3290 matches found
Dark web hackers selling 400,000 South Korean & US payment card data
By Sudais Asif According to researchers, this is the biggest sale of South Korean payment cards both credit and debit on the dark web in 2020. This is a post from HackRead.com Read the original post: Dark web hackers selling 400,000 South Korean & US payment card data...
edm-tableau-external-test.usbank.com Cross Site Scripting vulnerability
Open Bug Bounty ID: OBB-1149171 Following coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has:       a. verified the vulnerability and confirmed its existence;       b. notified the website...
Stripo Inc: [www.stripo.email] There is no rate limit for /it/contact-us/ endpoints
The speed limit for the https://stripo.email/it/contact-us endpoint has not been implemented...
Stripo Inc: [www.stripo.email] There is no rate limit for contact-us endpoints
Summary The speed limit for the https://stripo.email/es/contact-us endpoint has not been implemented. Steps To Reproduce 1. Go to the https://stripo.email/es/contact-us 2. Turn on blocking and fill out the contact form 3. Send request to Intruder. 4. Set your payloads and start attack. 5. There i...
Inductive Automation Ignition
1. EXECUTIVE SUMMARY CVSS v3 9.1 ATTENTION: Exploitable remotely/low skill level to exploit Vendor: Inductive Automation Equipment: Ignition 8 Gateway Vulnerability: Improper Access Control 2. RISK EVALUATION Successful exploitation of this vulnerability could allow an attacker to write endless...
NERC CIP Compliance in Azure vs. Azure Government cloud
As discussed in my last blog post on North American Electric Reliability Corporation—Critical Infrastructure Protection NERC CIP Compliance in Azure, U.S. and Canadian utilities are now free to benefit from cloud computing in Azure for many NERC CIP workloads. Machine learning, multiple data...
us-a.eu Cross Site Scripting vulnerability
Open Bug Bounty ID: OBB-1147101 Security Researcher MrRain1996 Helped patch 1003 vulnerabilities Received 5 Coordinated Disclosure badges Received 9 recommendations , a holder of 5 badges for responsible and coordinated disclosure, found a security vulnerability affecting us-a.eu website and its...
U.S. Dept Of Defense: Previously Compromised PulseSSL VPN Hosts
Hi again!! Back in 2019, I had reported that a pulseSSL VPN server owned by US DoD can be compromised by a publicly available exploit. The report is 681249. As a result, the userid and passwd db was also compromised. I found that at least 1 userid and password combination from that compromised db...
U.S. Dept Of Defense: Members Personal Information Leak Due to IDOR
Summary https://██████ allows anyone to sign up and view other members profile. According to wikipedia, ███████ is part of US DoD "████████": ██████ I signed up with a regular account and noticed that by referencing users ████, I can send thousands of "█████████" and also, using another end-point...
A billion-dollar US firm caught exposing highly sensitive database online
By Sudais Asif Another day, another data breach - This time, database of a US firm named has surfaced online containing highly sensitive data. This is a post from HackRead.com Read the original post: A billion-dollar US firm caught exposing highly sensitive database online...
So Wait, How Encrypted Are Zoom Meetings Really?
The service's mixed messages have frustrated cryptographers, as the US government and other sensitive organizations increasingly depend on it...
Story of Gus Weiss
This is a long and fascinating article about Gus Weiss, who masterminded a long campaign to feed technical disinformation to the Soviet Union, which may or may not have caused a massive pipeline explosion somewhere in Siberia in the 1980s, if in fact there even was a massive pipeline explosion...
The Army Corps of Engineers Deploys Against Coronavirus
The US is desperate for hospital beds. The US Army Corps of Engineers can build thousands of them in a matter of days...
TrickBot Now Exploits Infected PCs to Launch RDP Brute Force Attacks
A new module for TrickBot banking Trojan has recently been discovered in the wild that lets attackers leverage compromised systems to launch brute-force attacks against selected Windows systems running a Remote Desktop Protocol RDP connection exposed to the Internet. The module, dubbed...
U.S. Dept Of Defense: Apache solr RCE via velocity template
Hi team, While doing some recon i stumbled upon an IP address http://██████/ The IP took me to a Login Page at ████=https%3A%2F%2F██████████████████ as of the URL suggest this system belongs to US gov. Doing a Port scan reveals that POST ██████████ is Open, A lot of doors open if Solr is exposed...
Coronavirus related cyber attacks hit HHS in US, testing center in Czech
By Deeba Ahmed Who could have imagined cyber criminals will use Coronavirus pandemic to steal data and make quick money? This is a post from HackRead.com Read the original post: Coronavirus related cyber attacks hit HHS in US, testing center in Czech...
201 million US demographic, personal records leaked online
By Waqas Another day, another data breach - This time, 201 million records have been leaked online. This is a post from HackRead.com Read the original post: 201 million US demographic, personal records leaked online...
More on Crypto AG
One follow-on to the story of Crypto AG being owned by the CIA: this interview with a Washington Post reporter. The whole thing is worth reading or listening to, but I was struck by these two quotes at the end: ...in South America, for instance, many of the governments that were using Crypto...
A Massive U.S. Property and Demographic Database Exposes 200 Million Records
More than 200 million records containing a wide range of property-related information on US residents were left exposed on a database that was accessible on the web without requiring any password or authentication. The exposed data — a mix of personal and demographic details — included the name,...
2 Chinese Charged with Laundering $100 Million for North Korean Hackers
Two Chinese nationals have been charged by the US Department of Justice DoJ and sanctioned by the US Treasury for allegedly laundering $100 million worth of virtual currency using prepaid Apple iTunes gift cards. According to a newly unsealed court document, the illicit funds originated from a $2...