SAS@Home Virtual Summit Showcases New Threat Intel, Industry Changes

As the COVID-19 pandemic continues to force in-person cybersecurity event cancellations, Kaspersky is forging ahead with a virtual security summit, SAS@home. Topics on the agenda include threat intel on advanced persistent threats APTs, new vulnerability research, and topics related to a...

Cyberattackers Ramp Up to 1.5M COVID-19 Emails Per Day

Cyberattackers have reached a peak of sending 1.5 million malicious emails per day related to the COVID-19 pandemic over the course of the last three months, according to new research. Research from Forcepoint analyzing coronavirus-themed attacks between Jan. 19 to April 18 found cybercriminals...

Prusa Research PrusaSlicer _3MF_Importer::_handle_end_model() use-after-free vulnerability

Summary A use-after-free vulnerability exists in the 3MFImporter::handleendmodel functionality of Prusa Research PrusaSlicer 2.2.0 and Master commit 4b040b856. A specially crafted 3MF file can lead to code execution. An attacker can provide a malicious file to trigger this vulnerability. Tested...

suqu.market Cross Site Scripting vulnerability

Open Bug Bounty ID: OBB-1144936 Security Researcher g0bl1nsec Helped patch 3768 vulnerabilities Received 4 Coordinated Disclosure badges Received 3 recommendations , a holder of 4 badges for responsible and coordinated disclosure, found a security vulnerability affecting suqu.market website and i...

portalpune.com Cross Site Scripting vulnerability

Open Bug Bounty ID: OBB-1144452 Security Researcher ELProfesor Helped patch 2793 vulnerabilities Received 8 Coordinated Disclosure badges Received 106 recommendations , a holder of 8 badges for responsible and coordinated disclosure, found a security vulnerability affecting portalpune.com website...

File Transfer iFamily 2.1 - Directory Traversal Vulnerability

Exploit for iOS platform in category web applications Title: File Transfer iFamily 2.1 - Directory Traversal Software Link: http://www.dedecms.com/products/dedecms/downloads/ CVE: N/A Document Title: =============== File Transfer iFamily v2.1 - Directory Traversal Vulnerability Vulnerability Clas...

insantro.ru Cross Site Scripting vulnerability

Open Bug Bounty ID: OBB-1142569 Security Researcher geeknik Helped patch 8696 vulnerabilities Received 8 Coordinated Disclosure badges Received 20 recommendations , a holder of 8 badges for responsible and coordinated disclosure, found a security vulnerability affecting insantro.ru website and it...

Hackers Targeting Critical Healthcare Facilities With Ransomware During Coronavirus Pandemic

As hospitals around the world are struggling to respond to the coronavirus crisis, cybercriminals—with no conscience and empathy—are continuously targeting healthcare organizations, research facilities, and other governmental organizations with ransomware and malicious information stealers. The n...

securityresearchmap.de Cross Site Scripting vulnerability

Open Bug Bounty ID: OBB-1138339 Security Researcher ELProfesor Helped patch 2791 vulnerabilities Received 8 Coordinated Disclosure badges Received 106 recommendations , a holder of 8 badges for responsible and coordinated disclosure, found a security vulnerability affecting securityresearchmap.de...

Travelex Pays $2.3M in Bitcoin to Hackers Who Hijacked Network in January

Travelex has paid out $2.3 million in Bitcoin to hackers to regain access to its global network after a malware attack at the new year knocked the global currency exchange offline and crippled its business during the month of January. The move—reported by the Wall Street Journal—may seem...

securityresearchmap.de Cross Site Scripting vulnerability

Open Bug Bounty ID: OBB-1137606 Security Researcher ELProfesor Helped patch 2791 vulnerabilities Received 8 Coordinated Disclosure badges Received 106 recommendations , a holder of 8 badges for responsible and coordinated disclosure, found a security vulnerability affecting securityresearchmap.de...

Exploit for Exposure of Sensitive Information to an Unauthorized Actor in Gitlab

It is an offensive tool for vulnerability research and education. The primary CVE ID is not explicitly mentioned, but the repository contains various vulnerable environments based on Docker-Compose, including ones for CVE-2016-9086, CVE-2017-1000353, and CVE-2018-1000006. The target product/servi...

A Cheap 3D Printer Can Trick Smartphone Fingerprint Locks

With a budget of just $2,000, researchers could fool biometric scanners 80 percent of the time...

Amcrest Dahua NVR Camera IP2M-841 Denial Of Service

Exploit Title: Amcrest Dahua NVR Camera IP2M-841 - Denial of Service PoC Date: 2020-04-07 Exploit Author: Jacob Baines Vendor Homepage: https://amcrest.com/ Software Link: https://amcrest.com/firmwaredownloads Version: Many different versions due to number of Dahua/Amcrest/etc devices affected...

chabotcollege.edu Cross Site Scripting vulnerability

Open Bug Bounty ID: OBB-1135845 Security Researcher 4NCURZE Helped patch 1496 vulnerabilities Received 7 Coordinated Disclosure badges Received 12 recommendations , a holder of 7 badges for responsible and coordinated disclosure, found a security vulnerability affecting chabotcollege.edu website...

lawyerlocate.ca Cross Site Scripting vulnerability

Open Bug Bounty ID: OBB-1132676 Security Researcher KhanJanny Helped patch 3056 vulnerabilities Received 9 Coordinated Disclosure badges Received 38 recommendations , a holder of 9 badges for responsible and coordinated disclosure, found a security vulnerability affecting lawyerlocate.ca website...

Wiper Malware Called "Coronavirus" Spreads Among Windows Victims

A new Windows malware has emerged that makes disks unusable by overwriting the master boot record MBR. It takes its cue from the COVID-19 pandemic, calling itself simply “Coronavirus.” Overwriting the MBR is the same trick that the infamous NotPetya wiper malware used in 2017 in a campaign that...

Key Findings from the 2020 Cyberthreat Defense Report

The new 2020 Cyberthreat Defense Report CDR released this week. Now in its seventh year, the annual report provides a look at how global cybersecurity professionals perceive threats and plan to defend against them. The CDR enables cybersecurity professionals to benchmark their company’s security...

Exploit for CVE-2020-1938

说明 工具仅用于安全研究以及内部自查, 禁止使用工具发起非法攻击, 造成的后果由使用者负责 Apache Tomcat文件包含漏洞（CVE-2020-1938 / CNVD-2020-1048 ）批量检测工具. 此项目在Kit4y的项目的基础上进行修改. 代码修改 当ip.txt中只有1个域名或ip时, 会使得threadCount为1, 程序实际上没有运行, 增加判断线程数的代码 ... if threadCount == 1: threadCount = 2 for i in range0,threadCount-1: ... 修改少量代码, 以兼容Python3. 修改前的代码...

Clarifying the Computer Fraud and Abuse Act

A federal court has ruled that violating a website's terms of service is not "hacking" under the Computer Fraud and Abuse Act. The plaintiffs wanted to investigate possible racial discrimination in online job markets by creating accounts for fake employers and job seekers. Leading job sites have...