某政府在用系统通用型SQL注入#9

简要描述： rt 详细说明： 某政府在用系统通用型SQL注入9。 案例： http://www.lgqzwfw.gov.cn/xspww/InteractiveCommunication/InterActiveIndex.aspx http://60.215.8.148:6006//InteractiveCommunication/InterActiveIndex.aspx http://www.lgqzwfw.gov.cn/xspww/InteractiveCommunication/InterActiveIndex.aspx...

SQL injection vulnerability in txtContent parameter in InteractiveCommunication/InterActiveIndex.aspx of Wave Government Service Platform

Wave software government system is an industry informatization application system built on the basis of cloud computing and big data. There is a SQL injection vulnerability in the txtContent parameter of the InteractiveCommunication/InterActiveIndex.aspx of the Wave government service platform,...

Security Researchers Publish Comments on Wassenaar Rules

With the two-month comment period for the proposed U.S. Wassenaar Arrangement rules barely under way, a cast of influential security researchers has wasted no time preparing and submitting their thoughts on the controversial proposal. Researchers who seek out vulnerabilities in software—developin...

某政府在用系统通用型SQL注入#5

简要描述： rt 详细说明： 某政府在用系统通用型SQL注入5。 山东浪潮齐鲁软件产业股份有限公司 http://www.inspur.com/ 案例如下： http://www.whaac.gov.cn:8080/InteractiveCommunication/ProjectList.aspx?sxname= http://www.rcsp.cn/InteractiveCommunication/ProjectList.aspx?sxname=...

online.moha.gov.my XSS vulnerability

Vulnerable URL: http://online.moha.gov.my/ePermit/index.php?mod=lesen=certviewid=34073id=4554id=28635%27%22%3E%3Csvg/onload=alert%28/XSSPOSED/%29%3E Details: Description| Value ---|--- Patched:| Yes, at 22.11.2017 Latest check for patch:| 22.11.2017 08:54 GMT Vulnerability type:| XSS Vulnerabilit...

某政府在用系统通用型SQL注入#3

简要描述： rt 详细说明： 某政府在用系统通用型SQL注入3。 案例如下: http://wssp.jiangxi.gov.cn:8008/outportal/licenseManage/licenseManage.jsp http://117.40.187.175:8008/outportal/licenseManage/licenseManage.jsp http://xzfw.jinxi.gov.cn/outportal/licenseManage/licenseManage.jsp...

某政府在用系统通用型SQL注入#2

简要描述： rt 详细说明： 某政府在用系统通用型SQL注入2。 山东浪潮齐鲁软件产业股份有限公司 http://www.inspur.com/ 案例： http://117.40.187.175:8008/outportal/bulletin/Businessview.jsp?businessid=8080812a897481012a9761f71e0618 http://218.65.59.94/outportal/bulletin/Businessview.jsp?businessid=018ae42b585524012b5983103e01a5...

UK Government Rewrites Laws to Let GCHQ Hack Into Computers Legally

The UK Government has quietly changed the Anti-Hacking Laws quietly that exempt GCHQ, police, and other electronic intelligence agencies from criminal prosecution for hacking into computers and mobile phones and carrying out its controversial surveillance practices. The details of the changes wer...

The Great... Great... Firewall of China Hijacks Facebook Connect Plugin

From past few days, Internet Users in China are dealing with a weird redirection of traffic nationwide while accessing any website that makes use of connect.facebook.net resource. Great Firewall of China, which is infamous for the Internet censorship by Chinese government, believes to be...

buenosaires.gob.ar XSS vulnerability

Vulnerable URL: http://www.buenosaires.gob.ar/bweb/search?keys=%3Csvg/onload%3Dprompt%28/XSSPOSED/%29%3Etype= Details: Description| Value ---|--- Patched:| Yes, at 03.10.2017 Latest check for patch:| 03.10.2017 14:53 GMT Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa Ran...

Tor-Based Dark Web Email Service Targeted by Government Spies

The administrator of the popular Darknet email service, SIGAINT, is warning its users that the email service has become a target of a suspected law enforcement agency who tried to compromise it. About a week ago, SIGAINT has been targeted by an attacker who tried to hack the service by using near...

Google Provides Detailed Analysis of GitHub Attack Traffic

The high-profile DDoS attack against GitHub that went on for several days last month was the end result of an operation that included several phases and extensive testing and optimization by the attackers. Researchers at Google analyzed the attack traffic over several weeks and found that the...

iniciar.mendoza.gov.ar XSS vulnerability

Open Bug Bounty ID: OBB-59399 Description| Value ---|--- Affected Website:| iniciar.mendoza.gov.ar Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N Remediation Guide:| OWASP XSS Prevention...

U-Mail mail system bulk getshell（truly unlimited, no General account-the vulnerability warning-the black bar safety net

The mail system is there any user login, and the presence of injection, which can be unlimited perfect getshell（getshell process only takes three simple. Mad Dog, this is not struck by lightning while waiting to be burst chrysanthemum. Detailed description: 1. Mail System Description 1 Official...

White House, State Department Counted Among CozyDuke APT Victims

A data-mining advanced persistent threat hit a handful of high profile targets last year, including the White House’s computer network. Dubbed CozyDuke, the APT’s toolset shares several similarities with fellow APTs MiniDuke, CosmicDuke and OnionDuke. Kurt Baumgartner and Costin Raiu, researchers...

RSA Conference Panel on Threat Information Sharing Bill

SAN FRANCISCO – The House of Representatives is considering a pair of information sharing bills this week. Also up for consideration is a data breach notification bill that is not likely to make it into law any time in the near future. According to a panel of experts at the RSA Conference, the...

Crypto 'Front Door' Debate Likely to Go On For Years

SAN FRANCISCO–Encryption is the hot new topic in security at the moment, as it has been any number of times in the last few decades. And, as in the past, the notions of key escrow, mandated legal access to encrypted systems and other ideas for helping governments defeat cryptosystems have followe...

某通用电子政务系统注入

简要描述： 深夜来一发 详细说明： 深圳太极软件有限公司是一套专门的政务服务系统，大量用户在用。这个就不多说了。 注入点： http://www.gzegn.gov.cn:8080/application/gzhd/bgxz/showdepartments.jsp?zzjgdm=009390359&depName=%CA%A1%C3%F1%D5%FE%CC%FC zzjgdm=存在注入，就以贵州省电子政务为例，仅跑出表，其他不做测试。 payload： Place: GET Parameter: zzjgdm Type: boolean-based blind Title: AND...

某政府系统通用SQL盲注#(影响大量政府)

简要描述： RT 详细说明： 官网:http://www.jit.com.cn/ http://218.27.140.5/zwdtSjgl/Directory/lastDirListiframe.jsp?departmentid=402880eb3430f524013430f693450002&departmentname=各部门、各直属机构&departmentType=-1...

大汉政府信息公开多处SQL注入一(附100个案例)

简要描述： 大汉政府信息公开多处SQL注入一附100个案例 详细说明： webservice漏洞，漏洞存在于 /xxgk/services/WSSyncsearchinfo 该WSSyncsearchinfo服务的多个方法，多个参数存在严重漏洞，且该漏洞普遍存在，如 getClientIpAxis wsTest wsSyncGetInfos setBase64 isBase64 setStrAppId 上述方法的多个参数均存在漏洞，这里随便选取一个方法进行测试 首先保存如下内容为wooyun.txt POST /xxgk/services/WSSyncsearchinfo HTTP/1....