SQL Injection Vulnerability in Public Consultation Module of SMiCMS Government Website System

SMi CMS Government Website System is a website system for governments, schools and groups. A SQL injection vulnerability exists in the Public Consultation module of SMiCMS Government website system, which can be exploited to execute arbitrary SQL commands and obtain sensitive database information...

Phoenix Broadband Technologies LLC PowerAgent SC3 Site Controller

CVSS v3 5.3 ATTENTION: Remotely exploitable/low skill level to exploit. Vendor: Phoenix Broadband Technologies LLC Equipment: PowerAgent SC3 Site Controller Vulnerability: Use of Hard-Coded Password AFFECTED PRODUCTS Phoenix Broadband Technologies LLC reports that the following versions of...

ShadowBrokers Put Price on Monthly Zero Day Leaks

The threat posed by the first wave of ShadowBrokers leaks of Equation Group hacking tools was relatively benign. Some vendors had to scramble to patch zero days in older versions of products, but for the most part, the leaks and accompanying auction were more of a novelty. That obviously changed...

Who Are the Shadow Brokers?

In 2013, a mysterious group of hackers that calls itself the Shadow Brokers stole a few disks full of NSA secrets. Since last summer, they've been dumping these secrets on the Internet. They have publicly embarrassed the NSA and damaged its intelligence-gathering capabilities, while at the same...

Shadow Brokers Launches 0-Day Exploit Subscriptions for $21,000 Per Month

As promised to release more zero-days exploits and hacking tools for various platforms starting from June 2017, the infamous hacking group Shadow Brokers is back with more information on how to subscribe and become a private member for receiving exclusive access to the future leaks. The Shadow...

Microsoft Unveils Special Version of Windows 10 For Chinese Government

China is very strict about censorship, which is why the country has become very paranoid when it comes to adopting foreign technologies. The country banned Microsoft's Windows operating system on government computers in 2014 amid concerns about security and US surveillance. Even in the wake of...

SQL injection vulnerability in the cell_phone parameter of SMiCMS government website system

SMi CMS Government Website System is a website system for governments, schools and groups. There is a SQL injection vulnerability in the cellphone parameter of SMiCMS government website system, because the parameters of the registration page are not sufficiently filtered, an attacker can exploit...

SQL Injection Vulnerability in the Keyword Parameter of Keyword Module of SMiCMS Government Website System

SMi CMS Government Website System is a website system for governments, schools and groups. A SQL injection vulnerability exists in the keyword parameter of the opinion solicitation module of the SMiCMS government website system. Due to insufficient filtering of the parameter, an attacker can...

Private Eye Allegedly Used Leaky Goverment Tool in Bid to Find Tax Data on Trump

In March 2017, KrebsOnSecurity warned that thieves who perpetrate tax refund fraud with the U.S. Internal Revenue Service were leveraging a widely-used online student loan tool to find critical data on consumers that allows them to claim huge refunds with the IRS in someone else's name. This week...

tradexchange.gov.sg XSS vulnerability

Vulnerable URL: https://www.tradexchange.gov.sg/tradexchange/portlets/search/searchHSCA/searchHSCA.do?hsCode=3402==%22%3E%3Cscript%3E%20alert%27XSSPOSED%27%20%3C/script%3E===hscaPage=false=41 Details: Description| Value ---|--- Patched:| Yes, at Vulnerability type:| XSS Vulnerability status:|...

Senate's Use of Signal A Good First Step, Experts Say

On Tuesday the United States Senate made it official and approved the use of encrypted messaging app Signal by staffers. Encryption advocates applauded the measure, but say more needs to be done to protect “civic” infrastructure critical to democracy. “The move to secure communications...

The US Senate Is Using Signal

The US Senate just approved Signal for staff use. Signal is a secure messaging app with no backdoor, and no large corporate owner who can be pressured to install a backdoor. Susan Landau comments. Maybe I'm being optimistic, but I think we just won the Crypto War. A very important part of the US...

kansastag.gov XSS vulnerability

Vulnerable URL: http://www.kansastag.gov/searchresults.asp Details: Description| Value ---|--- Patched:| No Latest check for patch:| 31.07.2017 Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa Rank| 1276579 VIP website status:| No Check kansastag.gov SSL connection:| Grade...

ShadowBrokers Planning Monthly Exploit, Data Dump Service

Popcorn in hand, the ShadowBrokers say they’re taking in the WannaCry outbreak from the sidelines before starting in June a subscription service for new exploits and stolen data akin to a wine of the month club. In what’s become a signature periodic rant from the unknowns behind the leak of...

The Quick vs. the Strong: Commentary on Cory Doctorow's Walkaway

Technological advances change the world. That's partly because of what they are, but even more because of the social changes they enable. New technologies upend power balances. They give groups new capabilities, increased effectiveness, and new defenses. The Internet decades have been a...

Matthew Hickey on WannaCry Ransomware Outbreak

Matthew Hickey, founder of HackerHouse and @hackerfantastic on Twitter, talks to Mike Mimoso about Friday’s WannaCry ransomware outbreak, what the upcoming week bodes for businesses and the dangers of governments weaponizing attacks without sharing vulnerability information. Download:...

SQL Injection Vulnerability in 'menu_id' Parameter of Pioneer Hi-Tech Government System

Pioneer Hi-Tech Government System is an "easy technology" system. A SQL injection vulnerability exists in the 'menuid' parameter of the Pilot Hi-Tech Government System. This vulnerability can be exploited by attackers to obtain sensitive information from the database...

Indian Biometric System Data leaked; over 130 M people could be affected

By Jahanzaib Hassan The personal identifiable information of people in the wrong hands could cause a major havoc, and this could happen pretty soon in India. According to the reports, the government sites supposed to protect the user data are instead, leaking it! Names, addresses, date of birth,...

Dridex and Locky Return Via PDF Attachments in Latest Campaigns

Dridex and Locky, two prolific malware families that made waves in 2016 after being distributed in several high-volume spam campaigns, have returned after a brief hiatus. FireEye observed a decline in the volume of Dridex and Locky in the latter half of 2016, but we recently observed two new larg...

Dridex and Locky Return Via PDF Attachments in Latest Campaigns

Dridex and Locky, two prolific malware families that made waves in 2016 after being distributed in several high-volume spam campaigns, have returned after a brief hiatus. FireEye observed a decline in the volume of Dridex and Locky in the latter half of 2016, but we recently observed two new larg...