FBI Email Hoaxer ID’ed by the Guy He Allegedly Loves to Torment

Vinny Troia, the cybersecurity researcher mentioned in a fake alert gushed out to thousands of people from the FBI’s own email system on Friday night, has fingered the guy who allegedly pulled off the exploit. Register now for our LIVE event! Troia – white hat threat hunter, cybercrime investigat...

FBI's Email System Hacked to Send Out Fake Cyber Security Alert to Thousands

The U.S. Federal Bureau of Investigation FBI on Saturday confirmed unidentified threat actors have breached one of its email servers to blast hoax messages about a fake "sophisticated chain attack." The incident, which was first publicly disclosed by threat intelligence non-profit SpamHaus,...

WP Admin Logo Changer <= 1.0 - Plugin's Settings Update via CSRF

The plugin does not have CSRF check when saving its settings, which could allow attackers to make a logged in admin update them via a CSRF attack. PoC...

MTN Group: Default Admin Username and Password on remedysso.mtncameroon.net

Summary: A Remedy Single Sign-On Remedy SSO Server is running at https://remedysso.mtncameroon.net/rsso/admin//. It is possible to access the application is using the default Administrator credentials. Steps To Reproduce: Go to https://remedysso.mtncameroon.net/rsso/admin// and login with...

Microsoft Azure Real Time Operating System 信息泄露漏洞

Microsoft Azure is a set of open, enterprise-grade cloud computing platforms from the U.S.-based Microsoft. An information disclosure vulnerability exists in Microsoft Azure RTOS. The vulnerability stems from errors such as configuration during operation of a networked system or product. An...

VulnCheck KEV: CVE-2016-3643

SolarWinds Virtualization Manager allows for privilege escalation through leveraging a misconfiguration of sudo...

SolarWinds Virtualization Manager Privilege Escalation Vulnerability

SolarWinds Virtualization Manager allows for privilege escalation through leveraging a misconfiguration of sudo...

NewStart CGSL CORE 5.05 / MAIN 5.05 : ibus Vulnerability (NS-SA-2021-0155)

The remote NewStart CGSL host, running version CORE 5.05 / MAIN 5.05, has ibus packages installed that are affected by a vulnerability: - A flaw was discovered in ibus in versions before 1.5.22 that allows any unprivileged user to monitor and send method calls to the ibus bus of another user due ...

SHEIN: RCE via npm misconfig -- installing internal libraries from the public registry

The following node package has been installed on at least one shein owned build/development server directly from the public npm registry. https://www.npmjs.com/package/shineout-mobile This package should normally be downloaded from the internal shein registry, but a misconfiguration appears to ha...

Flickr: critical server misconfiguration lead to access to any user sensitive data which include user email and password

Hi flickr team, I found a critical issue lead to access to any user sensitive data which include user hashed password and possibly can lead to takeover any user account on flickr's main site, literally i can get all user information from database with no restrictions , Let me explain how this...

8x8: Authentication Bypass & ApacheTomcat Misconfiguration in [██]

A single host in the pilot environment exposed the Apache Tomcat /admin and /manager endpoints. The issue has been rectified, as access to these endpoints has been restricted...

Twitch Suffers Massive 125GB Data and Source Code Leak Due to Server Misconfiguration

Interactive livestreaming platform Twitch acknowledged a "breach" after an anonymous poster on the 4chan messaging board leaked its source code, an unreleased Steam competitor from Amazon Game Studios, details of creator payouts, proprietary software development kits, and other internal tools. Th...

The vulnerability of InspIRCd allows unauthorized access to critical resources, enabling attackers to gain access to confidential data.

The vulnerability of InspIRCd relates to the improper assignment of permissions for critical resources. Exploiting this vulnerability can allow a remote attacker to gain access to confidential data...

Scrapy 信息泄露漏洞

Scrapy is a free and open source web crawler framework written in Python. Scrapy Scrapy-splash suffers from an information disclosure vulnerability that originates from errors such as configuration during operation of a networked system or product. An unauthorized attacker can exploit the...

Medium: docker

Issue Overview: A bug was found in Moby Docker Engine where attempting to copy files using docker cp into a specially-crafted container can result in Unix file permission changes for existing files in the host 2019s filesystem, widening access to others. This bug does not directly allow files to ...

DEBIAN-CVE-2021-41092

Docker CLI is the command line interface for the docker container runtime. A bug was found in the Docker CLI where running docker login my-private-registry.example.com with a misconfigured configuration file typically /.docker/config.json listing a credsStore or credHelpers that could not be...

Survey Solutions 安全漏洞

Survey Solutions is a survey management and data collection system. survey Solutions is vulnerable to an information disclosure vulnerability that stems from a configuration or other error in the operation of the network system or product. An attacker could exploit the vulnerability to obtain...

CVE-2021-41101

wire-server is an open-source back end for Wire, a secure collaboration platform. Before version 2.106.0, the CORS Access-Control-Allow-Origin header set by nginz is set for all subdomains of .wire.com including wire.com. This means that if somebody were to find an XSS vector in any of the...

UPchieve: Password reset token leakage

Reset Password link : http://hackers.upchieve.org/setpassword?token=a3c448b1eb9b982f93ec39a7181ec1a2 1.Open Password reset page from email. 2.Intercept the requestI have used burp suite 3.You can see the link for reset password in below requests POST...

UPchieve: Password Reuse

Issue Description: A user is able to reuse any of their old passwords during the change passwords process. URL & Location: https://hackers.upchieve.org/resetpassword POC video : recording-1632907447530.webm @thug645 Impact Misconfiguration...