CVE-2019-1010136

ChinaMobile GPN2.4P21-C-CN W2001EN-00 is affected by: Incorrect Access Control - Unauthenticated Remote Reboot. The impact is: PLC Wireless Router's are vulnerable to an unauthenticated remote reboot due. The component is: Reboot settings are available to unauthenticated users instead of only...

Ke3chang APT Linked to Previously Undocumented Backdoor

The Ke3chang cyberespionage group, a.k.a. APT15, Mirage, Playful Dragon or Vixen Panda, has been tied to a backdoor called Okrum that has been used to target diplomatic missions throughout Europe and Latin America. The attribution widens the scope of known Ke3chang activity, an APT believed to be...

xss vulnerability in shuipfcms

ShuipFCMS is a content management system based on ThinkPHP framework as the core, using the independent grouping approach to development. Shuipfcms has an xss vulnerability. Attackers can use this vulnerability to obtain administrator cookies...

Cellular networks under fire from Soft Cell attacks

We place a lot of trust in our mobile experience, given they’re one of the most constant companions we have. Huge reams of data, tied to a device we always carry with us, with said device frequently offering additional built-in app functionality. An astonishing wealth of information, for anyone...

Agent Smith Malware Infects 25M Android Phones to Push Rogue Ads

Researchers are warning of a new breed of Android malware, dubbed “Agent Smith,” that they claim has infected 25 million handsets in order to replace legitimate apps with doppelgangers that display rogue ads. The malware is tied to a China-based firm, according to Check Point researchers, and is...

F5 BIG-IP PEM Input Validation Error Vulnerability

F5 BIG-IP PEM is a policy enforcer used in BIG-IP from F5 USA. An input validation error vulnerability exists in F5 BIG-IP PEM, which can be exploited by an attacker to cause traffic processing interruptions...

Code Execution Vulnerability in SDCMS V1.8

SDCMS is a PHP and MySQL based enterprise station building content management system CMS from China Fireworks Network Technology Company. A code execution vulnerability exists in SDCMS V1.8, which can be exploited by an attacker to gain server privileges...

Tenda W20E V15.11.0.6_CN has a command execution vulnerability (CNVD-2019-22869)

Shenzhen Jixiang Tengda Technology Co., Ltd. is one of the first pioneers in the field of wireless network in China. Tenda W20E V15.11.0.6CN suffers from a command execution vulnerability that can be exploited by an attacker to gain server privileges...

China Distributes Spyware at Its Border and Beyond

Plus, Cyber Command warns about Outlook bugs, Virginia criminalizes deepfake porn, and more top security news from this week...

PHPwind v9.1.0 - Multiple Cross Site Scripting Vulnerabilities

Document Title: =============== PHPwind v9.1.0 - Multiple Cross Site Scripting Vulnerabilities References Source: ==================== https://www.vulnerability-lab.com/getcontent.php?id=2184 http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2019-13472 CVE-ID: ======= CVE-2019-13472 Release Dat...

XnView Classic Buffer Overflow Vulnerability (CNVD-2019-22459)

XnView is a multi-platform software that supports image viewing, conversion and editing. A buffer overflow vulnerability exists in XnView Classic. No details of the vulnerability are available at this time...

Logic Flaw Vulnerability in China Merchants Bank App Activity Business

China Merchants Bank APP is the center of gravity for China Merchants Bank to build a digital financial service platform, which is the carrier and platform for China Merchants Bank to connect users. There is a logic flaw vulnerability in the active business of China Merchants Bank APP. An attacke...

Cellular networks worldwide hit by hackers in espionage attempt

By Uzair Amir Cybereason, an Israeli-US security firm based in Boston, has reported that certain nation-state hackers managed to compromise the systems of no less than ten cellular carriers across the globe to steal metadata of specific users. Without naming anyone, the company claims that the...

Logic Flaw Vulnerability in sdcms V1.8

SDCMS is a PHP and MySQL based enterprise station building content management system CMS from China Fireworks Network Technology Company. A logic flaw vulnerability exists in sdcms V1.8, which can be exploited by attackers to obtain sensitive information...

Denial of Service Vulnerability in Schneider Electric M340 PLCs

M340 is a medium-sized PLC from Schneider Electric, which is widely used in the industrial control field in China. A denial of service vulnerability exists in the Schneider Electric M340 PLC. An attacker can cause a web service denial of response by constructing a special message to be sent on po...

Security News This Week: Telegram Says China Is Behind DDoS

Voting machine security gets a boost, Have I Been Pwned is for sale, and more of the week's top security news...

News Wrap: Amazon Privacy and Telegram DDoS Attack

Beyond Patch Tuesday, this week was crammed with privacy and security related news. In this week’s Threatpost podcast, editors Tara Seals and Lindsey O’Donnell discussed the top news from the week. That includes: A federal lawsuit alleging that Amazon is recording children who use its Alexa...

Telegram CEO Fingers China State Actors for DDoS Attack

The chief executive of secure messaging app Telegram is pointing the finger squarely at China as the culprit responsible for the distributed denial of service DDoS attack that it suffered on Wednesday. The company announced the attack on Twitter, warning that users may be experiencing connection...

Telegram Suffers 'Powerful DDoS Attack' From China During Hong Kong Protests

Telegram, one of the most popular encrypted messaging app, briefly went offline yesterday for hundreds of thousands of users worldwide after a powerful distributed denial-of-service DDoS attack hit its servers. Telegram founder Pavel Durov later revealed that the attack was mainly coming from the...

Telegram Suffers 'Powerful DDoS Attack' From China During Hong Kong Protests

Telegram, one of the most popular encrypted messaging app, briefly went offline yesterday for hundreds of thousands of users worldwide after a powerful distributed denial-of-service DDoS attack hit its servers. Telegram founder Pavel Durov later revealed that the attack was mainly coming from the...