22 Apple Distributors Arrested for Selling Customers’ Data in $7.4 Million

--- Image Source: South China Morning Post Chinese authorities have announced the arrest of around 22 distributors working as Apple distributors as part of a $7 million operation, who stole customers’ personal information from an internal Apple database and illegally sold it to Chinese black mark...

CVE-2016-6087

IBM Domino 8.5 and 9.0 could allow an attacker to steal credentials using multiple sessions and large amounts of data using Domino TLS Key Exchange validation. IBM X-Force ID: 117918...

The Internet of Vulnerable Things

IntroductionTechnological progress is resulting in computing systems that are smaller, cheaper and consuming less power. These micro-computing systems are able to be integrated into everyday objects; when coupled with ubiquitous wireless connectivity these devices form the “Internet of Things”. T...

Beware! Fireball Malware Infects Nearly 250 Million Computers Worldwide

Security researchers have discovered a massive malware campaign that has already infected more than 250 million computers across the world, including Windows and Mac OS. Dubbed Fireball, the malware is an adware package that takes complete control of victim's web browsers and turns them into...

XSS Vulnerability in Baoding OA Email Function

Baoding OA system is an office system for enterprises. An XSS vulnerability exists in the email function of Baoding OA. An attacker can exploit this vulnerability to gain administrator privileges, steal data, etc...

All Android Phones Vulnerable to Extremely Dangerous Full Device Takeover Attack

Researchers have discovered a new attack, dubbed 'Cloak and Dagger', that works against all versions of Android, up to version 7.1.2. Cloak and Dagger attack allows hackers to silently take full control of your device and steal private data, including keystrokes, chats, device PIN, online account...

Session Hijacking, Cookie-Stealing WordPress Malware Spotted

Researchers have identified a strain of cookie stealing malware injected into a legitimate JavaScript file, that masquerades as a WordPress core domain. Cesar Anjos, a security analyst at Sucuri, a firm that specializes in WordPress security, came across the malware during an incident response...

CVE-2017-5905

The Dollar Bank Mobile app 2.6.3 for iOS does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

CVE-2017-3213

The Think Mutual Bank Mobile Banking app 3.1.5 for iOS does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

Stealthy Konni RAT Targeting North Korea Since 2014

Two recent espionage campaigns against political and strategic targets in North Korea has been linked to malware that has stayed hidden for the better part of three years. Cisco’s research arm Talos published a report yesterday on the malware it calls Konni. Two attacks in April used phishing...

Google Shuts Down Docs Phishing Spree

Google said it has disabled offending accounts involved in a widespread spree of phishing emails today impersonating Google Docs. The emails, at the outset, targeted journalists primarily and attempted to trick victims into granting the malicious application permission to access the user’s Google...

IBM: Destroy USBs Infected with Malware Dropper

USB drives shipped with some IBM’s Storwize storage products are infected with malware, and the tech giant advises customers destroy the devices. IBM would not comment on the source of the infection or where in the supply chain the interdiction happened, and instead referred Threatpost to an...

Insecure Apps that Open Ports Leave Millions of Smartphones at Risk of Hacking

A team of researchers from the University of Michigan discovered that hundreds of applications in Google Play Store have a security hole that could potentially allow hackers to steal data from and even implant malware on millions of Android smartphones. The University of Michigan team says that t...

CVE-2017-2104

The Business LaLa Call App for Android 1.4.7 and earlier does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

hirkereso.hu XSS vulnerability

Open Bug Bounty ID: OBB-228394 Description| Value ---|--- Affected Website:| hirkereso.hu Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

Serendipity Cross-Site Scripting Vulnerability

Serendipity is scalable PHP-driven weblog engine. A cross-site scripting vulnerability exists in Serendipity version 2.1-rc1. A remote attacker can exploit this vulnerability to steal administrator cookies or other information...

xDedic Market Spilling Over With School Servers, PCs

Nearly two-thirds of servers and PCs peddled on the xDedic underground marketplace belong to schools and universities, and most are based in the United States. In a recent analysis of xDedic, Flashpoint found that besides the education sector, PC and servers tied to healthcare and legal firms mak...

Phone Hack Uses Sensors To Steal PINs

University researchers have created a method to steal a smartphone user’s PIN by leveraging sensor data generated by the targeted phone. Researchers say the method has a 74 percent success rate when it comes to accurately determining four-digit PIN data inputted by a phone’s owner. Researchers fr...

U.S. Trade Group Hacked by Chinese Hackers ahead of Trump-Xi Trade Summit

Researchers have uncovered a Chinese cyber-espionage against the United States ahead of the trade summit on Thursday between US President Donald Trump and China's President Xi Jinping. According to a new report published today by Fidelis Cybersecurity firm, the Chinese APT10 hacking group implant...

NoSQL Injection

A NoSQL injection occurs when a value originating from the client's request is used within a NoSQL call without prior sanitisation. This can allow cyber-criminals to execute arbitrary NoSQL code and thus steal data, or use the additional functionality of the database server to take control of...