■□□□□ Cracked version of Nipper software is leaked online.

■■■■□ #Exclusive | Zero-Day: Privilege Escalation in Nvidia Control Panel.

As per the researcher, the vulnerability was identified using alert 📢 mechanism based on an earlier UAC bypass (CVE-2019-1388).

https://twitter.com/_M_Shahnawaz/status/1383686714087010311

■■□□□ Privacy violation by app | Interesting thread: https://mobile.twitter.com/0dayCTF/status/1383494676141903877

■■■■■ The Code Testing Company CodeCov Suffers a Data Breach Which Went Undetected for Months.

U.S. federal authorities are investigating a safety violation at Codecov, which works on selling a tool that allows developers to calculate their codebase coverage and works for more than 29,000 clients worldwide. The organization acknowledged the violation and reported that for months it remained unnoticed.

https://www.ehackingnews.com/2021/04/the-code-testing-company-codecov.html

■□□□□ Data-Leak | Russia 🇷🇺 : Database containing e-mail addresses of Navalny's supporters leaked onto the Internet.

https://www.ehackingnews.com/2021/04/database-containing-e-mail-addresses-of.html

■■□□□ Sish - HTTP(S)/WS(S)/TCP Tunnels To Localhost Using Only SSH.

https://github.com/antoniomika/sish

■□□□□ India 🇮🇳: CERT-IN Issues "High" Severity Rating Advisory for WhatsApp Threats.

■■■■□ HttpDoom - A Tool For Response-Based Inspection Of Websites Across A Large Amount Of Hosts For Quickly Gaining An Overview Of HTTP-based Attack Surface.

https://github.com/filipi86/httpdoom

■■■■■ (POC) Remove any Facebook’s live video ($14,000 bounty) | by Ahmad Talahmeh | Apr, 2021.

https://infosecwriteups.com/poc-remove-any-facebooks-live-video-14-000-bounty-70c8135b7b4c

■□□□□ Pakistan 🇵🇰 shut down several social networks within its borders last Friday but lifted the ban after around four hours.

https://mobile.twitter.com/PTAofficialpk/status/1382963881979482112

https://www.theregister.com/2021/04/19/pakistan_brief_social_media_ban/

■■□□□ Interesting thread: https://mobile.twitter.com/sec_r0/status/1381645790263697411

■■□□□ Command to extract all endpoints from a JS File.

cat files.txt | grep -aoP "(?<=(\"|\'|`))\/[a-zA-Z0-9?&=\/-#.](?=(\"|\'|`))" | sort -u | tee output.txt

■□□□□ Almost all XSS Payloads / brute-force list for quick results.

https://github.com/irfan-knr/KNR-XSS-Payloads

■□□□□ Interesting Thread: https://mobile.twitter.com/Aamer_Sha/status/1384077678941073408

■■■■□ Spraygen - Password List Generator For Password Spraying.

https://github.com/3ndG4me/spraygen

■□□□□ Malware Spreads Via Xcode Projects Now Targeting Apple's M1-based Macs.

https://thehackernews.com/2021/04/malware-spreads-via-xcode-projects-now.html

■■■□□ Grype – Vulnerability Scanner For Container Images & Filesystems.

https://github.com/anchore/grype

■□□□□ Google Trumpets New Mobile App Security Standard.

https://www.infosecurity-magazine.com:443/news/google-trumpets-new-mobile-app/

■■□□□ Vulnerability Spotlight: Remote code execution vulnerabilities in Cosori smart air fryer.

https://blog.talosintelligence.com/2021/04/vuln-spotlight-co.html