CVE-2020-25598

An issue was discovered in Xen 4.14.x. There is a missing unlock in the XENMEMacquireresource error path. The RCU Read, Copy, Update mechanism is a synchronisation primitive. A buggy error path in the XENMEMacquireresource exits without releasing an RCU reference, which is conceptually similar to...

Source code of Cerberus banking trojan released online for free

By Sudais Asif Initially, the source code of Cerberus banking trojan - active since July 2019 - was being auctioned by one of its developers. This is a post from HackRead.com Read the original post: Source code of Cerberus banking trojan released online for free...

EulerOS 2.0 SP5 : keepalived (EulerOS-SA-2020-1919)

According to the version of the keepalived package installed, the EulerOS installation on the remote host is affected by the following vulnerability : - keepalived 2.0.8 didn't check for existing plain files when writing data to a temporary file upon a call to PrintData or PrintStats. If a local...

Sensitive data of cyber security firm & other businesses leaked online

By Sudais Asif Other than the cyber security firm, the leaked data belongs to universities, an insurance firm, non-profit, and public limited firms. This is a post from HackRead.com Read the original post: Sensitive data of cyber security firm & other businesses leaked online...

Hundreds of Uber Eats User records leaked on Dark Web

By Zara Khan User records of Uber Eats, an American online food ordering service, have been leaked by... This is a post from HackRead.com Read the original post: Hundreds of Uber Eats User records leaked on Dark Web...

Intel leaks – Hacker posts 20GB of alleged Intel source code, files online

By Waqas "This is the first 20GB release in a series of large Intel leaks" the developer claimed. This is a post from HackRead.com Read the original post: Intel leaks - Hacker posts 20GB of alleged Intel source code, files online...

Mail.ru: SECRET_KEY Of Django Leaked In maps.me

Token for a internal Jenkins account of maps.me was leaked via git commit...

40GB of leaked videos expose how Iranian hackers hijack email accounts

By Deeba Ahmed The trove of videos showing how Iranian hackers function was identified... This is a post from HackRead.com Read the original post: 40GB of leaked videos expose how Iranian hackers hijack email accounts...

Iranian Spies Accidentally Leaked Videos of Themselves Hacking

IBM’s X-Force security team obtained five hours of APT35 hacking operations, showing exactly how the group steals data from email accounts—and who it’s targeting...

Database with 271 million Wattpad accounts leaked on hacker forum

By Waqas Wattpad database has been published on an English and Russian speaking hacker forum. This is a post from HackRead.com Read the original post: Database with 271 million Wattpad accounts leaked on hacker forum...

Authorization Bypass

electron is vulnerable to authorization bypass. The vulnerability exists as it was possible to bypass a context isolation via leaked cross-context objects, causing code in the main world context to reach the isolated context with higher privileges...

FreeBSD : Gitlab -- Multiple Vulnerabilities (0a305431-bc98-11ea-a051-001b217b3468)

Gitlab reports : Missing Permission Check on Time Tracking Cross-Site Scripting in PyPi Files API Insecure Authorization Check on Private Project Security Dashboard Cross-Site Scripting in References Cross-Site Scripting in Group Names Cross-Site Scripting in Blob Viewer Cross-Site Scripting in...

Snapchat: Leaked JFrog Artifactory username and password exposed on GitHub - https://snapchat.jfrog.io

Researcher found valid jFrog credentials which were committed to a public Github repository of a Snap employee. This allowed access to internal Snap libraries/artifacts along with the ability to push updates to existing artifacts as well...

Mail.ru: Log files Leaked In mcsblog.ru

Server log files were available via web interface...

Mail.ru: Redmin API Key Exposed In GIthub

Sensitive application configuration data related to tracker.ucs.ru was leaked on github.com...

Imperva Takes on its Largest Recorded Account Takeover Attack on a Single Company

Imperva recently detected and mitigated the largest - and most concentrated - series of brute force ATO account takeover attacks in its history. Over the course of 60 hours from midnight on October 28, our ATO team’s monitoring systems detected more than 44 million ATO attempts on the login page ...

h1-ctf: [h1-2006 CTF] Multiple vulnerabilities leading to account takeover and two-factor authentication bypass allows to send pending bounty payments

Hi, First things first, the flag of the CTF challenge. F863095 Write-Up I've published my write-up at https://kapytein.nl/texts/2020-06-10-h1-2006-ctf-writeup-2cf34abd3ed/, in order to avoid a lengthy report 😅. TL;DR 1 2FA bypass as we control both values on the comparison. 2 SSRF to...

GitMonitor - A Github Scanning System To Look For Leaked Sensitive Information Based On Rules

GitMonitor is a Github scanning system to look for leaked sensitive information based on rules. I know that there are a lot of very good other tools for finding sensitive information leaked on Github right now, I myself currently still use some of them. However, I think they still lack some...

Database of dark web host with 7600 websites leaked by KingNull

By Sudais Asif The dark web hosting firm known as Daniel's Hosting was under cyber attacks since 2018. This is a post from HackRead.com Read the original post: Database of dark web host with 7600 websites leaked by KingNull...

A New Free Monitoring Tool to Measure Your Dark Web Exposure

Last week, application security company ImmuniWeb released a new free tool to monitor and measure an organization's exposure on the Dark Web. To improve the decision-making process for cybersecurity professionals, the free tool crawls Dark Web marketplaces, hacking forums, and Surface Web resourc...