World’s largest data dump surfaces on web with 2.2 billion accounts

By Waqas It hasn’t even been 15 days since details of the world’s biggest online private data dump were discovered by security researchers and now its second "installment" has posted online. As per the report from Heise.de, a German-language website, the first collection, which was published on...

Shopify: Unauthenticated access to Zendesk tickets through athena-flex-production.shopifycloud.com Okta bypass

Summary athena-flex-production.shopifycloud.com seems to be an internal system that Shopify uses because it redirects user to Okta login. During this however, I noticed that it first returns 200 and then does a redirect meaning some part of the website loads before redirecting. With this, I was...

CVE-2017-1654

IBM Spectrum Scale 4.1.1 and 4.2.0 - 4.2.3 could allow a local unprivileged user access to information located in dump files. User data could be sent to IBM during service engagements. IBM X-Force ID: 133378...

New NSA Data Dump: ShadowBrokers Release UNITEDRAKE Malware

By Waqas The ShadowBrokers is a group of hackers known for leaking This is a post from HackRead.com Read the original post: New NSA Data Dump: ShadowBrokers Release UNITEDRAKE Malware...

Hacker Leaks Data From Mandiant (FireEye) Senior Security Analyst

Reportedly, at least one senior cyber security analyst working with Mandiant, a Virginia-based cybersecurity firm owned by the FireEye, appears to have had its system compromised by hackers, exposing his sensitive information on the Internet. On Sunday, an anonymous group of hackers posted some...

Shadow Brokers Launches 0-Day Exploit Subscriptions for $21,000 Per Month

As promised to release more zero-days exploits and hacking tools for various platforms starting from June 2017, the infamous hacking group Shadow Brokers is back with more information on how to subscribe and become a private member for receiving exclusive access to the future leaks. The Shadow...

ShadowBrokers Planning Monthly Exploit, Data Dump Service

Popcorn in hand, the ShadowBrokers say they’re taking in the WannaCry outbreak from the sidelines before starting in June a subscription service for new exploits and stolen data akin to a wine of the month club. In what’s become a signature periodic rant from the unknowns behind the leak of...

Turns Out Microsoft Has Already Patched Exploits Leaked By Shadow Brokers

The latest dump of hacking tools allegedly belonged to the NSA is believed to be the most damaging release by the Shadow Brokers till the date. But after analyzing the disclosed exploits, Microsoft security team says most of the windows vulnerabilities exploited by these hacking tools, including...

eClinicalWorks Patient Portal SQL Injection Vulnerability

eClinicalWorks Patient Portal is a product for healthcare applications from eClinicalWorks, Inc. that provides patients with a secure means of communicating to view their Personal Health Record PHR, view lab results, and more. An SQL injection vulnerability exists in the messageJson.jsp file in...

OIC Exponent CMS SQL Injection Vulnerability (CNVD-2017-01280)

OIC Exponent CMS is a free, open source modular content management system CMS based on PHP from the American OIC Group of companies. The system supports direct editing in the page, and provides user management, site configuration, content editing and other functions. A SQL injection vulnerability...

CVE-2017-5569

An issue was discovered in eClinicalWorks Patient Portal 7.0 build 13. This is a blind SQL injection within the template.jsp, which can be exploited without the need of authentication and via an HTTP POST request, and which can be used to dump database data out to a malicious server, using an...

CVE-2017-5570: Improper Neutralization of Special Elements used in an SQL Command

An issue was discovered in eClinicalWorks Patient Portal 7.0 build 13. This is a blind SQL injection within the messageJson.jsp, which can only be exploited by authenticated users via an HTTP POST request and which can be used to dump database data out to a malicious server, using an out-of-band...

Leaked NSA Hacking Tools Were 'Mistakenly' Left By An Agent On A Remote Server

If you are a hacker, you might have enjoyed the NSA's private zero-day exploits, malware and hacking tools that were leaked last month. But the question is: How these hacking tools ended up into the hands of hackers? It has been found that the NSA itself was not directly hacked, but a former NSA...

Ashley Madison Hackers (with another 300GB Dump) – Wait, Cheaters! We haven't Yet Done

Over a month ago, a group of hackers breached the popular cheater's dating service Ashley Madison and its parent company Avid Life Media, affecting tens of Millions site customers private life and also dump the website's source code onto the dark web. The hackers behind the Ashley Madison hack, w...

Rig Exploit Kit 3.0 Claims 1 Million Malvertising Victims

LAS VEGAS – A rampant malvertising campaign fueled by a new version of the Rig Exploit Kit has claimed at least 950,000 victims worldwide and is doing so with an unprecedented success rate. Researchers at Trustwave said in advance of this week’s Black Hat conference that they have been watching...

Zero-Day Flash Player Exploit Disclosed in 'Hacking Team' Data Dump

The Recent Cyber Attack that exposed 400GB of corporate data belonging to surveillance software firm Hacking Team has revealed that the spyware company have already discovered an exploit for an unpatched zero-day vulnerability in Flash Player. Security researchers at Trend Micro claim that the...

Elastix Voip system 2.x , Php code injection / Data dump Exploit

Elastix is famous asterisk voip system interface dist. it's vulnerable to php code injection vuln , which can be used to dump all data including - SIP Extention Data - Plain text admin password - Moderators passwords - All trunks data - shell upload Usage Info just add the ip list to "list.txt"...

Federal Reserve Admits It was Briefly Hacked During Super Bowl

Two days after the group Anonymous boasted it had broken into a government Web site and had the data dump to prove it, the U.S. Federal Reserve admitted it was hacked. “The Federal Reserve system is aware that information was obtained by exploiting a temporary vulnerability in a website vendor...

BSNL telecom server hacked by Anonymous Group against Section 66A of IT Act

The Homepage of BSNL Bharat Sanchar Nigam Limited https://www.bsnl.co.in/ was hacked today morning by hacking group Anonymous. BSNL is an Indian state-owned telecommunications company, the largest provider of fixed telephony and fourth largest mobile telephony provider in India, and is also a...

Hacker hacked into Adobe servers and dump data of 150000 users

This morning I received the news of new attacks against Adobe, an Egyptian Hacker named ViruSHimA hacked into Adobe servers and leaked private data. The hacker claims to have violated Adobe servers gaining full access and dumping the entire database with more of 150,000 emails and hashed password...