3299 matches found
Hackers Calling Employees to Steal VPN Credentials from US Firms
Watch out for THE CALL!...
Iranian State Hackers Team Up with Ransomware Gangs in Attacks on US
State-Sponsored Espionage Meets Ransomware!...
CODAC Behavioral Healthcare, US Marshalls are latest ransomware targets
The Qilin ransomware group listed CODAC Behavioral Healthcare, a nonprofit health care treatment organization, as one of their latest victims. Qilin seems to have a preference for healthcare and support organizations. One of their most well-known victims was the pathology lab services provider...
Iran-based Cyber Actors Enabling Ransomware Attacks on US Organizations
Summary The Federal Bureau of Investigation FBI, Cybersecurity and Infrastructure Security Agency CISA, and the Department of Defense Cyber Crime Center DC3 are releasing this joint Cybersecurity Advisory CSA to warn network defenders that, as of August 2024, a group of Iran-based cyber actors...
US Federal Court Rules Against Geofence Warrants
This is a big deal. A US Appeals Court ruled that geofence warrants--these are general warrants demanding information about all people within a geographical boundary--are unconstitutional. The decision seems obvious to me, but you cant take anything for granted...
The US Navy Has Run Out of Pants
Plus: The US intelligence community formally blames Iran for Trump campaign hack, aircraft-tracking platform FlightAware says a “configuration error” exposed sensitive user data, and more...
The US Government Wants You—Yes, You—to Hunt Down Generative AI Flaws
The AI ethics nonprofit Humane Intelligence and the US National Institute of Standards and Technology are launching a series of contests to get more people probing for problems in generative AI systems...
Toyota confirms customer and employee data stolen, says breach at third party to blame
Last week, a cybercriminal using the handle ZeroSevenGroup dumped 240GB of data on the infamous stolen data site BreachForums, that they said came from a hack on the US branch of car manufacturer Toyota. ZeroSevenGroup claims the dump includes customer and employee data. ZeroSevenGroup posted the...
U.S. Dept Of Defense: XSS found for https://█████████
The XSS vulnerability was found in the /web/guest/search endpoint, where the query parameter was not properly sanitized before being reflected in the server's response. An attacker could craft a malicious payload and trick a user into sending a POST request, allowing the execution of arbitrary...
CVE-2024-40481
A Stored Cross Site Scripting XSS vulnerability was found in "/admin/view-enquiry.php" in PHPGurukul Old Age Home Management System v1.0, which allows remote attackers to execute arbitrary code via the Contact Us page "message" parameter...
USPS Text Scammers Duped His Wife, So He Hacked Their Operation
The Smishing Triad network sends up to 100,000 scam texts per day globally. One of those messages went to Grant Smith, who infiltrated their systems and exposed them to US authorities...
Thousands of Exposed Industrial Control Systems in US, UK Threaten Water Supplies
Thousands of Industrial Control Systems in the US and UK are vulnerable to cyberattacks, putting critical infrastructure like…...
CVE-2024-40481
The vulnerability CVE-2024-40481 affects PHPGurukul Old Age Home Management System v1.0, specifically the /admin/view-enquiry.php endpoint. A Stored Cross Site Scripting (XSS) flaw exists in the Contact Us page message parameter, allowing remote attackers to execute arbitrary code. The issue is d...
CVE-2024-40481
A Stored Cross Site Scripting XSS vulnerability was found in "/admin/view-enquiry.php" in PHPGurukul Old Age Home Management System v1.0, which allows remote attackers to execute arbitrary code via the Contact Us page "message" parameter...
CVE-2024-40481
A Stored Cross Site Scripting XSS vulnerability was found in "/admin/view-enquiry.php" in PHPGurukul Old Age Home Management System v1.0, which allows remote attackers to execute arbitrary code via the Contact Us page "message" parameter...
CVE-2024-7505
A vulnerability, which was classified as critical, was found in itsourcecode Bike Delivery System 1.0. Affected is an unknown function of the file contactusaction.php. The manipulation of the argument name leads to sql injection. It is possible to launch the attack remotely. The exploit has been...
PT-2024-38394 · Unknown · Bike Delivery System
Name of the Vulnerable Software and Affected Versions: Bike Delivery System version 1.0 Description: A critical issue was found in the Bike Delivery System, affecting an unknown function of the file contact us action.php. The manipulation of the name argument leads to SQL injection. It is possibl...
How Project 2025 Would Put US Elections at Risk
Experts say the “nonsensical” policy proposal, which largely aligns with Donald Trump’s agenda, would weaken the US agency tasked with protecting election integrity, critical infrastructure, and more...
US Hands Over Russian Cybercriminals in WSJ Reporter Prisoner Swap
Plus: Meta pays $1.4 million in a historic privacy settlement, Microsoft blames a cyberattack for a major Azure outage, and an artist creates a face recognition system to reveal your NYPD “coppelganger.”...