Russian Arrested After Offering $1 Million to U.S. Company Employee for Planting Malware

Hackers always find a way in, even if there's no software vulnerability to exploit. The FBI has arrested a Russian national who recently traveled to the United States and offered $1 million in bribe to an employee of a targeted company for his help in installing malware into the company's compute...

APIs Are the Next Frontier in Cybercrime

Application Programming Interface API usage has exploded, and cybercriminals are increasingly taking advantage of API security flaws to commit fraud and steal data. APIs, which are used to create connections between software programs and perform integrations, make everything a bit easier — from...

Jack Daniels, Ritz London Face Cyberattacks

A pair of cyberattacks on high-profile targets – the owner of the Jack Daniels distillery and the iconic Ritz London hotel – have resulted in the exposure of sensitive information. The maker behind Jack Daniels and other alcoholic beverages, Brown-Forman Corp., has suffered a recent cyberattack b...

PT-2020-3654 · Microsoft · Windows Media Foundation +1

Name of the Vulnerable Software and Affected Versions: Windows Media Foundation affected versions not specified Description: The issue is caused by a memory corruption vulnerability in Windows Media Foundation, allowing an attacker to install programs, view, change, or delete data, or create new...

Google Chrome Browser Bug Exposes Billions of Users to Data Theft

A vulnerability in Google’s Chromium-based browsers would allow attackers to bypass the Content Security Policy CSP on websites, in order to steal data and execute rogue code. The bug CVE-2020-6519 is found in Chrome, Opera and Edge, on Windows, Mac and Android – potentially affecting billions of...

Over a Billion Android Devices Are at Risk of Data Theft

Qualcomm has released a fix for the flaws in its Snapdragon chip, which attackers might exploit to monitor location or render the phone unresponsive...

Code injection

Given an installed malicious file picker application, an attacker was able to steal and upload local files of their choosing, regardless of the actually files picked. Note: This issue only affected Firefox for Android. Other operating systems are unaffected.. This vulnerability affects Firefox ES...

Evasive Credit Card Skimmers Using Homograph Domains and Infected Favicon

Cybersecurity researchers today highlighted an evasive phishing technique that attackers are exploiting in the wild to target visitors of several sites with a quirk in domain names, and leverage modified favicons to inject e-skimmers and steal payment card information covertly. "The idea is simpl...

Microsoft Edge Information Disclosure Vulnerability (CNVD-2020-57803)

Microsoft Edge is a web browser from the American company Microsoft that comes with systems after Windows 10. An information disclosure vulnerability exists in Microsoft Edge based on EdgeHTML. The vulnerability can be exploited by an attacker to obtain a user's personal information by making a...

CWT Travel Agency Faces $4.5M Ransom in Cyberattack, Report

CWT, a giant in the corporate travel agency world with a global clientele, may have faced payment of $4.5 million to unknown hackers in the wake of a ransomware attack. Independent malware hunter @JAMESWT tweeted on Thursday that a malware sample used against CWT formerly known as Carlson Wagonli...

SQL Injection Vulnerability in the Website Building System of Beijing Dongyun Chuangda Technology Co.

Beijing Dongyuntranda Technology Co., Ltd Dongyuntranda is a leading mobile Internet application service provider in China, with subsidiaries in Tianjin and Xi'an. Based on the cloud computing model, Dongyuntranda focuses on Beijing, Tianjin, Xi'an and other well-known enterprises at home and...

North Korean Hackers Spotted Using New Multi-Platform Malware Framework

Lazarus Group, the notorious hacking group with ties to the North Korean regime, has unleashed a new multi-platform malware framework with an aim to infiltrate corporate entities around the world, steal customer databases, and distribute ransomware. Capable of targeting Windows, Linux, and macOS...

Xiamen Creative Future Culture Co., Ltd.'s New Comic App Has Logic Flaw Vulnerability

New Manga is an internet platform that provides genuine and high-quality manga reading service, and owns an independent mobile manga reading tool - New Manga APP, which takes week as the basic unit and updates different works every day. Xiamen Creative Future Culture Co., Ltd. new comic APP there...

US Charges 2 Chinese Hackers for Targeting COVID-19 Research and Trade Secrets

The U.S. Department of Justice DoJ yesterday revealed charges against two Chinese nationals for their alleged involvement in a decade-long hacking spree targeting dissidents, government agencies, and hundreds of organizations in as many as 11 countries. The 11-count indictment, which was unsealed...

Iranian Spies Accidentally Leaked Videos of Themselves Hacking

IBM’s X-Force security team obtained five hours of APT35 hacking operations, showing exactly how the group steals data from email accounts—and who it’s targeting...

CVE-2020-11084

In iPear, the manual execution of the eval function can lead to command injection. Only PCs where commands are manually executed via "For Developers" are affected. This function allows executing any PHP code within iPear which may change, damage, or steal data files from the PC...

CVE-2020-11084

In iPear, the manual execution of the eval function can lead to command injection. Only PCs where commands are manually executed via "For Developers" are affected. This function allows executing any PHP code within iPear which may change, damage, or steal data files from the PC...

CVE-2020-11084 Command Injection in iPear

In iPear, the manual execution of the eval function can lead to command injection. Only PCs where commands are manually executed via "For Developers" are affected. This function allows executing any PHP code within iPear which may change, damage, or steal data files from the PC...

BSA Radar 1.6.7234.24750 - Cross-Site Request Forgery (Change Password) Vulnerability

Exploit for hardware platform in category web applications Exploit title: BSA Radar 1.6.7234.24750 - Cross-Site Request Forgery Change Password Exploit Author: William Summerhill Vendor Homepage:bhttps://www.globalradar.com/ Version: BSA Radar - Version 1.6.7234.24750 and lower CVE: CVE-2020-1494...

Lazarus hackers use Magecart attack to steal card data from EU, US sites

By Deeba Ahmed Lazarus hackers are believed to be backed by the North Korean government. This is a post from HackRead.com Read the original post: Lazarus hackers use Magecart attack to steal card data from EU, US sites...