;31m' DEFAULT = '\0330m' ORANGE = '\03333m' WHITE = '\03397m' BOLD = '\0331m' BRCOLOUR = '\0331;37;40m' banner = ''' ..--.. ..... .-- ..... . .": "-...

CVE-2018-0262

A vulnerability in Cisco Meeting Server could allow an unauthenticated, remote attacker to gain unauthorized access to components of, or sensitive information in, an affected system, leading to Remote Code Execution. The vulnerability is due to incorrect default configuration of the device, which...

TBK DVR4104 DVR4216 - Credentials Leak

TBK DVR4104 DVR4216 - Credentials Leak -- coding: utf-8 -- import json import requests import argparse import tableprint as tp class Colors: BLUE = '\03394m' GREEN = '\03332m' RED = '\0330;31m' DEFAULT = '\0330m' ORANGE = '\03333m' WHITE = '\03397m' BOLD = '\0331m' BRCOLOUR = '\0331;37;40m' banne...

TBK DVR4104 / DVR4216 - Credentials Leak

-- coding: utf-8 -- import json import requests import argparse import tableprint as tp class Colors: BLUE = '\03394m' GREEN = '\03332m' RED = '\0330;31m' DEFAULT = '\0330m' ORANGE = '\03333m' WHITE = '\03397m' BOLD = '\0331m' BRCOLOUR = '\0331;37;40m' banner = ''' ..--.. ..... .-- ..... . .": "-...

A cryptocurrency platform exposed sensitive data of 25,000 users

By Waqas Bezop, a cryptocurrency startup exposed highly personal details of more This is a post from HackRead.com Read the original post: A cryptocurrency platform exposed sensitive data of 25,000 users...

Moxa EDR-810 Server Agent Information Disclosure Vulnerability(CVE-2017-12128)

Summary An exploitable information disclosure vulnerability exists in the Server Agent functionality of Moxa EDR-810 V4.1 build 17030317. A specially crafted TCP packet can cause information disclosure. An attacker can send a crafted TCP packet to trigger this vulnerability. Tested Versions Moxa...

The Role That IT Security Teams Need to Play in Connected Hospitals

The WannaCry outbreak that reportedly raked in US$1B in damage costs also forced doctors to cancel scheduled appointments, among other things, brought on warranted concern over pervasive ransomware attacks that could stem from oft-overlooked components of healthcare networks—exposed medical cyber...

Facebook Secretly Provided Analytic Firm Access to Million of Profiles

By Waqas Controversies and scandals on Facebook don’t seem to end anytime This is a post from HackRead.com Read the original post: Facebook Secretly Provided Analytic Firm Access to Million of Profiles...

PT-2018-2306

Name of the Vulnerable Software and Affected Versions Sinatra rack-protection versions 1.5.4 and 2.0.0.rc3 and earlier Description The issue is related to a timing attack vulnerability in the CSRF token checking mechanism. This vulnerability can result in signatures being exposed and appears to b...

Unprotected AWS Bucket Exposes 50.4 GB of Financial Giant’s Data

By Waqas Another day, another AWS Bucket exposed to the public - This This is a post from HackRead.com Read the original post: Unprotected AWS Bucket Exposes 50.4 GB of Financial Giant's Data...

Security Constraint Bypass

tomcat-catalina is vulnerable to security constraint bypass. Security constraints are only applied after a servlet has already been loaded. Depending on the order in which the servlets were loaded, its possible that some of the constraints were not applied at all. Leveraging this, users may have...

CVE-2018-1164

This vulnerability allows remote attackers to cause a denial-of-service condition on vulnerable installations of ZyXEL P-870H-51 DSL Router 1.00AWG.3D5. Authentication is not required to exploit this vulnerability. The specific flaw exists within numerous exposed CGI endpoints. The vulnerability ...

ABB netCADOPS Web Application

CVSS v3 5.8 ATTENTION: Remotely exploitable/low skill level to exploit. Vendor: ABB Equipment: netCADOPS Web Application Vulnerability: Information Exposure AFFECTED PRODUCTS The following versions of netCADOPS Web Application, a web interface, are affected: netCADOPS Web Application Version 3.4...

Design/Logic Flaw

An issue was discovered in config/error.php in Anchor 0.12.3. The error log is exposed at an errors.log URI, and contains MySQL credentials if a MySQL error such as "Too many connections" has occurred...

CVE-2017-15712

CVE-2017-15712 affects Apache Oozie before fixes: vulnerable versions include 3.1.3-incubating up to 4.3.0 and 5.0.0-beta1. The issue allows a remote attacker to obtain private files on the Oozie server by crafting a workflow XML that references sensitive files via XML directives/configuration. T...

Dropbox: Exposed Git Repo at http://fileserver.dropboxbusiness.com

The report revealed an exposed git repository on a vendor that Dropbox uses. This endpoint could allow an attacker to retrieve much of the source code and git history for this service which could potentially reveal sensitive information like application secrets. Thankfully, after performing an...

CVE-2017-17406

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Netgain Enterprise Manager. Authentication is not required to exploit this vulnerability. The specific flaw exists within an exposed RMI registry, which listens on TCP ports 1800 and 1850 by defaul...