U.S. Dept Of Defense: SQL injection at [█████████] [HtUS]

Hello, Summary while doing test on █████ I’ve found that the endpoint at /olc/set/m101/leasib.php is vulnerable with SQL injection vulnerability Vulnerable parameters - scn - SUBJECT - COURSEID POC 1. using sqlmap run command python3 sqlmap.py --level=5 --risk=3 --tamper=space2comment...

PT-2022-7131 · Unknown +8 · X.Org Server +8

Name of the Vulnerable Software and Affected Versions: X.org Server affected versions not specified Description: A critical vulnerability was found in X.org Server, affecting the GetCountedString function of the xkb/xkb.c file. The manipulation leads to a buffer overflow. This issue can be...

Hacker Selling Shanghai Police Database with Billions of Chinese Citizen Data

By Waqas As seen by Hackread.com, the database is currently being sold for 10 Bitcoin around $200,000 at the time… This is a post from HackRead.com Read the original post: Hacker Selling Shanghai Police Database with Billions of Chinese Citizen Data...

U.S. Dept Of Defense: Broken access discloses users and PII at https://███████ [HtUS]

Good morning, I was able to register at https://████/ and get the list of users. 1- Go to https://██████████/OAHTML/ibeCAcpSSOReg.jsp and register. 2- Go to https://███/OAHTML/AppsLocalLogin.jsp with the created user and login. 3- On the homepage, click on vacations rules, create, and search user...

5 pro-freedom technologies that could change the Internet

In the digital era, freedom is inextricably linked to privacy. After a good start, the Internet-enabled, technological revolution we are living through has hit some bumps in the road. We have already lost a lot of control over who and what has access to our data, and there are further threats to...

CVE-2022-28713

Improper authentication vulnerability in Scheduler of Cybozu Garoon 4.10.0 to 5.5.1 allows a remote attacker to obtain some data of Facility Information without logging in to the product...

HackerOne Employee Caught Stealing Vulnerability Reports for Personal Gains

Vulnerability coordination and bug bounty platform HackerOne on Friday disclosed that a former employee at the firm improperly accessed security reports submitted to it for personal gain. "The person anonymously disclosed this vulnerability information outside the HackerOne platform with the goal...

NFT Marketplace OpenSea Suffers Data Breach- Users’ Email IDs Leaked

By Deeba Ahmed In a blog post published Wednesday, OpenSea said the issue was caused by an employee of Customer.io, which is… This is a post from HackRead.com Read the original post: NFT Marketplace OpenSea Suffers Data Breach- Users Email IDs Leaked...

The vulnerability of the kernel-level driver nvlddmkm.sys of the NVIDIA GPU Display Driver allows a attacker to cause a system failure and compromise data integrity.

The vulnerability of the kernel-level driver nvlddmkm.sys of the NVIDIA GPU Display Driver is related to insufficient input data validation. Exploiting this vulnerability can allow attackers to cause system failures and compromise data integrity...

Why a “Lift-and-shift” Cloud Migration Strategy Doesn’t Support Data Security

The classic 1982 Steven Spielberg horror film “Poltergeist” chronicles disturbing, unexplained paranormal activity happening in a suburban family’s idyllic home. As the activity becomes more sinister and terrifying, the family learns that their neighborhood was built on an old burial ground. It...

City worker loses USB stick containing data on every resident after day of drinking

A person working in the city of Amagasaki, in Western Japan, has mislaid a USB stick which contained data on the citys 460,000 residents. The USB drive was in a bag that went missing during a reported day of drinking and dining at a restaurant last Tuesday. The person reported it to the police th...

Log4Shell Still Being Exploited to Hack VMWare Servers to Exfiltrate Sensitive Data

The U.S. Cybersecurity and Infrastructure Security Agency CISA, along with the Coast Guard Cyber Command CGCYBER, on Thursday released a joint advisory warning of continued attempts on the part of threat actors to exploit the Log4Shell flaw in VMware Horizon servers to breach target networks...

MAL-2022-4839 Malicious code in nflx-spectator-jsconf (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 202e32ca9322d937e294bd61303e7d694cabc1ed9a69e237325a867444eda124 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-1514 Malicious code in bfx-facs-api (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 0a1774979dc7da22a1b17bfa58da15255dd1eea3106952833c0f6535a9d1af6e Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-1086 Malicious code in argocd-diff-action (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 51718ff427530768bc006e381b08ab59421bd7258c90823243b8039334322b18 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-5474 Malicious code in profile-nft-gamification (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 37710620e91bbba317c045b70e448937826b6a44304c5e388dc97727a4b9da57 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

ALPHV squeezes victim with dedicated leak site for employees and customers

Eyebrows were raised this week when the ALPHV ransomware group created a leak site dedicated to just one of its victims. The site was aimed at the employees and guests of a hotelier that had been attacked, and allowed them to see if their personal details had been leaked. The new tactic seems to ...

Photos of kids taken from spyware-ridden phones found exposed on the internet

A stalkerware-type app that boasts "the best free phone spying software on the market," has exposed the data it snooped on from the phones it was installed in. The data exposed by TheTruthSpy included GPS locations and photos on victims phones, and images of children and babies. This news, first...

Email compromise leads to healthcare data breach at Kaiser Permanente

At least 69,000 people have been impacted by a data breach at Kaiser Permanente, a long-running managed healthcare consortium. The latest in a long-running series of healthcare attacks, the road to stolen data began on April 5 this year with an email compromise. The direct path to data A...

Kaiser Permanente Exposes Nearly 70K Medical Records in Data Breach

Kaiser Permanente suffered a data breach due to email compromise on April 5 that potentially exposed the medical records of nearly 70,000 patients, the company revealed earlier this month. Attackers gained access to the emails of an employee at Kaiser Foundation Health Plan of Washington that...