U.S. Authorities Shut Down Slilpp—Largest Marketplace for Stolen Logins

The U.S. Department of Justice DoJ Thursday said it disrupted and took down the infrastructure of an underground marketplace known as "Slilpp" that specialized in trading stolen login credentials as part of an international law enforcement operation. Over a dozen individuals have been charged or...

Mysterious Custom Malware Collects Billions of Stolen Data Points

Researchers have uncovered a 1.2-terabyte database of stolen data, lifted from 3.2 million Windows-based computers over the course of two years by an unknown, custom malware. The heisted info includes 6.6 million files and 26 million credentials, and 2 billion web login cookies – with 400 million...

Bosch B426 Web Configuration Credential Information Disclosure Vulnerability

This vulnerability allows network-adjacent attackers to disclose sensitive information on affected installations of Bosch B426. User interaction is required to exploit this vulnerability. The specific flaw exists within the handling of login credentials provided to the login.cgi endpoint. The iss...

Hackers Exploit Post-COVID Return to Offices

With COVID-19 restrictions lifting and workers trickling back to offices, threat actors are sharpening their spear phishing ploys. The latest scam includes pelting recipients with emails purportedly from their CIOs welcoming employees back into offices. The emails outline a company’s post-pandemi...

Bizarro: a banking Trojan full of nasty tricks

Researchers have discovered a new banking Trojan that has been found targeting customers of European and South American banks. They have dubbed the new Trojan Bizarro. How does Bizarro spread? The Bizarro malware spreads via Microsoft Installer MSI packages. Identified sources so far have been sp...

CVE-2021-27945

The Squirro Insights Engine was affected by a Reflected Cross-Site Scripting XSS vulnerability affecting versions 2.0.0 up to and including 3.2.4. An attacker can use the vulnerability to inject malicious JavaScript code into the application, which will execute within the browser of any user who...

Cross site scripting

The Squirro Insights Engine was affected by a Reflected Cross-Site Scripting XSS vulnerability affecting versions 2.0.0 up to and including 3.2.4. An attacker can use the vulnerability to inject malicious JavaScript code into the application, which will execute within the browser of any user who...

Database with 100,300 CityBee users’ login credentials leaked online

By Saad Rajpoot According to the hacker behind the breach, they found the backup database of CityBee exposed on the internet for public access. This is a post from HackRead.com Read the original post: Database with 100,300 CityBee users login credentials leaked online...

Sovremennye Delovye Tekhnologii FX Aggregator Security Breach

A security vulnerability exists in Sovremennye Delovye Tekhnologii FX that originates from storing authentication credentials in plaintext during login...

CVE-2021-21448

SAP GUI for Windows, version - 7.60, allows an attacker to spoof logon credentials for Application Server ABAP backend systems in the client PCs memory. Under certain conditions the attacker can access information which would otherwise be restricted. The exploit can only be executed locally on th...

iBall-Baton WRA150N File Disclosure

Exploit Title: iBall-Baton WRA150N Rom-0 Backup - File Disclosure Sensitive Information Date: 07/01/2021 Exploit Author: h4cks1n Vendor Homepage: iball.co.in Version: iBall-Baton WRA150N Tested on : Windows 7/8/8.1/10, Parrot Linux OS The iBall-Baton router version WRA150N is vulnerable to the...

Hackers phish 615,000 login credentials by using Facebook ads

By Sudais Asif Once again, Facebook ads have been misused by cybercriminals in a large-scale phishing scam to steal victims' login credentials. This is a post from HackRead.com Read the original post: Hackers phish 615,000 login credentials by using Facebook ads...

Denial Of Service (DoS)

Icecast is vulnerable to Denial of service DoS. An attacker is able to cause a denial of service via a request without login credentials...

CVE-2020-29054

An issue was discovered on CDATA 72408A, 9008A, 9016A, 92408A, 92416A, 9288, 97016, 97024P, 97028P, 97042P, 97084P, 97168P, FD1002S, FD1104, FD1104B, FD1104S, FD1104SN, FD1108S, FD1204S-R2, FD1204SN, FD1204SN-R2, FD1208S-R2, FD1216S-R1, FD1608GS, FD1608SN, FD1616GS, FD1616SN, and FD8000 devices...

Sectona Spectra Information Disclosure Vulnerability

Sectona Spectra is a privilege management system for enterprise device access from US-based sectona. The platform supports the consolidation of accounts in the cloud with local accounts to centralize enterprise device management and improve access security. An information disclosure vulnerability...

Microsoft Teams Phishing Attack Targets Office 365 Users

Researchers are warning of a phishing campaign that pretends to be an automated message from Microsoft Teams. In reality, the attack aims to steal Office 365 recipients’ login credentials. Teams is Microsoft’s popular collaboration tool, which has particularly risen in popularity among remote...

CVE-2020-24551

IProom MMC+ Server login page does not validate specific parameters properly. Attackers can use the vulnerability to redirect to any malicious site and steal the victim's login credentials...

Open redirect

IProom MMC+ Server login page does not validate specific parameters properly. Attackers can use the vulnerability to redirect to any malicious site and steal the victim's login credentials...

CVE-2020-24551

The CVE-2020-24551 entry applies to IProom MMC+ Server login page, where improper validation of specific parameters enables an open redirect. The vulnerability is network-?driven; CVSS details from NVD indicate both CVSS v2 (base 5.8) and CVSS v3.1 (base 6.1) with no authentication, user interact...

CVE-2020-24551 IProom MMC+ Server - URL Redirection to Untrusted Site (Open Redirect')

IProom MMC+ Server login page does not validate specific parameters properly. Attackers can use the vulnerability to redirect to any malicious site and steal the victim's login credentials...