3299 matches found
The US Says Chinese Hackers Went Too Far During the Covid-19 Crisis
The FBI and DHS say that Beijing's hacking “jeopardizes” the delivery of much-needed Covid-19 treatment options...
US Government Exposes North Korean Malware
US Cyber Command has uploaded North Korean malware samples to the VirusTotal aggregation repository, adding to the malware samples it uploaded in February. The first of the new malware variants, COPPERHEDGE, is described as a Remote Access Tool RAT "used by advanced persistent threat APT cyber...
Feds Reveal Hidden Cobra's Trove of Espionage Tools
The U.S. Department of Homeland Security and Federal Bureau of Investigation have exposed what they say are hacking tools used by the North Korean-sponsored APT group Hidden Cobra. The disclosure was the result of a broad government effort to combat the advanced persistent threat group, who have...
U.S. Defense Warns of 3 New Malware Used by North Korean Hackers
Yesterday, on the 3rd anniversary of the infamous global WannaCry ransomware outbreak for which North Korea was blamed, the U.S. government released information about three new malware strains used by state-sponsored North Korean hackers. Called COPPERHEDGE, TAINTEDSCRIBE, and PEBBLEDASH, the...
North Korean Malicious Cyber Activity
The Cybersecurity and Infrastructure Security Agency CISA, the Federal Bureau of Investigation FBI, and the Department of Defense DoD have identified three malware variants—COPPERHEDGE, TAINTEDSCRIBE, and PEBBLEDASH—used by the North Korean government. In addition, U.S. Cyber Command has released...
SQL injection vulnerability in us***.php of Easy B2C Mall System v1.1
Easy B2C mall system is a mall system based on open source framework development. Easy B2C Mall System V1.1 version us.php SQL injection vulnerability, attackers can use the vulnerability to obtain sensitive information in the database...
Fazecast jSerialComm
1. EXECUTIVE SUMMARY CVSS v3 7.8 ATTENTION: Low skill level to exploit Vendor: Fazecast Equipment: jSerialComm Vulnerability: Uncontrolled Search Path Element 2. RISK EVALUATION Successful exploitation of this vulnerability could allow an unauthenticated attacker to execute arbitrary code on a...
Hackers exploit vulnerability to leak The Last of Us 2 spoiler video
By Deeba Ahmed Last week, it was reported that someone leaked The Last of Us Part 2 story spoilers online. Now Sony knows who... This is a post from HackRead.com Read the original post: Hackers exploit vulnerability to leak The Last of Us 2 spoiler video...
Parts of a Whole: Effect of COVID-19 on US Internet Traffic
Introduction In our previous post, The Building Wave of Internet Traffic, we looked at the traffic patterns across Europe and the effect the COVID-19 pandemic has had. We examined traffic in Italy, Poland, and Spain, and demonstrated how we observed...
Dark web hackers selling 400,000 South Korean & US payment card data
By Sudais Asif According to researchers, this is the biggest sale of South Korean payment cards both credit and debit on the dark web in 2020. This is a post from HackRead.com Read the original post: Dark web hackers selling 400,000 South Korean & US payment card data...
edm-tableau-external-test.usbank.com Cross Site Scripting vulnerability
Open Bug Bounty ID: OBB-1149171 Following coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has:       a. verified the vulnerability and confirmed its existence;       b. notified the website...
Stripo Inc: [www.stripo.email] There is no rate limit for /it/contact-us/ endpoints
The speed limit for the https://stripo.email/it/contact-us endpoint has not been implemented...
Stripo Inc: [www.stripo.email] There is no rate limit for contact-us endpoints
Summary The speed limit for the https://stripo.email/es/contact-us endpoint has not been implemented. Steps To Reproduce 1. Go to the https://stripo.email/es/contact-us 2. Turn on blocking and fill out the contact form 3. Send request to Intruder. 4. Set your payloads and start attack. 5. There i...
Inductive Automation Ignition
1. EXECUTIVE SUMMARY CVSS v3 9.1 ATTENTION: Exploitable remotely/low skill level to exploit Vendor: Inductive Automation Equipment: Ignition 8 Gateway Vulnerability: Improper Access Control 2. RISK EVALUATION Successful exploitation of this vulnerability could allow an attacker to write endless...
NERC CIP Compliance in Azure vs. Azure Government cloud
As discussed in my last blog post on North American Electric Reliability Corporation—Critical Infrastructure Protection NERC CIP Compliance in Azure, U.S. and Canadian utilities are now free to benefit from cloud computing in Azure for many NERC CIP workloads. Machine learning, multiple data...
us-a.eu Cross Site Scripting vulnerability
Open Bug Bounty ID: OBB-1147101 Security Researcher MrRain1996 Helped patch 1003 vulnerabilities Received 5 Coordinated Disclosure badges Received 9 recommendations , a holder of 5 badges for responsible and coordinated disclosure, found a security vulnerability affecting us-a.eu website and its...
U.S. Dept Of Defense: Previously Compromised PulseSSL VPN Hosts
Hi again!! Back in 2019, I had reported that a pulseSSL VPN server owned by US DoD can be compromised by a publicly available exploit. The report is 681249. As a result, the userid and passwd db was also compromised. I found that at least 1 userid and password combination from that compromised db...
U.S. Dept Of Defense: Members Personal Information Leak Due to IDOR
Summary https://██████ allows anyone to sign up and view other members profile. According to wikipedia, ███████ is part of US DoD "████████": ██████ I signed up with a regular account and noticed that by referencing users ████, I can send thousands of "█████████" and also, using another end-point...
A billion-dollar US firm caught exposing highly sensitive database online
By Sudais Asif Another day, another data breach - This time, database of a US firm named has surfaced online containing highly sensitive data. This is a post from HackRead.com Read the original post: A billion-dollar US firm caught exposing highly sensitive database online...