Schneider Electric EcoStruxure

1. EXECUTIVE SUMMARY CVSS v3 7.4 ATTENTION: Exploitable remotely/low skill level to exploit Vendor: Schneider Electric Equipment: EcoStruxure Vulnerability: Open Redirect 2. RISK EVALUATION Successful exploitation of this vulnerability could allow an attacker to use this device as a platform to...

Chinese Malicious Cyber Activity

The Department of Homeland Security DHS Cybersecurity and Infrastructure Security Agency CISA released information on Chinese government malicious cyber activity targeting global information technology IT service providers—such as managed service providers and cloud service providers—and their...

Teaching Cybersecurity Policy

Peter Swire proposes a a pedagogic framework for teaching cybersecurity policy. Specifically, he makes real the old joke about adding levels to the OSI networking stack: an organizational layer, a government layer, and an international layer...

gov.kg Improper Access Control vulnerability

Open Bug Bounty ID: OBB-712297 Description| Value ---|--- Affected Website:| gov.kg Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| hidden until disclosure Vulnerability Type:| IAC Improper Access Control / CWE-284 CVSSv3 Score:| hidden until...

Hackers bypassed Gmail & Yahoo’s 2FA to target US officials

By Waqas The attack was carried out by Iran-backed charming kitten hackers and victims include dozens of US government officials. Private emails of US sanctions officials and nuclear scientists have been breached by Iranian state-sponsored hackers. As per the data obtained by Certfa, a...

Real-Time Attacks Against Two-Factor Authentication

Attackers are targeting two-factor authentication systems: Attackers working on behalf of the Iranian government collected detailed information on targets and used that knowledge to write spear-phishing emails that were tailored to the targets' level of operational security, researchers with...

Shamoon Returns to Wipe Systems in Middle East, Europe

ARCHIVED STORY Shamoon Returns to Wipe Systems in Middle East, Europe By Alexandre Mundo · December 14, 2018 Destructive malware has been employed by adversaries for years. Usually such attacks are carefully targeted and can be motivated by ideology, politics, or even financial aims. Destructive...

Secure Critical Infrastructure Top of Mind for U.S.

When it comes to cyber-threats and defense, the U.S. government says that critical infrastructure threats are a growing concern. Rob Joyce, senior advisor of cybersecurity strategy for the National Security Agency NSA, said that while attacks targeting the systems that power the manufacturing,...

New Australian Backdoor Law

Last week, Australia passed a law giving the government the ability to demand backdoors in computers and communications systems. Details are still to be defined, but it's really bad. Note: Many people e-mailed me to ask why I haven't blogged this yet. One, I was busy with other things. And two,...

SQL Injection Vulnerability in Fully Graphical Application Development Environment V2010

The full graphical application system development environment is developed by Jiangsu Lianbang Information Technology Co., Ltd. and is mainly used in the government, education industry, medical industry website. A SQL injection vulnerability exists in Full Graphical Application Development...

S-CMS government website builder system SQL injection vulnerability in front-end go***/fo***.php page

S-CMS government station building system is Zibo Shining Network Technology Co., Ltd. developed a specialized enterprise to provide solutions for station building products. There is a SQL injection vulnerability in the front-end go/fo.php page of S-CMS government website builder system. Attackers...

Australia Anti-Encryption Law Triggers Sweeping Backlash

A controversial Australian bill, which could give the government access to data protected by end-to-end encryption, was passed Thursday. The bill, called the Assistance and Access Act, empowers Australian police to essentially force companies that are operating in the country to help the governme...

dsi.gov.mo XSS vulnerability

Open Bug Bounty ID: OBB-708634 Description| Value ---|--- Affected Website:| dsi.gov.mo Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| hidden until disclosure Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| hidden until...

Microsoft Calls For Facial Recognition Tech Regulation

As facial recognition continues to gain traction in public use cases, Microsoft on Thursday called for regulation of the technology, citing heightened concerns around privacy and consent. Over the past year, facial recognition technology has started to pop up in various government-related...

KC GRUP Web Design 1.0 SQL Injection

Exploit Title : KC GRUP Web Design 1.0 SQL Injection Author Discovered By : KingSkrupellos from Cyberizm Digital Security Army Date : 03/12/2018 Vendor Homepage : kcgrup.com kcgrupsms.com Software Download Link : N/A Tested On : Windows and Linux Category : WebApps Version Information : 1.0 Explo...

Lawsuit Claims Pegasus Spyware Helped Saudis Spy on Khashoggi

A well-known Saudi dissident previously targeted by the notorious Pegasus spyware has filed a lawsuit against that spyware’s authors, Israel-based NSO Group. The suit claims that Pegasus was instrumental in the Saudi government’s surveillance of Washington Post journalist Jamal Khashoggi leading ...

The United States Postal Service, the Amazon company due to API defects lead to a large number of customer data exposure-vulnerability warning-the black bar safety net

The United States is an annual holiday shopping carnival on Friday officially kicked off, and at the same time, the United States Postal Service and Amazon but there were two security incidents, both with the API using the improper about this event affected millions of people, at the same time...

The US Leans on Private Firms to Expose Foreign Hackers

Opinion: The government needs to step up in calling out cyber-attackers. Otherwise, we risk playing into their hands...

The Effect of NIST 800-171A on Government Contractors

NIST 800-171A introduces a standardized opportunity to perform a more structured and granular level of assessment leveraging the National Institute of Standards and Technology NIST Special Publication SP 800-171 framework...

How Surveillance Inhibits Freedom of Expression

In my book Data and Goliath, I write about the value of privacy. I talk about how it is essential for political liberty and justice, and for commercial fairness and equality. I talk about how it increases personal freedom and individual autonomy, and how the lack of it makes us all less secure. B...