FBI shuts down malware on hundreds of Exchange servers, opens Pandora’s box

A rather remarkable story has emerged, setting the scene for lively debates about permissible system access. A press release from the US Department of Justice Judge has revealed that the FBI were granted permission to perform some tech support backdoor removal. Bizarrely, they did this without...

Cross site request forgery (csrf)

Some ZTE products have CSRF vulnerability. Because some pages lack CSRF random value verification, attackers could perform illegal authorization operations by constructing messages.This affects: ZXHN H168N V3.5.0EG1T5TE, V2.5.5, ZXHN H108N V2.5.5BTMT1...

CVE-2021-21729

The CVE-2021-21729 entry describes a CSRF vulnerability in ZTE router models ZXHN H168N (V3.5.0_EG1T5_TE, V2.5.5) and ZXHN H108N (V2.5.5_BTMT1). Root cause: pages lack CSRF random value verification, enabling an attacker to perform unauthorized operations by crafting messages. Affected products a...

DeepDotWeb Admin Pleads Guilty to Money Laundering Charges

The U.S. Department of Justice DoJ on Wednesday said that an Israeli national pleaded guilty for his role as an "administrator" of a portal called DeepDotWeb DDW, a "news" website that "served as a gateway to numerous dark web marketplaces." According to the unsealed court documents, Tal Prihar,...

Nanopb 安全漏洞

Nanopb is a protocol buffer implementation for microprocessors by the individual developer of Nanopb. A security vulnerability exists in Nanopb that results in invalid "free" or "realloc" calls...

Illegal Content and the Blockchain

Security researchers have recently discovered a botnet with a novel defense against takedowns. Normally, authorities can disable a botnet by taking over its command-and-control server. With nowhere to go for instructions, the botnet is rendered useless. But over the years, botnet designers have...

Input validation

Some ZTE products have an input verification vulnerability in the diagnostic function interface. Due to insufficient verification of some parameters input by users, an attacker with high privileges can cause process exception by repeatedly inputting illegal parameters. This affects:...

CVE-2021-21726

Some ZTE products have an input verification vulnerability in the diagnostic function interface. Due to insufficient verification of some parameters input by users, an attacker with high privileges can cause process exception by repeatedly inputting illegal parameters. This affects:...

Police shut down illegal video streaming app Mobdro with 100M users

By Habiba Rashid Authorities have arrested 4 people from Spain and Andorra while servers behind Mobdro have also been seized. Here's why it happened. This is a post from HackRead.com Read the original post: Police shut down illegal video streaming app Mobdro with 100M users...

NewStart CGSL CORE 5.04 / MAIN 5.04 : libsolv Multiple Vulnerabilities (NS-SA-2021-0014)

The remote NewStart CGSL host, running version CORE 5.04 / MAIN 5.04, has libsolv packages installed that are affected by multiple vulnerabilities: - There is a NULL pointer dereference at ext/testcase.c function testcaseread in libsolvext.a in libsolv through 0.7.2 that will cause a denial of...

Siemens SINEMA Remote Connect Server 安全漏洞

Siemens SINEMA Remote Connect Server is a remote network management platform from Siemens, Germany. The platform is used to remotely access, maintain, control and diagnose the underlying network. An incorrect authorization vulnerability exists in Siemens SINEMA Remote Connect Server. An attacker...

Botnet Abusing Bitcoin Blockchain To Evade Detection

By Deeba Ahmed Cybercriminals are abusing Bitcoin transactions to carry out illegal crypto mining operations while staying under the radar. This is a post from HackRead.com Read the original post: Botnet Abusing Bitcoin Blockchain To Evade Detection...

Remote Code Execution (RCE)

Smarty is vulnerable to remote code execution. The library does not properly handle the illegal function names in function name='blah'/function, allowing a malicious user to inject and execute arbitrary commands...

EulerOS 2.0 SP2 : nasm (EulerOS-SA-2021-1332)

According to the versions of the nasm package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - In Netwide Assembler NASM 2.14rc0, there are multiple heap use after free vulnerabilities in the tool nasm. The related heap is allocated in the...

Cybercriminal Enterprise 'Ringleaders' Stole $55M Via COVID-19 Fraud, Romance Scams

Click to Register U.S. law enforcement arrested six “ringleaders” of a Ghana-based cybercriminal enterprise, who had allegedly launched a slew of money-stealing scams dating back to 2013 that included romance scams, business email compromise attacks and fraud. Seized in the arrests were a slew of...

RainbowFish PacsOne Server SQL Injection Vulnerability

RainbowFish PacsOne Server is an image archiving and communication system server from RainbowFish. The system is used to save incoming images, and a SQL injection vulnerability exists in RainbowFish PacsOne Server that could be exploited by attackers to execute illegal SQL commands...

Clearview Facial-Recognition Technology Ruled Illegal in Canada

Canadian authorities have found that the collection of facial-recognition data by Clearview AI is illegal because it violates federal and provincial privacy laws, representing a win for individuals’ privacy and potentially setting a precedent for other legal challenges to the controversial...

Updated resteasy packages fix a security vulnerability

A flaw was found in Resteasy, where an improper input validation results in returning an illegal header that integrates into the server's response. This flaw may result in an injection, which leads to unexpected behavior when the HTTP response is constructed CVE-2020-1695...

360 F5 Input Validation Error Vulnerability

The 360 F5 is a smartphone device from the Chinese company 360. The 360F5 3.1.3.64296 and lower suffers from an Input Authentication Error vulnerability that stems from a specific illegal 802.11 Null Data Frame, which causes other wireless terminals to disconnect from the wireless connection in...

Police Arrest 21 WeLeakInfo Customers Who Bought Breached Personal Data

21 people have been arrested across the UK as part of a nationwide cyber crackdown targeting customers of WeLeakInfo.com, a now-defunct online service that had been previously selling access to data hacked from other websites. The suspects used stolen personal credentials to commit further cyber...