La Commission de la protection des informations personnelles (PIPC) de Corée du Sud a reçu une seconde notification de violation de données de la part de l'opérateur KT, dans le cadre d'un incident lié à des micropaiements non autorisés.Le 18 septembre, KT a complété sa notification initiale du 11 s...
Note: This is a guest post by pentester and researcher, Tom Stacey (@t0xodile). You'd think that after almost 21 years since its initial public discovery, HTTP Request Smuggling would be barely exploi
A breach at the New York Blood Center resulted in theft of data for 194,000 people, including SSNs, IDs, bank and health information
One third of Android and over half iOS apps shown to be leaking insecure APIs and hardcoded secrets
Mutation testing reveals blind spots in test suites by systematically introducing bugs and checking if tests catch them. Blockchain developers should use mutation testing to measure the effectiveness of their test suites and find bugs that traditional testing can miss.
SonicWall said that threat actors accessed firewall preference files stored in the cloud for around 5% of its firewall install base
Insight Partners has released more details of a 2024 ransomware breach impacting thousands of individuals
How to choose an external attack surface management (EASM) tool that’s right for your organisation.
Long known to be a sweet spot for cybercriminals, small businesses are more likely to be victimized by ransomware than large enterprises
The UK’s National Crime Agency is the new chair of the Five Eyes Law Enforcement Group
Conor Brian Fitzpatrick, the creator of the notorious BreachForums hacking forum, has been resentenced to three years in prison after a US appeals court overturned his prior sentence of time served and 20 years of supervised release.
Read more in my article on the Hot for Security blog.
Every curl security report starts out with someone submitting an issue to us on https://hackerone.com/curl. The reporter tells us what they suspect and what they think the problem is. This report is kept private, visible only to the curl security team and the reporter while we work on it. In recent...
Use after free in Microsoft Graphics Component allows an authorized attacker to elevate privileges locally.
The CVSS score for this vulnerability has been updated to reflect a change in the **Attack Complexity** metric from **High** to **Low**.
This vulnerability allows remote attackers to disclose sensitive information on affected installations of Apple Safari. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The ZDI has assigned a CVSS rating of 4.3. The f...
Concurrent execution using shared resource with improper synchronization ('race condition') in Microsoft Graphics Component allows an authorized attacker to elevate privileges locally.
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Apple macOS. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The ZDI has assigned a CVSS rating of 8.8. The following...
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Apple macOS. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The ZDI has assigned a CVSS rating of 7.8. The following...
In February 2017, the forum for the adult website FreeOnes suffered a data breach that was later redistributed as part of a larger corpus of data. The data included 960k unique email addresses alongside usernames, IP addresses and salted MD5 password hashes.
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Delta Electronics COMMGR. An attacker must first obtain the ability to compromise a PLC in order to exploit this vulnerability. The ZDI has assigned a CVSS rating of 8.8. The following CVEs are assigned...