1262 matches found
Zoom zero-day discovery makes calls safer, hackers $200,000 richer
Two Dutch white-hat security specialists entered the annual computer hacking contest Pwn2Own, managed to find a Remote Code Execution RCE flaw in Zoom and are $200,000 USD better off than they were before. Pwn2Own Pwn2Own is a high profile event organized by the Zero Day Initiative that challenge...
The Gaming Platforms That Let Streamers Profit From Hate
WIRED has found dozens of far-right and white supremacist figures monetizing their livestreams through “donation management services” Streamlabs and StreamElements...
2020 Shows the Danger of a Decapitated Cyber Regime
Trump's White House has long been AWOL on cybersecurity. That lack of oversight almost seemed to be working—until the SolarWinds hack...
Automattic: GET /api/v2/url_info endpoint is vulnerable to Blind SSRF
Summary: GET /api/v2/urlinfo endpoint is vulnerable to Blind SSRF. I am able to hit both Internal and External services via url parameter by replacing with internal and external url. Platforms Affected: https://www.tumblr.com/ Steps To Reproduce: 1. Login to https://www.tumblr.com/ 2. Follow any...
Become a White Hat Hacker — Get 10 Top-Rated Courses at 97% OFF
Many of us here would love to turn hacking into a full-time career. To make that dream come true, you need to master your subject and earn some key certifications. To speed up this process, you might want to take a little guidance from the experts. Featuring 98 hours of content from top...
Become a White Hat Hacker — Get 10 Top-Rated Courses at 97% OFF
Many of us here would love to turn hacking into a full-time career. To make that dream come true, you need to master your subject and earn some key certifications. To speed up this process, you might want to take a little guidance from the experts. Featuring 98 hours of content from top...
8x8 Bounty: Any meeting chat history can be read and modified by an arbitrary user
A vulnerability existed where a JaaS user could read & modify the chat history of an 8x8 Meet conference. It was limited by the fact that the meeting UUID was required to be known. The fix was promptly deployed to production. A vulnerability in an API accessible through the jaas.8x8.vc white-labe...
Michael Ellis as NSA General Counsel
Over at Lawfare, Susan Hennessey has an excellent primer on how Trump loyalist Michael Ellis got to be the NSA General Counsel, over the objections of NSA Director Paul Nakasone, and what Biden can and should do about it. While important details remain unclear, media accounts include numerous...
Researcher Discloses Critical RCE Flaws In Cisco Security Manager
Cisco has published multiple security advisories concerning critical flaws in Cisco Security Manager CSM a week after the networking equipment maker quietly released patches with version 4.22 of the platform. The development comes after Code White researcher Florian Hauser frycos yesterday public...
Report: CISA Chief Expects White House to Fire Him
Top U.S. cybersecurity official Christopher Krebs said he expects to be fired by the Trump administration after he delivered a secure presidential election that didn’t go in the current administration’s favor. Krebs, the first and current director of the Department of Homeland Security’s DHS’s...
Windows 10, iOS, Chrome, Firefox and Others Hacked at Tianfu Cup Competition
Multiple software products from Adobe, Apple, Google, Microsoft, Mozilla, and Samsung were successfully pwned with previously unseen exploits in Tianfu Cup 2020, the third edition of the international cybersecurity contest held in the city of Chengdu, China. "Many mature and hard targets have bee...
Monitorr 1.7.6m Remote Code Execution
!/usr/bin/python -- coding: UTF-8 -- Exploit Title: Monitorr 1.7.6m - Remote Code Execution Unauthenticated Date: September 12, 2020 Exploit Author: Lyhin's Lab Detailed Bug Description:...
player.chriswhite.tech Cross Site Scripting vulnerability OBB-1468620
Following coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has:       a. verified the vulnerability and confirmed its existence;       b. notified the website operator about its existence...
red-white-grizzlies.de Cross Site Scripting vulnerability OBB-1462442
Following coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has:       a. verified the vulnerability and confirmed its existence;       b. notified the website operator about its existence...
[SECURITY] Fedora 33 Update: python-bleach-3.2.1-1.fc33
Bleach is an HTML sanitizing library that escapes or strips markup and attributes based on a white list...
Researchers Found 55 Flaws in Apple's Corporate Network
The company has patched the vulnerabilities and paid the team of white-hat hackers $288,000...
What Programming Languages Do Ethical Hackers Use?
By Owais Sultan Ethical hacking is when hacking is done for good reasons - The people behind ethical hacking are ethical hackers or white hat hackers. This is a post from HackRead.com Read the original post: What Programming Languages Do Ethical Hackers Use?...
Autoptimize < 2.7.8 - Arbitrary File Upload via "Import Settings"
The plugin attempts to delete malicious files such as .php form the uploaded archive via the "Import Settings" feature, after its extraction. However, the extracted folders are not checked and it is possible to upload a zip which contained a directory with PHP file in it and then it is not remove...
RAINBOWMIX Apps in Google Play Serve Up Millions of Ad Fraud Victims
Researchers with White Ops have uncovered a scam to deliver millions of out-of-context OOC ads through a group of more than 240 Android applications on the official Google Play store, which the team said were collectively delivering more than 15 million impressions per day at their peak. The apps...