Beers with Talos Ep. #51: Sea Turtles yeeting packets

Beers with Talos BWT Podcast Ep. No. 51 is now available. Download this episode and subscribe to Beers with Talos: If iTunes and Google Play aren't your thing, click here. Recorded April 12, 2019 — Today, we rip through a few other things to spend most of our time discussing Sea Turtle, the lates...

Cyberspies Hijacked the Internet Domains of Entire Countries

A mysterious new group called Sea Turtle targeted 40 organizations in a DNS hijacking spree...

CVE-2019-8418

SeaCMS 7.2 mishandles member.php?mod=repsw4 requests...

sea-m.banggood.com XSS vulnerability

Open Bug Bounty ID: OBB-702662 Description| Value ---|--- Affected Website:| sea-m.banggood.com Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| hidden until disclosure Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| hidd...

SeaCMS SQL Injection Vulnerability (CNVD-2019-08331)

SeaCMS Ocean CMS is a professional open source free PHP film and television system. SeaCMS 6.6.4 suffers from a SQL injection vulnerability, which can be exploited by attackers via the adminmakehtml.php topic parameter...

archive.northsearegion.eu XSS vulnerability

Open Bug Bounty ID: OBB-684102 Description| Value ---|--- Affected Website:| archive.northsearegion.eu Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| hidden until disclosure Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score...

SeaCMS SQL Injection Vulnerability (CNVD-2018-19865)

SeaCMS is a free and open source web content management system written in PHP. The system has been designed primarily to manage video-on-demand resources. A SQL injection vulnerability exists in the 'order' parameter in SeaCMS version 6.64, which can be exploited by remote attackers to execute SQ...

CVE-2018-16348

SeaCMS V6.61 has XSS via the adminvideo.php vcontent parameter, related to the site name...

Friday Squid Blogging: New Tool for Grabbing Squid and other Fragile Sea Creatures

Interesting video of a robot grabber that's delicate enough to capture squid and even jellyfish in the ocean. As usual, you can also use this squid post to talk about the security stories in the news that I haven't covered. Read my blog posting guidelines here...

CVE-2018-14517

SeaCMS 6.61 has two XSS issues in the adminconfig.php file via certain form fields...

CVE-2018-13445

An issue was discovered in SeaCMS 6.61. There is a CSRF vulnerability that can add a user account via adm1n/adminmanager.php?action=add...

Sea Lotus APT groups use CVE-2017-8570 vulnerability of the new sample and Association analysis-vulnerability warning-the black bar safety net

Sea Lotus（OceanLotus）APT gang is a highly organized, professional foreign national hacker group, the oldest by 360 days eye Labs discovered and disclosed. The organization since at least 2012 and 4 January will be for the Chinese government, research institutes, Maritime institutions, Maritime...

Friday Squid Blogging: Squid Prices Rise as Catch Decreases

In Japan: Last year's haul sank 15% to 53,000 tons, according to the JF Zengyoren national federation of fishing cooperatives. The squid catch has fallen by half in just two years. The previous low was plumbed in 2016. Lighter catches have been blamed on changing sea temperatures, which impedes t...

Friday Squid Blogging: Market Squid in Alaskan Waters

Rising sea temperatures is causing market squid to move north into Alaskan waters. As usual, you can also use this squid post to talk about the security stories in the news that I haven't covered. Read my blog posting guidelines here...

metronome.ge XSS vulnerability

Open Bug Bounty ID: OBB-593634 Description| Value ---|--- Affected Website:| metronome.ge Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

Suspected Chinese Cyber Espionage Group (TEMP.Periscope) Targeting U.S. Engineering and Maritime Industries

Intrusions Focus on the Engineering and Maritime Sector Since early 2018, FireEye including our FireEye as a Service FaaS, Mandiant Consulting, and iSIGHT Intelligence teams has been tracking an ongoing wave of intrusions targeting engineering and maritime entities, especially those connected to...

nas-sites.org XSS vulnerability

Open Bug Bounty ID: OBB-577279 Description| Value ---|--- Affected Website:| nas-sites.org Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

Cobham Sea Tel Information Disclosure Vulnerability (CNVD-2018-03967)

Cobham Sea Tel is a suite of wireless communication terminals from Cobham UK. An information disclosure vulnerability exists in Cobham Sea Tel version 121 build 222701. A remote attacker can exploit this vulnerability by sending a /cgi-bin/getSysStatus request to obtain sensitive information...

Cross site request forgery (csrf)

Cobham Sea Tel 121 build 222701 devices allow remote attackers to obtain potentially sensitive information via a /cgi-bin/getSysStatus request, as demonstrated by the Latitude/Longitude of the ship, or satellite details...

CVE-2018-5728

Cobham Sea Tel 121 build 222701 devices allow remote attackers to obtain potentially sensitive information via a /cgi-bin/getSysStatus request, as demonstrated by the Latitude/Longitude of the ship, or satellite details...