APT Group Uses Catfish Technique To Ensnare Victims

LAS VEGAS–Meet Mia Ash, a 20-something London-based photographer, amateur model, social media butterfly with a keen interest in tech-savvy guys with ties to the oil and gas industry. You guessed it. Mia Ash doesn’t exist. Ash, according to Dell SecureWorks Counter Threat Unit, is a virtual person...

nationaloil.co.ke XSS vulnerability

Open Bug Bounty ID: OBB-214439 Description| Value ---|--- Affected Website:| nationaloil.co.ke Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

premier-oil.com XSS vulnerability

Vulnerable URL: http://www.premier-oil.com/premieroil/search?searchquery=%3Cscript+src%3Dhttps%3A%2F%2Fopenbugbounty.org%2F1.js%3E&go.x;=0&go.y;=0 Details: Description| Value ---|--- Patched:| Yes, at 27.07.2017 Latest check for patch:| 27.07.2017 09:56 GMT Vulnerability type:| XSS Vulnerability...

ArtRage Oil Painter Free - Exported components, External URLs, Native code usage vulnerabilities

HackApp vulnerability scanner discovered that application ArtRage Oil Painter Free published at the 'play' market has multiple vulnerabilities...

Off Road Oil Truck Transporter - Customized SSL, Dangerous filesystem permissions, WebView SSL handling enabled vulnerabilities

HackApp vulnerability scanner discovered that application Off Road Oil Truck Transporter published at the 'play' market has multiple vulnerabilities...

Five-Year 'Dust Storm' APT Campaign Seen Targeting Japanese Critical Infrastructure

A five-year campaign primarily focused on extracting sensitive information from Japanese oil, gas, and electric utilities was outlined by researchers on Tuesday. Referred to as Operation Dust Storm .PDF by researchers at Cylance, the campaign has managed to stay persistent over the years, and...

用友某系统通用漏洞涉及多家银行、证券、能源行业、企业

简要描述： 用友某系统通用漏洞可以读取配置文件 详细说明： 用友某系统通用漏洞涉及多家银行、证券、能源行业、企业 测试了部分网站，还有大量的网站存在此漏洞 http://zhaopin.cnooc.com.cn/hrss/dorado/smartweb2.RPC.d?rpc=true http://nc.hbny.com.cn:9090/hrss/dorado/smartweb2.RPC.d?rpc=true http://59.173.0.46:8070/hrss/dorado/smartweb2.RPC.d?rpc=true...

Hackers Can Abuse SAP Apps Connected to SCADA

Much in the same way the Target hackers used a HVAC management system to catapult onto the corporate network, attackers focused on oil and gas and other critical industries may be finding similar openings via enterprise applications such as SAP. Researchers from ERPScan, during last week’s Black...

premier-oil.com XSS vulnerability

Vulnerable URL: http://www.premier-oil.com/premieroil/search?searchquery=%3C%2Fscript%3E%3Cscript%3Ealert%28%27XSSPOSED%27%29%3C%2Fscript%3E&go.x;=16&go.y;=13 Details: Description| Value ---|--- Patched:| Yes, at 25.07.2017 Latest check for patch:| 25.07.2017 21:13 GMT Vulnerability type:| XSS...

Emerson Patches Series of Flaws in Controllers Used in Oil and Gas Pipelines

Researchers have identified a wide range of vulnerabilities in remote terminal units manufactured by Emerson Process Management that are widely used in oil and gas pipelines and other applications. The vulnerabilities include a number of hidden functions in the RTUs, an authentication bypass and...

U-Mail Mail Service system arbitrary file upload+execution vulnerabilities runtime defects and authentication bypass）-bug warning-the black bar safety net

Brief description: PRODUCT DESCRIPTIONtaken from website U-Mail focus on email field 1 to 5 years, for enterprises to easily build the most secure and stable e-mail system software. Keywords: 1 5 years the safest most stable 1 5 year the safest and most stable , woxaole,so wonderful code, so...

Targeted String of Paerls Campaign Includes Word Macro Attack

A targeted malware campaign has been uncovered that combines an old-school Microsoft Word Macro malware attack with a decidedly new school approach of redirecting victims to exploits stored on Dropbox. The String of Paerls attacks, which Cisco’s VRT team reported today, targets industries such as...

New Oil and Natural Gas ONG-ISAC Launches

Energy utilities certainly have not been spared by hackers who for years have targeted vulnerabilities in process control systems and networks with alarming success. In a move to close the gap and keep that corner of the U.S.’ critical infrastructure secure, a new information sharing group popped...

[Onapsis Security Advisories] Multiple Hard-coded Usernames in SAP Components

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Onapsis Security Advisories:Multiple Hard-coded Usernames CWE-798 have been found and patched in a variety of SAP components. Summaries of the advisories with links to full versions follow: 1. ONAPSIS-2014-011-SAP Project System Structures and...

CVE-2014-4006

The SAP Trader's and Scheduler's Workbench TSW for SAP Oil & Gas has hardcoded credentials, which makes it easier for remote attackers to obtain access via unspecified vectors...

Icefog Cyberespionage Campaign Hit 3 US Oil, Gas Companies

When the curtain was peeled back on the Icefog targeted espionage campaign in September, a new type of operator was unveiled, one that took the persistence out of advanced persistent threats APT. Researchers at Kaspersky Lab noted in uncovering Icefog that the attacks against the defense supply...

Siemens WinCC 7.0 SP3 Multiple Vulnerabilities

Overview This advisory provides mitigation details for vulnerabilities that impact the Siemens SIMATIC WinCC. Positive Technologies and Siemens ProductCERT have identified multiple vulnerabilities in the Siemens SIMATIC WinCC, which is used to configure SIMATIC operator devices. Siemens has...

CVE-2013-5402

Cross-site scripting XSS vulnerability in IBM Maximo Asset Management, Maximo Asset Management Essentials, Maximo for Government, Maximo for Nuclear Power, Maximo for Transportation, Maximo for Life Sciences, Maximo for Oil and Gas, and Maximo for Utilities 7.1.x through 7.1.1.12, 7.1.2, 7.5 befo...

ProSoft Technology RadioLinx ControlScape PRNG vulnerability

Industrial automation software used worldwide to create and configure wireless radios that connect devices in environments such as oil and gas is vulnerable to attack by a hacker armed with an antenna from as far as 30 miles away. Though the vulnerability in the ProSoft Technology RadioLinx...

Oil, Energy Watering Hole Attacks Linked to DOL attack

A string of watering hole attacks targeting oil and energy companies dating back to May could be linked to similar attacks against the U.S. Department of Labor website. Researchers at Cisco discovered the compromised domains of 10 oil and energy companies worldwide, including hydroelectric plants...