Hackers Using Fake Trump's Scandal Video to Spread QNode Malware

Cybesecurity researchers today revealed a new malspam campaign that distributes a remote access Trojan RAT by purporting to contain a sex scandal video of U.S. President Donald Trump. The emails, which carry with the subject line "GOOD LOAN OFFER!!," come attached with a Java archive JAR file...

SUSE-SU-2021:0031-1 Security update for tomcat

This update for tomcat fixes the following issue: - CVE-2020-17527: Fixed a HTTP/2 request header mix-up bsc1179602...

h1-ctf: [hackyholidays] CTF write-up

hi, this is my write-up for hackyholidays CTF. I attached the write-up in PDF format. thanks, REND Impact saving the Christmas... fix this otherwise people would be happy...

h1-ctf: Infiltrating into Grinch-Networks and saving Christmas!

Hi, you can find the write-up for this CTF here : https://castilho101.github.io/posts/hackerone-ctf-christmas...

Rust Security Vulnerabilities

Rust is a general-purpose, compiled programming language from the Mozilla Foundation. bigint crate through 2020-05-07 for Rust A security vulnerability exists that allows soundness violations...

h1-ctf: Writeup Submission

The Write-Up will be published within the next hours latest till Dec. 31st 12:00 PST under https://blogs.tippexs.io User: h4ck4r0ne Pass: s4nt4sucks Let me know if I need to submit anything else. I have started crafting an PDF but it become that huge that I have decided to create a complete new...

h1-ctf: 12 Days of CTF Walkthroughs

h1-ctf: 12 Days of Hacky Holidays This is my writeup for 12 Days of Hacky Holidays. The report is written such that beginners to CTFs will be able to learn the tricks of the trade. The Mission: The Grinch has gone hi-tech this year with the intention of ruining the holidays 😱We need you to...

h1-ctf: Stopping Grinch to ruin XMas!

Hello, Gonna just submit flags first then will send my write up later tomorrow. flag1: flag48104912-28b0-494a-9995-a203d1e261e7 https://hackyholidays.h1ctf.com/robots.txt recon revealing hidden endpoint flag2: flagb7ebcb75-9100-4f91-8454-cfb9574459f7 https://hackyholidays.h1ctf.com/s3cr3t-ar3a...

Moderate: Red Hat Security Advisory: kernel security and bug fix update

An update for kernel is now available for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the...

CVE-2020-8936 Arbitrary enclave memory overwrite vulnerability in ECall ecall_restore

An arbitrary memory overwrite vulnerability in Asylo versions up to 0.6.0 allows an attacker to make a host call to UntrustedCall. UntrustedCall failed to validate the buffer range within sgxparams and allowed the host to return a pointer that was an address within the enclave memory. This allowe...

CVE-2020-17527 Apache Tomcat: Request header mix-up between HTTP/2 streams

While investigating bug 64830 it was discovered that Apache Tomcat 10.0.0-M1 to 10.0.0-M9, 9.0.0-M1 to 9.0.39 and 8.5.0 to 8.5.59 could re-use an HTTP request header value from the previous stream received on an HTTP/2 connection for the request associated with the subsequent stream. While this...

CVE-2020-29439

Tesla Model X vehicles before 2020-11-23 have key fobs that rely on five VIN digits for the authentication needed for a body control module BCM to initiate a Bluetooth wake-up action. The full VIN is visible from outside the vehicle...

Tesla Model X Security Breach

Tesla The Tesla Model X is a new energy vehicle from the American company Tesla. A security vulnerability exists in versions of Tesla Model X vehicles prior to 2020-11-23, which stems from the fact that its key fobs rely on 5 VIN digits for authentication, and the Body Control Module BCM is...

Damn-Vulnerable-Bank - Vulnerable Banking Application For Android

Damn Vulnerable Bank Android Application aims to provide an interface for everyone to get a detailed understanding with internals and security aspects of android application. How to Use Application Clone the repository and run the Backend Server as per instructions in the link. We have released t...

GHSA-PFJ3-56HM-JWQ5 Template injection in cron-utils

Impact A Template Injection was identified in cron-utils enabling attackers to inject arbitrary Java EL expressions, leading to unauthenticated Remote Code Execution RCE vulnerability. Versions up to 9.1.2 are susceptible to this vulnerability. Please note, that only projects using the @Cron...

Pray.com exposed data of millions after database mess up

By Deeba Ahmed Pray.com applied lackluster security practices potentially exposing nearly 10 million users to frauds and cyberattacks, claim VpnMentor's researchers. This is a post from HackRead.com Read the original post: Pray.com exposed data of millions after database mess up...

Fixed in Apache Tomcat 9.0.40

Important: Information disclosure CVE-2021-24122 When serving resources from a network location using the NTFS file system it was possible to bypass security constraints and/or view the source code for JSPs in some configurations. The root cause was the unexpected behaviour of the JRE API...

@decentralized-identity/sidetree (>=0.10.0-unstable.0042dcd, <=1.0.1), spec-up (>=0.9.0, <=0.10.1) +2 more potentially affected by unknown CVE via markdown-it-prism (>=2.0.3, <=2.1.2)

markdown-it-prism NPM version =2.0.3, =0.10.0-unstable.0042dcd, =0.9.0, =1.1.11, =0.10.1, =0.11.1-preview.1 Source cves: unknown CVE Source advisory: SNYK:JS-MARKDOWNITPRISM-1040462...

An Engineer Gets 9 Years for Stealing $10M From Microsoft

The defendant tried—and failed—to use bitcoin to cover his tracks...

Receiver Clean-Up Utility

Important Notes Please note: You can download the required file from the Citrix downloads website by visiting the following link: https://www.citrix.com/downloads/citrix-tools --- Receiver cleanup utility is not required while upgrading to the Receiver forWindows 4.4 or newer. Receiver for Window...