■■■■□ WhatsApp exposure of TLS 1.2 cryptographic material to third party apps.

https://census-labs.com/news/2021/04/14/whatsapp-exposure-of-cryptographic-material-to-third-party-apps/

■□□□□ AppSpace Zero-Days

1. XSS - Stored
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-27989

2. Broken Auth
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-27990

Credits: https://www.linkedin.com/in/syedsohaibkarim

■■■□□ Swissknife - Scriptable VSCode Extension To Generate Or Manipulate Data.

https://github.com/luisfontes19/vscode-swissknife/

■■■■■ Multiple one-click vulnerabilities have been discovered across a variety of popular software applications, allowing an attacker to potentially execute arbitrary code on target systems. The issues were discovered by Positive Security researchers Fabian Bräunlein and Lukas Euler and affect apps like Telegram, Nextcloud, VLC, LibreOffice, OpenOffice, Bitcoin/Dogecoin Wallets, Wireshark, and Mumble.

https://positive.security/blog/url-open-rce

https://thehackernews.com/2021/04/1-click-hack-found-in-popular-desktop.html

■■■■□ Cobaltstrike4.1 Source on GitHub.

https://github.com/mai1zhi2/CobaltstrikeSource

■■■□□ United States 🇺🇸 Treasury sanctions Russia 🇷🇺 with sweeping new Sanctions Authority amid cyber attacks.

https://home.treasury.gov/news/press-releases/jy0127

● Other hacking forums have significant clutter about RaidForum.

■□□□□ 📢 RaidForum's official account claims that fake news is being circulated about its closure.

https://mobile.twitter.com/1dot3dot3dot7/status/1382700999865995271

■■□□□ Unconfirmed: Team Fortress 2 remote code execution exploit triggered by joining a community server.

■■■□□ Over $760 million worth of Bitcoin that were stolen from cryptocurrency exchange Bitfinex in 2016 were moved to new accounts.

https://securityaffairs.co/wordpress/116858/digital-id/bitfinex-funds-moved.html

■■□□□ Google Brings 37 Security Fixes to Chrome 90.

■■■□□ Defeat-Defender - Powerful Batch Script To Dismantle Complete Windows Defender Protection And Even Bypass Tamper Protection.

https://github.com/swagkarna/Defeat-Defender

■■■■□ Severe Bugs Reported in EtherNet/IP Stack for Industrial Systems.

https://thehackernews.com/2021/04/severe-bugs-reported-in-ethernetip.html

■■□□□ Uptycs’ threat research team recently detected several variants of the Linux-based botnet malware family, “Gafgyt,”some of them re-used Mirai code.

https://securityaffairs.co/wordpress/116882/cyber-crime/gafgyt-re-uses-mirai-code.html

■■□□□ Iraq 🇮🇶: Intelligence services downplay the Data-Leak incident that leaked many internal documents, most of which were sensitive.

The original post by ckure at https://t.me/cKure/7604 was confirmed after we assessed the sample data and images.
https://www.shorouknews.com/mobile/news/view.aspx?cdate=12042021&id=e2208673-0a4d-4f40-94f2-31276cd341e9

■□□□□ #Exclusive | Data-Leak: Asus Middle East leaks 14K records due to Broken Authentication.

Note: This data has not been leaked and is under responsible disclosure for Asus to fix.

The data includes:
Email, Bill, Serial No. of device.

The bill has variety of informatiom like transaction IDs card details and other details what a normal bill from electronic store has.

Credits: M Shahnawaz.
https://mobile.twitter.com/Aamer_Sha/status/1383117859459629057

■□□□□ Facebook Faces Mass Legal Action Over Data Leak.

https://packetstormsecurity.com/news/view/32204/Facebook-Faces-Mass-Legal-Action-Over-Data-Leak.html

■■■□□ Cockpit CMS flaws exposed web servers to NoSQL injection exploits.

https://portswigger.net/daily-swig/cockpit-cms-flaws-exposed-web-servers-to-nosql-injection-exploits

■■□□□ GetSimple CMS My SMTP Contact Plugin 1.1.1 - CSRF to RCE.

https://www.exploit-db.com/exploits/49774

■□□□□ Indonesia 🇮🇩: Hackers arrested over $60 million US Covid-19 scam.

https://www.msn.com/en-xl/news/world/indonesian-hackers-arrested-over--million-us-covid-scam/ar-BB1fIjeS