Experts Uncover Malware Attacks Against Colombian Government and Companies

Cybersecurity researchers took the wraps off an ongoing surveillance campaign directed against Colombian government institutions and private companies in the energy and metallurgical industries. In a report published by ESET on Tuesday, the Slovak internet security company said the attacks — dubb...

UBUNTU-CVE-2021-3139

In Open-iSCSI tcmu-runner 1.3.x, 1.4.x, and 1.5.x through 1.5.2, xcopylocateudev in tcmurcmdhandler.c lacks a check for transport-layer restrictions, allowing remote attackers to read or write files via directory traversal in an XCOPY request. For example, an attack can occur over a network if th...

Authorities Take Down World's Largest Illegal Dark Web Marketplace

Europol on Tuesday said it shut down DarkMarket, the world's largest online marketplace for illicit goods, as part of an international operation involving Germany, Australia, Denmark, Moldova, Ukraine, the U.K.'s National Crime Agency NCA, and the U.S. Federal Bureau of Investigation FBI. At the...

Warning — 5 New Trojanized Android Apps Spying On Users In Pakistan

Cybersecurity researchers took the wraps off a new spyware operation targeting users in Pakistan that leverages trojanized versions of legitimate Android apps to carry out covert surveillance and espionage. Designed to masquerade apps such as the Pakistan Citizen Portal, a Muslim prayer-clock app...

NSA Cybersecurity Directorate Releases 2020 Year in Review

The National Security Agency NSA Cybersecurity Directorate has released its 2020 Year in Review, outlining key milestones and mission outcomes achieved during NSA Cybersecurity’s first full year of existence. Highlights include NSA Cybersecurity’s contributions to the 2020 elections, Operation Wa...

Russia’s SolarWinds Attack and Software Security

The information that is emerging about Russias extensive cyberintelligence operation against the United States and other countries should be increasingly alarming to the public. The magnitude of the hacking, now believed to have affected more than 250 federal agencies and businesses -- ­primarily...

Reading on uninitialized memory may cause UB ( `util::read_spv()` )

Affected versions of this crate passes an uninitialized buffer to a user-provided Read implementation. Arbitrary Read implementations can read from the uninitialized buffer memory exposure and also can return incorrect number of bytes written to the buffer. Reading from uninitialized memory...

CRUD Operation 1.0 - Multiple Stored XSS

Exploit Title: CRUD Operation 1.0 - Multiple Stored XSS Date: 4/1/2021 Exploit Author: Arnav Tripathy Vendor Homepage: https://egavilanmedia.com Software Link: https://egavilanmedia.com/crud-operation-with-php-mysql-bootstrap-and-dompdf/ Version: 1.0 Tested on: linux / Lamp Click on add new recor...

FBI, CISA, NSA Officially Blame Russia for SolarWinds Cyber Attack

The U.S. government on Tuesday formally pointed fingers at the Russian government for orchestrating the massive SolarWinds supply chain attack that came to light early last month. "This work indicates that an Advanced Persistent Threat APT actor, likely Russian in origin, is responsible for most ...

CVE-2020-36169

An issue was discovered in Veritas NetBackup through 8.3.0.1 and OpsCenter through 8.3.0.1. Processes using OpenSSL attempt to load and execute libraries from paths that do not exist by default on the Windows operating system. By default, on Windows systems, users can create directories under the...

USN-4677-1 p11-kit vulnerabilities

David Cook discovered that p11-kit incorrectly handled certain memory operations. An attacker could use this issue to cause p11-kit to crash, resulting in a denial of service, or possibly execute arbitrary code...

EulerOS 2.0 SP9 : hunspell (EulerOS-SA-2021-1007)

According to the version of the hunspell packages installed, the EulerOS installation on the remote host is affected by the following vulnerability : - Hunspell 1.7.0 has an invalid read operation in SuggestMgr::leftcommonsubstring in suggestmgr.cxx.CVE-2019-16707 Note that Tenable Network Securi...

FFmpeg 缓冲区错误漏洞

FFmpeg is a complete solution for recording, converting and streaming audio and video from the FFmpeg Ffmpeg team. A buffer overflow vulnerability exists in FFmpeg version 4.3.1, which stems from an error when calculating when to perform a memset zero operation. No details of the vulnerability ar...

CVE-2020-17008 splWOW64 Elevation of Privilege Patch Bypass

This CVE is the result of a patch bypass for CVE-2020-0986, reported to Microsoft by Kaspersky in December 2019 and patched in June 2020. Google Project Zero researcher Maddie Stone notified Microsoft on September 24, 2020 that the fix for Kaspersky’s reported vulnerability was incomplete...

CVE-2020-1848

There is a resource management error vulnerability in Jackman-AL00D versions 8.2.0.185C00R2P1. Local attackers construct malicious application files, causing system applications to run abnormally...

Police Arrest 21 WeLeakInfo Customers Who Bought Breached Personal Data

21 people have been arrested across the UK as part of a nationwide cyber crackdown targeting customers of WeLeakInfo.com, a now-defunct online service that had been previously selling access to data hacked from other websites. The suspects used stolen personal credentials to commit further cyber...

Cybercriminals' Favorite Bulletproof VPN Service Shuts Down In Global Action

Law enforcement agencies from the US, Germany, Netherlands, Switzerland, France, along with Europol's European Cybercrime Centre EC3, announced today the coordinated takedown of Safe-Inet, a popular virtual private network VPN service that was used to facilitate criminal activity. The three domai...

Feds seize VPN service used by hackers in cyber attacks

By Deeba Ahmed Cybercriminals’ Favorite VPN Service Rendered ‘Inaccessible’ in a Joint Operation Conducted by Europol and the FBI. This is a post from HackRead.com Read the original post: Feds seize VPN service used by hackers in cyber attacks...

SeaCMS SQL Injection Vulnerability (CNVD-2020-74059)

SeaCMS Ocean CMS is a professional open source free PHP film and television system. SeaCMS 10.1 2020.02.08 suffers from a SQL injection vulnerability. An attacker can exploit this vulnerability by using the id parameter in the edit operation of adminmembersgroup.php to perform a SQL injection...

SeaCMS SQL注入漏洞

SeaCMS Ocean CMS is a professional open source free PHP film and television system. SeaCMS 10.1 2020.02.08 suffers from a SQL injection vulnerability. An attacker can exploit this vulnerability by using the id parameter in the edit operation of adminmembersgroup.php to perform a SQL injection...