Facebook Sweetens Deal for Hackers to Catch Security Bugs

The company is turbocharging its bug bounty to try to stop the next data leak before it happens...

Top Echelon Software: Disable xmlrpc.php file

Summary: xmlrpc.php can be used for portscanning or bruteforce attacks. Better is to hide this file. Steps To Reproduce: 1. Go to https://www.topechelon.com/xmlrpc.php 2. send a post request. POST /xmlrpc.php HTTP/1.1 Host: www.topechelon.com User-Agent: Mozilla/5.0 X11; Linux x8664; rv:60.0...

Frenemy at the Gates: The Breaching

Online businesses have to be careful. It’s a dangerous world, full of anonymous people and services wearing digital skins. It sounds horrific because it is. On the other side of a transaction, could be anyone. Extra measures have to be made to secure web interfaces and API endpoints that online...

Frenemy at the Gates: The Breaching

Online businesses have to be careful. It’s a dangerous world, full of anonymous people and services wearing digital skins. It sounds horrific because it is. On the other side of a transaction, could be anyone. Extra measures have to be made to secure web interfaces and API endpoints that online...

Apple Finally Breaks Its Silence on iOS Hacking Campaign

In its first public statement since Google revealed a sophisticated attack against iOS devices, Apple defended its security measures...

Innovation on the Dark Web: How Bad Actors Are Keeping Pace

By now, the vast majority of consumers have heard of the dark web. Even if they aren’t exactly sure how it works, they know that it’s the deep corner of the internet where “bad things happen.” Ever since the highly publicized seizure of large dark markets like AlphaBay and Hansa, It’s become comm...

Binance Confirms Hacker Obtained Its Users' KYC Data from 3rd-Party Vendor

As suspected, the KYC details of thousands of Binance's customers that hackers obtained and leaked online earlier this month came from the company's third-party vendor, Malta-based cryptocurrency exchange Binance confirmed. For those unaware, Binance, the world's largest cryptocurrency exchange b...

The Fight Against Robocalls Gets Powerful New Allies

All the state attorneys general, along with 12 major companies, promise to finally make serious moves against robocalls...

How to Guide Users to Better Passwords by Learning from Attackers

If you’re human, you’ve probably re-used a password or two. In fact, the majority of internet users between the ages of 18-65 have done so, and the younger you are, the more likely it is that you use just one password for all of your accounts. Article written by: Chris LaConte, Chief Strategy...

Trojans, ransomware dominate 2018–2019 education threat landscape

Heading into the new school year, we know educational institutions have a lot to worry about. Teacher assignments. Syllabus development. Gathering supplies. Readying classrooms. But one issue should be worrying school administrators and boards of education more than most: securing their networks...

Russia Is Going to Up Its Game for the 2020 Elections

"You don't need to change votes to cause chaos," Senator Mark Warner tells WIRED in an exclusive interview...

The vulnerability of the DirectWrite programming interface in Windows operating systems allows attackers to disclose sensitive information.

The vulnerability of the DirectWrite programming interface in Windows operating systems is related to errors in object handling in memory. Exploiting this vulnerability can allow an attacker to disclose sensitive information that is protected by security measures...

QuickBooks Cloud Hosting Firm iNSYNQ Hit in Ransomware Attack

Cloud hosting provider iNSYNQ says it is trying to recover from a ransomware attack that shut down its network and has left customers unable to access their accounting data for the past three days. Unfortunately for iNSYNQ, the company appears to be turning a deaf ear to the increasingly anxious...

Delta Industrial Automation CNCSoft ScreenEditor

1. EXECUTIVE SUMMARY CVSS v3 7.8 ATTENTION: Exploitable remotely/low skill level to exploit Vendor: Delta Electronics Equipment: CNCSoft ScreenEditor Vulnerabilities: Heap-based Buffer Overflow, Out-of-Bounds Read 2. RISK EVALUATION Successful exploitation of these vulnerabilities could cause...

PT-2019-6468 · Solarwinds · Dameware Mini Remote Control

Name of the Vulnerable Software and Affected Versions: DameWare Mini Remote Control version 12.1.0.89 Description: The issue allows an unauthenticated, remote attacker to request smart card login and upload and execute an arbitrary executable run under the Local System account. This is due to a...

Marriott Faces $123 Million GDPR Fine Over Starwood Data Breach

After fining British Airways with a record fine of £183 million earlier this week, the UK's data privacy regulator is now planning to slap world's biggest hotel chain Marriott International with a £99 million $123 million fine under GDPR over 2014 data breach. This is the second major penalty...

Symantec Messaging Gateway Privilege Escalation

SUMMARY Symantec has released an update to address an issue that was discovered in the Symantec Messaging Gateway SMG product. AFFECTED PRODUCTS Symantec Messaging Gateway SMG --- CVE | Affected Versions | Remediation CVE-2019-12751 | Prior to 10.7.1 | Upgrade to 10.7.1 ISSUES CVE-2019-12751 ---...

WordPress Live Chat Unlimited 2.8.3 Plugin - Cross-Site Scripting Vulnerability

Exploit for php platform in category web applications Exploit Title: Live Chat Unlimited v2.8.3 Stored XSS Injection Google Dork: inurl:"wp-content/plugins/screets-lcx" Date: 2019/06/25 Exploit Author: m0ze Vendor Homepage: https://screets.com/ Software Link:...

WordPress Plugin iLive 1.0.4 - Cross-Site Scripting

Exploit Title: iLive - Intelligent WordPress Live Chat Support Plugin v1.0.4 Stored XSS Injection Google Dork: - Date: 2019/06/25 Exploit Author: m0ze Vendor Homepage: http://www.ilive.wpapplab.com/ Software Link: https://codecanyon.net/item/ilive-wordpress-live-chat-support-plugin/20496563...

Support Board - Chat And Help Desk | Support & Chat <= 1.2.8 Stored XSS

Info: Weak security measures like bad textarea data filtering has been discovered in the «Support Board - Chat And Help Desk | Support & Chat». Demo Website: https://codecanyon.net/item/support-board-chat-and-help-desk/20752085 Backend: https://board.support/desk-demo/?login=true Login / Password...