■□□□□ Majority of Mobile App vulnerabilities are from Open Source code.

■■■■□ 13TB Data-Leak appears online pertaining to Dominos India 🇮🇳.

The data includes 250 internal employee files, 180 million customer order details and 1 million credit card details 💳

Data timeliness are from 2015 to 2021.

@ckure is in the process of assessing validity.

■■■■□ Adfsbrute - A Script To Test Credentials Against Active Directory Federation Services (ADFS), Allowing Password Spraying Or Bruteforce Attacks.

https://github.com/ricardojoserf/adfsbrute

■■■■□ PoC / exploit utilities.

CVE-2020-6516 - Chrome
CVE-2021-24027 - WhatsApp

https://github.com/CENSUS/whatsapp-mitd-mitm

■■■■□ New JavaScript Exploit Can Now Carry Out DDR4 Rowhammer Attacks.

https://thehackernews.com/2021/04/new-javascript-exploit-can-now-carry.html

■□□□□ Data-Leak / Iraq 🇮🇶

● Microsoft Mesh

https://m.youtube.com/watch?v=Xa0H-oO1uCc

● 📢 Hacking forum rf.ws is down. Last HeartBeat by the bot I created shows 11 hours.

■■■■□ Airstrike Attack - FDE bypass and EoP on domain joined Windows workstations (CVE-2021-28316).

https://shenaniganslabs.io/2021/04/13/Airstrike.html

■■■■□ Firefox 'fully compromised' in 15 minutes via SMASH attack.

https://go.theregister.com/feed/www.theregister.com/2021/04/15/rowhammer_ddr4/

■□□□□ Sweden 🇸🇪 blames Russia 🇷🇺 for Swedish Sports Confederation hack in 2017-18.

■■■■■ WhatsApp addressed two security vulnerabilities in its app for Android that could have been exploited to remotely hack the victim’s device.

https://securityaffairs.co/wordpress/116833/hacking/whatsapp-flaws-remote-hack.html

■■■■□ United States 🇺🇸: Australia 🇦🇺based Azimuth unlocked the iPhone at the center of an epic legal battle between the FBI and Apple. Now, Apple is suing the company co-founded by one of the hackers behind the unlock.

https://www.washingtonpost.com/technology/2021/04/14/azimuth-san-bernardino-apple-iphone-fbi/

■■□□□ Security Bug Allows Attackers to Brick Kubernetes Clusters. The vulnerability is triggered when a cloud container pulls a malicious image from a registry.

https://threatpost.com/security-bug-brick-kubernetes-clusters/165413/

■□□□□ Vulnerabilities in 17+ Elementor Add-on Plugins for WordPress.

https://www.searchenginejournal.com/wordpress-elementor-plugin-vulnerabilities/402330/

■■■■■ For the second time in a week, a Chromium zero-day remote code execution exploit code has been released on Twitter, multiple browsers impacted.

https://github.com/avboy1337/1195777-chrome0day

https://securityaffairs.co/wordpress/116844/hacking/google-chromium-zero.html

■■■■■ Remote exploitation of a man-in-the-disk vulnerability in WhatsApp (CVE-2021-24027).

https://census-labs.com/news/2021/04/14/whatsapp-mitd-remote-exploitation-CVE-2021-24027/

■■■■□ WhatsApp exposure of TLS 1.2 cryptographic material to third party apps.

https://census-labs.com/news/2021/04/14/whatsapp-exposure-of-cryptographic-material-to-third-party-apps/

■□□□□ AppSpace Zero-Days

1. XSS - Stored
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-27989

2. Broken Auth
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-27990

Credits: https://www.linkedin.com/in/syedsohaibkarim

■■■□□ Swissknife - Scriptable VSCode Extension To Generate Or Manipulate Data.

https://github.com/luisfontes19/vscode-swissknife/