Mail.ru: A manager of a determinate group of users still might have access to any user account from any group that he doesn't administrate anymore.

Domain, site, application: biz.mail.ru Testing environment: Lastest Chrome Steps to reproduce: Ok, this one is pretty much depending on scenario, so lets assume that there is the Evil Manager exists with network knowledge on higher than medium level. At first lets say that there is such role as...

Hacking Voice Assistant Systems with Inaudible Voice Commands

Turns out that all the major voice assistants -- Siri, Google Now, Samsung S Voice, Huawei HiVoice, Cortana and Alexa -- listen at audio frequencies the human ear can't hear. Hackers can hijack those systems with inaudible commands that their owners can't hear. News articles...

Onliner Spambot dump exposes 711 Million email and passwords

By Waqas The year 2017 has already been the year for some This is a post from HackRead.com Read the original post: Onliner Spambot dump exposes 711 Million email and passwords...

Hack Telegram, WhatsApp and Signal app; get $500,000

By Waqas If you are a hacker or a security researcher, it This is a post from HackRead.com Read the original post: Hack Telegram, WhatsApp and Signal app; get $500,000...

CVE-2017-13142

In ImageMagick before 6.9.9-0 and 7.x before 7.0.6-1, a crafted PNG file could trigger a crash because there was an insufficient check for short files...

adultfriendfinder.fr XSS vulnerability

Open Bug Bounty ID: OBB-279644 Description| Value ---|--- Affected Website:| adultfriendfinder.fr Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

Automattic: https://secure.gravatar.com

Здравствуйте! У вас есть полный доступ к профилю по ссылке...

APT28 Using EternalBlue to Attack Hotels in Europe, Middle East

Russian-speaking cyberespionage group APT28, also known as Sofacy, is believed to be behind a series of attacks last month against travelers staying in hotels in Europe and the Middle East. APT28 notably used the NSA hacking tool EternalBlue as part of its scheme to steal credentials from busines...

Windows exploit techniques: from any directory you create to any file-read-vulnerability warning-the black bar safety net

One, Foreword In the past few months, I'm in meetings, introduced me to the“Windows logic privilege escalation guide”tips. Meeting length is only 2 hours, I would like to introduce many interesting techniques and tricks had to have been deleted. Over time, think in training courses complete about...

Attackers Use Typo-Squatting To Steal npm Credentials

Hackers seeking developer credentials used typo-squatting to spread malicious code via libraries hosted at the online repository npm. In all, 40 npm packages were found malicious and removed from the Node.js package management registry, according to npm. The attack involved a user named HackTask...

Pharmaceutical Giant Still Feeling NotPetya's Sting

NotPetya was massive shift in malware tactics as what was initially believed to be another global ransomware attack on par with WannaCry was instead a wiper in disguise. It claimed thousands of victims worldwide, including some of the highest profile manufacturers, critical infrastructure provide...

crossfitwesthartford.com XSS vulnerability

Open Bug Bounty ID: OBB-267799 Description| Value ---|--- Affected Website:| crossfitwesthartford.com Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

Ethereum Hacks

The press is reporting a $32M theft of the cryptocurrency Ethereum. Like all such thefts, they're not a result of a cryptographic failure in the currencies, but instead a software vulnerability in the software surrounding the currency -- in this case, digital wallets. This is the second Ethereum...

Leaky WWE Database Exposes Personal Data of 3M Fans

Pro wrestling giant World Wrestling Entertainment notified fans on Thursday that a database containing personal information of three million fans was left on an insecure server. According to the WWE, personal information included names, both home and email addresses, earnings, ethnicity, children...

fayettevilleflyer.com Open Redirect vulnerability

Open Bug Bounty ID: OBB-259967 Description| Value ---|--- Affected Website:| fayettevilleflyer.com Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| Open Redirect / CWE-601 CVSSv3 Score:| 3.4...

asp01.fnguide.com XSS vulnerability

Vulnerable URL: http://asp01.fnguide.com/SVO2/asp/SVDDisclosurepop.asp?bulletkind=T500no=1"...

click.alfabank.ru XSS vulnerability

Open Bug Bounty ID: OBB-252748 Description| Value ---|--- Affected Website:| click.alfabank.ru Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

Eltek SmartPack - Backdoor Account

Eltek SmartPack - Backdoor Account Eltek SmartPack - Backdoor Account Author: Saeed reza Zamanian penetrationtest @ Linkedin Product: Eltek SmartPack Vendor: http://www.eltek.com/ Product Link : http://www.eltek.com/detailproducts.epl?k1=25507&id=1123846 About Product: The Smartpack controller is...

Command injection

If multiple users are concurrently logged into a single system where one user is sending a command via the Lenovo ToolsCenter Advanced Settings Utility ASU, UpdateXpress System Pack Installer UXSPI or Dynamic System Analysis DSA to a second machine, the other users may be able to see the user ID...

Application Level Firewall OpenSnitch

Application Level Firewall OpenSnitch OpenSnitch is a GNU/Linux port of the Little Snitch application firewall. OpenSnitch is an application level firewall, meaning then while running, it will detect and alert the user for every outgoing connection applications he’s running are creating. This can...