6488 matches found
CVE-2020-12427
The Western Digital WD Discovery application before 3.8.229 for MyCloud Home on Windows and macOS is vulnerable to CSRF, with impacts such as stealing data, modifying disk contents, or exhausting disk space...
Cross site request forgery (csrf)
The Western Digital WD Discovery application before 3.8.229 for MyCloud Home on Windows and macOS is vulnerable to CSRF, with impacts such as stealing data, modifying disk contents, or exhausting disk space...
CVE-2020-12427
The Western Digital WD Discovery application before 3.8.229 for MyCloud Home on Windows and macOS is vulnerable to CSRF, with impacts such as stealing data, modifying disk contents, or exhausting disk space...
Anubis Malware Upgrade Logs When Victims Look at Their Screens
The Anubis malware, which threat actors use to persistently attack Google’s Android-based smartphones, is set to evolve once again, this time adding a feature that allows the malware to identify if a victim is looking at his or her screen. The new feature is one of several that haven’t been...
7 New Flaws Affect All Thunderbolt-equipped Computers Sold in the Last 9 Years
A cybersecurity researcher today uncovers a set of 7 new unpatchable hardware vulnerabilities that affect all desktops and laptops sold in the past 9 years with Thunderbolt, or Thunderbolt-compatible USB-C ports. Collectively dubbed 'ThunderSpy,' the vulnerabilities can be exploited in 9 realisti...
7 New Flaws Affect All Thunderbolt-equipped Computers Sold in the Last 9 Years
A cybersecurity researcher today uncovers a set of 7 new unpatchable hardware vulnerabilities that affect all desktops and laptops sold in the past 9 years with Thunderbolt, or Thunderbolt-compatible USB-C ports. Collectively dubbed 'ThunderSpy,' the vulnerabilities can be exploited in 9 realisti...
Millions of Thunderbolt-Equipped Devices Open to 'ThunderSpy' Attack
A new attack enables bad actors to steal data from Windows or Linux devices equipped with Thunderbolt ports – if they can get their hands on the device for just five minutes. The attack, called “Thunderspy,” specifically targets Thunderbolt technology, which is a hardware interface developed by...
Zulip Desktop Trust Management Issue Vulnerability
Zulip Desktop is a desktop version of the team chat application from Zulip USA. A trust management issue vulnerability exists in Zulip Desktop versions prior to 5.2.0, which stems from a lack of validation of SSL certificates. The vulnerability can be exploited by an attacker to obtain sensitive...
TechSmith SnagIT Code Issue Vulnerability
TechSmith SnagIT is a set of screen capture software from TechSmith USA. The software is mainly used for taking screenshots on the screen, recording videos, etc. A code issue vulnerability exists in TechSmith SnagIt versions 11.2.1 through 20.0.3. A local attacker could exploit the vulnerability ...
Report: Microsoft’s GitHub Account Gets Hacked
Hackers have broken into Microsoft’s GitHub account and stolen 500 GB of data from the tech giant’s own private repositories on the developer platform, according to published reports. A group that calls itself Shiny Hunters claims it stole and then leaked the data, which did not appear to include...
Hackers Dumpster Dive for Taxpayer Data in COVID-19 Relief Money Scams
Threat actors are using a combination of scams to obtain as well as buy and sell credentials for U.S. taxpayers to steal appropriations from the COVID-19 relief package as well as 2020 tax refunds, new research has found. Researchers from Secureworks Counter Threat Unit CTU have observed an...
This Asia-Pacific Cyber Espionage Campaign Went Undetected for 5 Years
An advanced group of Chinese hackers has recently been spotted to be behind a sustained cyber espionage campaign targeting government entities in Australia, Indonesia, Philippines, Vietnam, Thailand, Myanmar, and Brunei—which went undetected for at least five years and is still an ongoing threat...
New Malware Jumps Air-Gapped Devices by Turning Power-Supplies into Speakers
Cybersecurity researcher Mordechai Guri from Israel's Ben Gurion University of the Negev recently demonstrated a new kind of malware that could be used to covertly steal highly sensitive data from air-gapped and audio-gapped systems using a novel acoustic quirk in power supply units that come wit...
Maze Ransomware group steals 11m card data from Banco de Costa Rica
By Deeba Ahmed Banco BCR has been attacked twice in the past eight months by Maze ransomware operators. This is a post from HackRead.com Read the original post: Maze Ransomware group steals 11m card data from Banco de Costa Rica...
New Android Malware Targets PayPal, CapitalOne App Users
An Android mobile malware has been uncovered that steals payment data from users of popular financial apps like PayPal, Barclays, CapitalOne and more. The infostealer, called EventBot, has targeted users of more than 200 different banking, money-transfer services and general cryptocurrency wallet...
Targeted Phishing Attacks Successfully Hacked Top Executives At 150+ Companies
In the last few months, multiple groups of attackers successfully compromised corporate email accounts of at least 156 high-ranking officers at various firms based in Germany, the UK, Netherlands, Hong Kong, and Singapore. Dubbed 'PerSwaysion,' the newly spotted cyberattack campaign leveraged...
Critical Bugs Found in 3 Popular e-Learning Plugins for WordPress Sites
Security researchers are sounding the alarm over newly discovered vulnerabilities in some popular online learning management system LMS plugins that various organizations and universities use to offer online training courses through their WordPress-based websites. According to the Check Point...
Critical WordPress e-Learning Plugin Bugs Open Door to Cheating
Researchers have disclosed critical-severity flaws in three popular WordPress plugins used widely by colleges and universities: LearnPress, LearnDash and LifterLMS. The flaws, now patched, could allow students to steal personal information, change their grades, cheat on tests and more. The...
CVE-2020-11822
In Rukovoditel 2.5.2, there is a stored XSS vulnerability on the application structure -- user access groups page. Thus, an attacker can inject malicious script to steal all users' valuable data...
CVE-2020-11822
In Rukovoditel 2.5.2, there is a stored XSS vulnerability on the application structure -- user access groups page. Thus, an attacker can inject malicious script to steal all users' valuable data...