Tesla 安全漏洞

The Tesla is an electric vehicle from the American company Tesla. Tesla vehicles prior to March 26, 2022 have a security vulnerability that allows an attacker to open the charging port via a 315 MHz radio frequency signal containing a fixed sequence of approximately one hundred symbols...

Microsoft: Lapsus$ Used Employee Account to Steal Source Code

In a new blog post published last night, Microsoft confirmed that the Lapsus$ extortion group hacked one of its employee’s accounts to get “limited access” to project source code repositories. “No customer code or data was involved in the observed activities. Our investigation has found a single...

Microsoft and Okta Confirm Breach by LAPSUS$ Extortion Group

Microsoft on Tuesday confirmed that the LAPSUS$ extortion-focused hacking crew had gained "limited access" to its systems, as authentication services provider Okta revealed that nearly 2.5% of its customers have been potentially impacted in the wake of the breach. "No customer code or data was...

Lapsus$ Data Kidnappers Claim Snatches From Microsoft, Okta

Both Microsoft and Okta are investigating claims by the new, precocious data extortion group Lapsus$ that the gang has breached their systems. Lapsus$ claimed to have gotten itself “superuser/admin” access to internal systems at authentication firm Okta. It also posted 40GB worth of files to its...

LAPSUS$ Hackers Claim to Have Breached Microsoft and Authentication Firm Okta

Microsoft and authentication services provider Okta said they are investigating claims of a potential breach alleged by the LAPSUS$ extortionist gang. The development, which was first reported by Vice and Reuters, comes after the cyber criminal group posted screenshots and source code of what it...

Bandai Namco FromSoftware Dark Souls III 安全漏洞

Bandai Namco FromSoftware Dark Souls III is an action role-playing game by Japanese company FromSoftware. A security vulnerability in the matchmaking server of Bandai Namco FromSoftware Dark Souls III through 2022-03-19 allows remote attackers to send arbitrary push requests to clients via...

SmarterTools SmarterTrack 安全漏洞

SmarterTools SmarterTrack is a customer service software from SmarterTools UK. It improves customer service and reduces support costs. A security vulnerability exists in SmarterTools SmarterTrack 100.0.8019.14010 that originates from direct object access in SmarterTools SmarterTrack...

GHSA-9988-F88M-MR42 Exposure of Sensitive Information to an Unauthorized Actor in FreeTAKServer-UI

FreeTAKServer-UI v1.9.8 was discovered to leak sensitive API and Websocket keys...

Microweber 安全漏洞

Microweber is an online store management system that provides drag and drop functionality from the Microweber community in the United States. The system includes modules for adding products, images, and more. A security vulnerability exists in Microweber prior to version 1.3, which arises from a...

PeerTube 安全漏洞

PeerTube is a decentralized video sharing service platform. It is used to create video projects. PeerTube suffers from a security vulnerability that stems from the insecure storage of sensitive information in the chocobozzz peertube...

Samsung Confirms Lapsus$ Ransomware Hit, Source Code Leak

Just days after leaking data it claims to have exfiltrated from chipmaker NVIDIA, ransomware group Lapsus$ is claiming another international company among its victims — this time releasing data purportedly stolen from Samsung Electronics. The consumer electronics giant confirmed in a media...

Samsung Encryption Flaw

Researchers have found a major encryption flaw in 100 million Samsung Galaxy phones. From the abstract: In this work, we expose the cryptographic design and implementation of Androids Hardware-Backed Keystore in Samsungs Galaxy S8, S9, S10, S20, and S21 flagship devices. We reversed-engineered an...

Iran's MuddyWater Hacker Group Using New Malware in Worldwide Cyber Attacks

Cybersecurity agencies from the U.K. and the U.S. have laid bare a new malware used by the Iranian government-sponsored advanced persistent threat APT group in attacks targeting government and commercial networks worldwide. "MuddyWater actors are positioned both to provide stolen data and accesse...

waline 安全漏洞

waline is a simple commenting system with a backend support branch from Valine. A security vulnerability exists in waline, which stems from waline 1.6.1, and allows an attacker to spoof any IP address using an X-Forwarded-For submission message...

Amazon Echo Dot 安全漏洞

The Amazon Echo Dot is a voice-activated speaker from Amazon.com. It can be used to play music, control smart home devices, make calls, answer questions, set timers and alarms, and more using Alexa. The Amazon Echo Dot 3rd and 4th generation has a security vulnerability that stems from improper...

UPchieve: All user password hash can be seen from admin panel

Summary: During my primary research I found that api/users?page=1&userId=&firstName=test&lastName=&email=&partnerOrg=&highSchool= this endpoint gives hashed password of all users. Steps To Reproduce: + Login to Admin and go to Admin-- Search Users. + We see a request like this was send and in...

microweber 安全漏洞

Microweber is an online store management system that provides drag and drop functionality from the Microweber community in the United States. The system includes modules for adding products, images, and more. A security vulnerability exists in microweber versions prior to 1.3, which stems from th...

Security Bulletin: Session Management vulnerability affects IBM Spectrum Control (formerly Tivoli Storage Productivity Center) (CVE-2019-4072)

Summary Session management has a security breach which in some cases can affect the IBM Spectrum Control application. Vulnerability Details CVEID: CVE-2019-4072 DESCRIPTION: IBM Tivoli Storage Productivity Center allows users to remain idle within the application even when a user has logged out...

microweber 安全漏洞

Microweber is an online store management system that provides drag and drop functionality from the Microweber community in the United States. The system includes modules for adding products, images, and more. A security vulnerability exists in microweber, which is caused by the generation of erro...

Cloud Security and Compliance: The Ultimate Frenemies of Financial Services

Meeting compliance standards as a financial services finserv company can be incredibly time-consuming and expensive. Finserv has some of the highest regulatory bars to clear out of any industry — with the exception, perhaps, of healthcare. That said, these regulations exist for good reason. Even...