‘Battle for the Galaxy’ Mobile Game Leaks 6M Gamer Profiles

An Elasticsearch server holding personal data of 6 million players of the popular mobile game Battle for the Galaxy was discovered insecure and containing over 1 terabyte of unencrypted data, meaning anyone with a link could access data stored on the repository. Ethical hackers WizCase found the...

OWASP Top-10 2021, statistically calculated proposal.

Everybody knows the OWASP Top-10 as well as the fact that it gets updated only every other 3–4 years. With the last update published in 2017, it’s no surprise that a new version is coming this year. During my application security career, I saw OWASP Top-10 at least in 2003, 2004, 2007, 2010, 2013...

Microsoft acquires ReFirm Labs to enhance IoT security

Modern computing devices can be thought of as a collection of discrete microprocessors each with a dedicated function like high-speed networking, graphics, Disk I/O, AI, and everything in between. The emergence of the intelligent edge has accelerated the number of these cloud-connected devices th...

Microsoft acquires ReFirm Labs to enhance IoT security

Modern computing devices can be thought of as a collection of discrete microprocessors each with a dedicated function like high-speed networking, graphics, Disk I/O, AI, and everything in between. The emergence of the intelligent edge has accelerated the number of these cloud-connected devices th...

What Is a Honeypot❓ Definition, Types and More

A honeypot is a computer system made to appear like a potential target of a cyber-attack. It may be used to track or redirect hacks away from a legitimate target. It could like wise be utilized to comprehend the strategies that cybercriminals employ. Honeypots have been around for quite awhile, y...

CISA Releases Best Practices for Mapping to MITRE ATT&CK®

As part of an effort to encourage a common language in threat actor analysis, CISA has released Best Practices for MITRE ATT&CK® Mapping. The guide shows analysts—through instructions and examples—how to map adversary behavior to the MITRE ATT&CK framework. CISA created this guide in partnership...

[SECURITY] Fedora 34 Update: cflow-1.6-8.fc34

GNU cflow analyzes a collection of C source files and prints a graph, charting control flow within the program. GNU cflow is able to produce both direct and inverted flowgraphs for C sources. Optionally a cross-reference listing can be generated. Two output formats are implemented: POSIX and GNU...

GSD-2021-1000520 RDMA/rxe: Clear all QP fields if creation failed

RDMA/rxe: Clear all QP fields if creation failed This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v4.9.270 by commit...

Backdoor.Win32.Whirlpool.a Buffer Overflow

Discovery / credits: Malvuln - malvuln.com c 2021 Original source: https://malvuln.com/advisory/90171763d1cc62102b08482bac54ea8b.txt Contact: [email protected] Media: twitter.com/malvuln Threat: Backdoor.Win32.Whirlpool.a Vulnerability: Remote Buffer Overflow - UDP Datagram Description: The...

Exploit for External Control of System or Configuration Setting in Dlink Dsl-2750U_Firmware

firmware-analysis 1. DS...

Exploit for External Control of System or Configuration Setting in Dlink Dsl-2750U_Firmware

firmware-analysis 1. DS...

Building Multilayered Security for Modern Threats

Considering recent announcements of major attacks caused by external malicious actors, including a ransomware attack on a U.S. gasoline pipeline, the need for increased security posture is as important as ever, and multilayered security remains the key. With rampant ransomware attacks and other...

GENIVI Alliance DLT

1. EXECUTIVE SUMMARY CVSS v3 9.8 ATTENTION: Exploitable remotely/low attack complexity Vendor: GENIVI Alliance Equipment: DLT-Daemon Vulnerability: Heap-based Buffer Overflow 2. RISK EVALUATION Successful exploitation of this vulnerability could lead to remote code execution or crash the...

Locked funds from tokenization are credited twice to user leading to protocol fund loss

Handle 0xRajeev Vulnerability details Impact The tokens optionally locked during tokenization are released twice on acquiring conviction back from a NFT. The incorrect double debit of locked funds during tokenization has been filed as a separate finding because it is not necessarily related and...

NFTs can never be redeemed back to their conviction scores leading to lock/loss of funds

Handle 0xRajeev Vulnerability details Impact Besides the conviction scores of users, there appears to be tracking of the FairSide protocol’s tokenized conviction score as a whole using fscAddress = addressfairSideConviction. This is evident in the attempted reduction of the protocol’s score when ...

Call to swapExactTokensForETH in liquidateDai() will always fail

Handle 0xRajeev Vulnerability details Impact liquidateDai calls Uniswap’s swapExactTokensForETH to swap Dai to ETH. This will work if msg.sender, i.e. FSD contract, has already given the router an allowance of at least amount on the input token Dai. Given that there is no prior approval, the call...

Incorrect use of _addTribute instead of _addGovernanceTribute

Handle 0xRajeev Vulnerability details Impact The addRegistrationTributeGovernance function is called by the FSD network to update tribute when 7.5% is contributed towards governance as part of purchaseMembership. However, this function incorrectly calls addTribute as done in addRegistrationTribut...

Rockwell Automation Micro800 and MicroLogix 1400

1. EXECUTIVE SUMMARY CVSS v3 6.1 ATTENTION: Exploitable remotely Vendor: Rockwell Automation Equipment: Micro800, MicroLogix 1400 Vulnerability: Channel Accessible by Non-endpoint 2. RISK EVALUATION Successful exploitation of this vulnerability may result in denial-of-service conditions, which...

What To Do When Your Business Is Hacked

As businesses move to a remote workforce, hackers have increased their activity to capitalize on new security holes. Cybercriminals often use unsophisticated methods that continue to be extremely successful. These include phishing emails to harvest credentials and gain easy access to...

MurMurHash - Tool To Calculate A MurmurHash Value Of A Favicon To Hunt Phishing Websites On The Shodan Platform

This little tool is to calculate a MurmurHash value of a favicon to hunt phishing websites on the Shodan platform. What is MurMurHash? MurmurHash is a non-cryptographic hash function suitable for general hash-based lookup. The name comes from two basic operations, multiply MU and rotate R, used i...