Sodinokibi drops greatest hits collection, and crime is the secret ingredient

When a group of celebrities ask to speak with their lawyer, they usually don’t have to call in a bunch of other people to go speak with their lawyer. However, in this case it may well be a thing a little down the line. A huge array of musicians including Bruce Springsteen, Lady Gaga, Madonna, Run...

Over 4000 Android Apps Expose Users' Data via Misconfigured Firebase Databases

More than 4,000 Android apps that use Google's cloud-hosted Firebase databases are 'unknowingly' leaking sensitive information on their users, including their email addresses, usernames, passwords, phone numbers, full names, chat messages and location data. The investigation, led by Bob Diachenko...

Hackers breach Ghost blogging platform to mine cryptocurrency

By Waqas The popular open-source blogging platform Ghost has suffered a security breach in which hackers attempted to mine cryptocurrency on... This is a post from HackRead.com Read the original post: Hackers breach Ghost blogging platform to mine cryptocurrency...

Helium: unpermitted user can change the device name of admin account

Invited user with only the read-only permission can change the device name in admin account 1.create two account 'A 'and 'B ' in console.helium 2.Invited the account 'B' with 'A' by giving the read-only permission 3.In account 'B' trying to delete the organization created by admin account 'A' and...

digitallibrary.al-furqan.com Cross Site Scripting vulnerability

Open Bug Bounty ID: OBB-1149684 Security Researcher EvilOperator Helped patch 4 vulnerabilities Received 0 Coordinated Disclosure badges , found a security vulnerability affecting digitallibrary.al-furqan.com website and its users. Following coordinated and responsible vulnerability disclosure...

deic.uab.es Cross Site Scripting vulnerability

Open Bug Bounty ID: OBB-1148081 Security Researcher ELProfesor Helped patch 2814 vulnerabilities Received 8 Coordinated Disclosure badges Received 107 recommendations , a holder of 8 badges for responsible and coordinated disclosure, found a security vulnerability affecting deic.uab.es website an...

CVE-2019-14012

CVE-2019-14012 is a null pointer dereference in Snapdragon video codec handling when processing SDP messages, triggered by referencing the codecs array without null checks across multiple Snapdragon platforms (Auto, Compute, Consumer IOT, Industrial IOT, Mobile, Wearables) and a wide range of SoC...

Over half a million Zoom accounts being sold on hacker forum

By Sudais Asif A hacker is selling 500,000 zoom account credentials on the dark web and an infamous hacker forum putting the privacy of users at risk. This is a post from HackRead.com Read the original post: Over half a million Zoom accounts being sold on hacker forum...

4 million Quidd user accounts dumped on hacker forum for download

By Waqas 4 million Quidd user accounts dumped on hacker forum for download - The hacker forum is letting anyone download the data. This is a post from HackRead.com Read the original post: 4 million Quidd user accounts dumped on hacker forum for download...

Bolt CMS 3.7.0 - Authenticated Remote Code Execution

Exploit Title: Bolt CMS 3.7.0 - Authenticated Remote Code Execution Date: 2020-04-05 Exploit Author: r3m0t3nu11 Vendor Homepage: https://bolt.cm/ Software Link: https://bolt.cm/ Version: up to date and 6.x Tested on: Linux CVE : not-yet-0day !/usr/bin/python import requests import sys import...

WordPress: Improper Access Control in Buddypress core allows reply,delete any user's activity

Description: Improper Access Control in Buddypress core allows reply,delete any user's activity in other public group,which they don't join. Steps To Reproduce: Step 1: Create two account A, B with two public groups Step 2: In group A-account A, create a new activity idA Step 3: In group B-accoun...

Cerberus Helpdesk Workers File User Credentials Disclosure

Cerberus Helpdesk on Version 4.2.3 Stable Build 925 and 5.4.4 and potentially below, contain an unsecured file which contains configuration details including all user’s usernames and password hashes. Recent assessments: h00die at March 25, 2020 12:30am UTC reported: Found this software in an...

German army’s sensitive data found on laptop bought from eBay

By Sudais Asif When dug, it turns out that the laptop contained highly sensitive information including military secrets. This is a post from HackRead.com Read the original post: German army's sensitive data found on laptop bought from eBay...

Security Breach Disrupts Fintech Firm Finastra

Finastra, a company that provides a range of technology solutions to banks worldwide, said today it was shutting down key systems in response to a security breach discovered this morning. The company's public statement and notice to customers does not mention the cause of the outage, but their...

Crafty Web Skimming Domain Spoofs “https”

Earlier today, KrebsOnSecurity alerted the 10th largest food distributor in the United States that one of its Web sites had been hacked and retrofitted with code that steals credit card and login data. While such Web site card skimming attacks are not new, this intrusion leveraged a sneaky new...

A Massive U.S. Property and Demographic Database Exposes 200 Million Records

More than 200 million records containing a wide range of property-related information on US residents were left exposed on a database that was accessible on the web without requiring any password or authentication. The exposed data — a mix of personal and demographic details — included the name,...

Hackers Compromise T-Mobile Employee' Email Accounts and Steal User' Data

If you are a T-Mobile customer, this news may concern you. US-based telecom giant T-Mobile has suffered yet another data breach incident that recently exposed personal and accounts information of both its employees and customers to unknown hackers. What happened? In a breach notification posted o...

CVE-2020-10104

An issue was discovered in Zammad 3.0 through 3.2. After authentication, it transmits sensitive information to the user that may be compromised and used by an attacker to gain unauthorized access. Hashed passwords are returned to the user when visiting a certain URL...

U.S. Dept Of Defense: PII Leak via https://████████

Summary: An attacker can create an account on https://████ and gain access to a wealth of PII for practically every member that is registered on the website. This includes e-mail addresses, physical addresses, telephone numbers, and other information about a vast majority of the US Air Force, as...

Fraudsters cloak credit card skimmer with fake content delivery network, ngrok server

Threat actors love to abuse legitimate brands and infrastructure—this, we know. Last year we exposed how web skimmers had found their way onto Amazon's Cloudfront content delivery network CDN via insecure S3 buckets. Now, we discovered scammers pretending to be CDNs while exfiltrating data and...