USN-4872-1: Axel vulnerability

It was discovered that Axel did not properly verify the certificates for hostnames. An attacker could use this vulnerability to impersonate another server and obtain sensitive information...

Chinese hackers using RedXOR backdoor against Linux systems

By Deeba Ahmed RedXOR malware can steal data, gather system information such as the MAC address, username, clock speed, distribution, and kernel version, etc. This is a post from HackRead.com Read the original post: Chinese hackers using RedXOR backdoor against Linux systems...

NewStart CGSL MAIN 4.06 : firefox Multiple Vulnerabilities (NS-SA-2021-0004)

The remote NewStart CGSL host, running version MAIN 4.06, has firefox packages installed that are affected by multiple vulnerabilities: - When removing data about an origin whose tab was recently closed, a use-after-free could occur in the Quota manager, resulting in a potentially exploitable...

DEBIAN-CVE-2021-21185

Insufficient policy enforcement in extensions in Google Chrome prior to 89.0.4389.72 allowed an attacker who convinced a user to install a malicious extension to obtain sensitive information via a crafted Chrome Extension...

Google Play Harbors Malware-Laced Apps Bent on Spying

A malware dropper that paves the way for attackers to remotely steal data from Android phones has been spreading via nine malicious apps on the official Google Play store, according to researchers. The malware is part of a campaign aimed at lifting victims’ financial information, but which also...

Malware Can Exploit New Flaw in Intel CPUs to Launch Side-Channel Attacks

A new research has yielded yet another means to pilfer sensitive data by exploiting what's the first "on-chip, cross-core" side-channel attack targeting the ring interconnect used in Intel Coffee Lake and Skylake processors. Published by a group of academics from the University of Illinois at...

Exploit for Path Traversal in Microsoft

I will continue to add any new code or modify existing code ba...

Mazafaka — Elite Hacking and Cybercrime Forum — Got Hacked!

In what's a case of hackers getting hacked, a prominent underground online criminal forum by the name of Maza has been compromised by unknown attackers, making it the fourth forum to have been breached since the start of the year. The intrusion is said to have occurred on March 3, with informatio...

Zero-day vulnerabilities in Microsoft Exchange Server

What happened? On March 2, 2021 several companies released reports about in-the-wild exploitation of zero-day vulnerabilities inside Microsoft Exchange Server. The following vulnerabilities allow an attacker to compromise a vulnerable Microsoft Exchange Server. As a result, an attacker will gain...

CISA Orders Fed Agencies to Patch Exchange Servers

Hot on the heels of Microsoft’s announcement about active cyber-espionage campaigns that are exploiting four serious security vulnerabilities in Microsoft Exchange Server, the U.S. government is mandating patching for the issues. The news comes as security firms report escalating numbers of relat...

Extortion Gang Breaches Cybersecurity Firm Qualys Using Accellion Exploit

Enterprise cloud security firm Qualys has become the latest victim to join a long list of entities to have suffered a data breach after zero-day vulnerabilities in its Accellion File Transfer Appliance FTA server were exploited to steal sensitive business documents. As proof of access to the data...

CISA Issues Emergency Directive on In-the-Wild Microsoft Exchange Flaws

Following Microsoft's release of out-of-band patches to address multiple zero-day flaws in on-premises versions of Microsoft Exchange Server, the U.S. Cybersecurity and Infrastructure Security Agency CISA has issued an emergency directive warning of "active exploitation" of the vulnerabilities. T...

Home-Office Photos: A Ripe Cyberattack Vector

That photo that appears when someone disables his or her Zoom video, or those photos of a remote worker’s home office shared on Instagram may seem innocuous and playful. However, they could become ammunition for threat actors to launch targeted scams and put personal and critical data at risk, a...

Hackers hit Microsoft Exchange Server to steal email data

By Deeba Ahmed Microsoft says Chinese hackers from the Hafnium group waged "limited and targeted attacks," in which its Exchange Email servers were breached to steal data. This is a post from HackRead.com Read the original post: Hackers hit Microsoft Exchange Server to steal email data...

URGENT — 4 Actively Exploited 0-Day Flaws Found in Microsoft Exchange

Microsoft has released emergency patches to address four previously undisclosed security flaws in Exchange Server that it says are being actively exploited by a new Chinese state-sponsored threat actor with the goal of perpetrating data theft. Describing the attacks as "limited and targeted,"...

Researchers Unearth Links Between SunCrypt and QNAPCrypt Ransomware

SunCrypt, a ransomware strain that went on to infect several targets last year, may be an updated version of the QNAPCrypt ransomware, which targeted Linux-based file storage systems, according to new research. "While the two ransomware families are operated by distinct different threat actors on...

Weak Password Vulnerability in XR20-GM of Hangzhou Dipu Technology Co.

XR20-GM is a new-generation router product based on the multi-core processor architecture of DIPTECH, which realizes the seamless integration of routing and switching with security and application delivery. The XR20-GM has a weak password vulnerability that can be exploited by attackers to log in...

SQL Injection Vulnerability in the Anti-Desertion Platform of Zhejiang Dahua Technology Co. Ltd. for Medical Treatment Outside the Company (CNVD-2021-21757)

Zhejiang Dahua Technology Co., Ltd. is a video-centered intelligent IOT solution provider and operation service provider. A SQL injection vulnerability exists in the anti-evasion platform of Zhejiang Dahua Technology Co. An attacker can exploit the vulnerability to obtain sensitive information in...

TikTok pays $92 million to end data theft lawsuit

TikTok, the now widely popular social media platform that allows users to create, share, and discover, short video clips has been enjoying explosive growth since it appeared in 2017. Since then, it hasn’t stopped growing—more so during the current pandemic. While we can no longer categorize TikTo...

Tax Season Ushers in Quickbooks Data-Theft Spike

Cybercriminals are ready for tax season with new malware designed to exfiltrate Quickbooks data and post it on the internet, according to a new report from ThreatLocker. Attackers use email to deliver the malware, which the ThreatLocker’s CEO Danny Jenkins told Threatpost is a simple, 15-line pie...