CVE-2019-3915

creationtimestamp| type| source ---|---|--- 2019-04-09 15:03:26+00:00| published-proof-of-concept| https://t.me/thehackernews/256...

Starbucks: SQL Injection Extracts Starbucks Enterprise Accounting, Financial, Payroll Database

As described in the Hacker Summary, @spaceraccoon discovered a SQL Injection vulnerability in a web service backed by Microsoft Dynamics AX. @spaceraccoon demonstrated that the flaw was exploitable via XML-formatted HTTP payload requests to the server. We appreciate @spaceraccoon's clear and...

Unhackable Cryptography?

A recent article overhyped the release of EverCrypt, a cryptography library created using formal methods to prove security against specific attacks. The Quanta magazine article sets off a series of "snake-oil" alarm bells. The author's Github README is more measured and accurate, and illustrates...

Unpatched Flaw in Xiaomi's Built-in Browser App Lets Hackers Spoof URLs

EXCLUSIVE — Beware, if you are using a Xiaomi's Mi or Redmi smartphone, you should immediately update its built-in MI browser or the Mint browser available on Google Play Store for non-Xiaomi Android devices. That's because both web browser apps created by Xiaomi are vulnerable to a critical...

Financial Apps are Ripe for Exploit via Reverse Engineering

A white hat hacker reverse engineered 30 mobile financial applications and found sensitive data buried in the underlying code of nearly all apps examined. With this information a hacker could, for example, recover application programming interface API keys and use them to attack the vendor’s...

Security for Connected Devices

With this post, I want to continue from earlier discussions on security posted here and here and focus on Connected Devices or the Internet of Things IoT. IoT typically represents a network of physical objects or “things” embedded with electronics, software, sensors, and connectivity to enable...

What Hacker History Can Tell Enterprises About Future Attack Strategy

There's an oft-quoted saying: "History repeats itself." For those that believe in the cyclical patterns that sometimes emerge over time, this aphorism definitely rings true. Today, we'll be applying this type of thinking to the cybercrime realm. Over the course of hacker history, numerous trends...

Beto O'Rourke Was Part of an Infamous '90s Hacker Group

The presidential candidate's first constituency was Cult of the Dead Cow...

Ad Network Sizmek Probes Account Breach

Online advertising firm Sizmek Inc. NASDAQ: SZMK says it is investigating a security incident in which a hacker was reselling access to a user account with the ability to modify ads and analytics for a number of big-name advertisers. In a recent posting to a Russian-language cybercrime forum, an...

robinbhandari FTP Remote Denial Of Service Exploit

Title: CVE-2019-9668 robinbhandari FTP remote DoS vulnerability Vulnerable: - https://github.com/rovinbhandari/FTP Description: robinbhandari is a open source tiny ftp server/client in github.com. it has a remote DoS vulnerability in a 'put' command. Timeline: 2019-03-11 CVE-2019-9668 robinbhanda...

Citrix Data Breach – Iranian Hackers Stole 6TB of Sensitive Data

Popular enterprise software company Citrix that provides services to the U.S. military, the FBI, many U.S. corporations, and various U.S. government agencies disclosed last weekend a massive data breach of its internal network by "international cyber criminals." Citrix said it was warned by the F...

Vulnerable smart alarms allowed hackers to track & turn off car engine

By Waqas By gaining access to the vehicles, hackers can not only locate them but also open their doors and even turn off the engine while the owner is driving. Two popular car alarm companies are facing problems with their products. Viper and Pandora are famous for their alarms that cost thousand...

BSides SF 2019: Remote-Root Bug in Logitech Harmony Hub Patched and Explained

SAN FRANCISCO – Users of Logitech’s Harmony Hub have been wide open to an attack for years because of four unpatched vulnerabilities that left any IoT device connected at risk to remote takeover. The bugs were patched by Logitech in November, but for the first time the researchers that discovered...

Argentinian Teen Becomes First to Earn $1M in Bug Bounties with HackerOne

A 19-year-old that goes by the handle “@trytohack” became the first white hat hacker to surpass $1 million in bounty awards on the HackerOne platform. The Argentinian researcher, whose real name is Santiago Lopez, started reporting security weaknesses to companies in 2015 on HackerOne, when he wa...

Dark web hacker selling admin access to a Chinese railway company

By Waqas The IT security researchers at Sixgill's threat intelligence team have identified an "experienced threat actor" on the dark web selling access to the admin panel of a Chinese rail control system. This access would enable criminals to manipulate train control systems, affecting over one...

19-year-old ethical hacker is a millionaire now; thanks to his skills

By Carolina Argentina’s Santiago Lopez is now a millionaire due to his prowess on identifying flaws in online services as well as software. The ethical hacker who uses the moniker @trytohack became part of HackerOne’s bug bounty program in 2015 and so far he has reported more than 1,670 unique...

The vulnerability of the QEMU hardware emulation software allows for data to be written beyond the specified buffer limit, enabling a hacker to trigger a service failure.

The vulnerability of the QEMU hardware emulation software allows for data to be written beyond the specified buffer limits. Exploiting this vulnerability can enable a hacker to trigger a service failure...

Popular Torrent Uploader 'CracksNow' Caught Spreading Ransomware

It's not at all surprising that downloading movies and software from the torrent network could infect your computer with malware, but it's more heartbreaking when a popular, trusted file uploader goes rogue. Popular software cracks/keygens uploader "CracksNow," who had trusted status from many...

Sinking a ship and hiding the evidence

Our earlier work on Voyage Data Recorder manipulation got us thinking about how a malicious individual or organisation might bring about the demise of a ship and hide the evidence. There are plenty of ways to get malware on to a ship. Whether it’s via satcoms, phishing, USB, crew Wi-Fi, dodgy DVD...

Dark Web hacker selling 92M new accounts on Dream market

By Waqas The dark web hacker “Gnosticplayers” has quickly made a reputation for his high-profile data breaches and selling user data on the infamous Dream marketplace. A couple of days ago the hacker was selling 126 million accounts stolen from new data breaches and now, the same hacker is back...