Facebook's Vice President Arrested in Brazil for Refusing to Share WhatsApp Data

Apple is not the only technology giant battling against authorities over a court order; Facebook is also facing the same. Brazil’s federal police arrested Facebook Latin America Vice President for failing to comply with court orders to help investigators in a drug trafficking case that involves...

Shopify: Injection via CSV Export feature in Admin Orders

i found out that the filtering of "=,-,+" is not working in all data. there's a way to bypass it. 1. Create a product with title =cmd|' /C calc'!'D2' 2. Add variants more than 2 variants then save it. 3. Go to Orders Create Order 4. search the product we made =cmd|' /C calc'!'D2' 5. Add 2 variant...

Shopify: XSS in Draft Orders in Timeline i SHOPIFY Admin Site!

Create an Draft with a product named "img src=x onerror=prompt'XSSP' 2. Send the Draft to someone and complete the order. Order is shown as Completed Drafts as order.png 3. Create a timeline and reference this Draft. As soon as you click POST you will be XSSEd xss.png Thanks...

Shopify: Stored XSS in /admin/orders

Hi , I have found a Stored XSS vulnerability in orders page. Steps to reproduce: 1. Create a new order with an item that requires shipping 2. Go to https://.myshopify.com/admin/orders/ 3. Click the Fulfill items button then fulfill the items 4. Now a new fulfillment with an id will be generated ,...

FBI Director Asks Tech Companies to At least Don't Offer End-to-End Encryption

FBI declared War against Encryption. Encryption is defeating government intelligence agencies to detect terrorist activities and after the recent ISIS-linked terror attacks in Paris and California, the issue has once again become a political target in Washington. ...and meanwhile, Kazakhstan plan...

spunlite.co.nz XSS vulnerability

Vulnerable URL: http://www.spunlite.co.nz/forms/orders.php?productname=%22%3E%3Csvg/onload=prompt%28/XSSPOSED/%29%3E Details: Description| Value ---|--- Patched:| No Latest check for patch:| 26.07.2017 Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa Rank| Unknown / Not...

xpshop网店系统sql注入两处（一处盲注）

简要描述： 详细说明： 漏洞位置：...order protected void PageLoadobject sender, EventArgs e if base.CurrentUser != null && base.CurrentUser.Name != "anonymous" this.member = base.CurrentUser; this.shipfree = new ShippingFreeDB.GetShippingFreeDetails1; if !base.IsPostBack if base.Request.QueryString"type" != null...

CloudFlare Transparency Report Shows Spike in Court Orders

In its latest transparency report, CloudFlare says that the number of subpoenas it has received has remained steady since last year, but the volume of court orders has more than doubled since the second half of last year. While much of the data from CloudFlare’s report for the first half of 2015...

FBI Director to Silicon Valley: 'Try Harder' to Find 'Going Dark' Solution

The United States government has eased off off its demands for “exceptional access” to encrypted communication, and instead volleyed the problem back to technology companies and asked them to try harder to come up with a solution. The government’s concern is that recent enhancements to encryption...

一采通电子采购系统多处SQL注入漏洞

简要描述： 一采通电子采购系统多处SQL注入漏洞 详细说明： google:inurl:companycglist.aspx?ComId= 1 漏洞存在于 /Orders/k3orderdetail.aspx，参数FINTERID 例如 http://eps.umgg.com.cn/Orders/k3orderdetail.aspx?FINTERID=1 2 漏洞存在于 /organization/GetUserList2.aspx，参数UserName 例如...

Shopify: Privilege Escalation - A `MEMBER` with no ACCESS to `ORDERS` can still access the orders by using `Order Printer APP`

This researcher pointed out that Shopify's app ecosystem has no built-in way of verifying who is using an app, and therefore most apps do not verify user privileges when requesting and displaying a store's data. To resolve this issue we implemented an "online access" mode in which an app can...

用友系统任意下载订单漏洞

简要描述： 用友系统任意下载订单漏洞 详细说明： http://uporder.yonyou.com/file/ 漏洞证明：...

Confusion Reigns Over FBI's Plans for National Security Letter Gag Orders

The way that National Security Letters are approved and used is one of the government’s more opaque processes. Now, you can add some more confusion into the mix, courtesy of some new comments from the FBI about when recipients are able to disclose the fact that they have received an NSL. More tha...

Canary Watch Site Launches to Track Warrant Canaries

In the years since Edward Snowden began putting much of the NSA‘s business in the street, including its reliance on the secret FISA court and National security Letters, warrant canaries have emerged as a key method for ISPs, telecoms and other technology providers to let the public know whether...

Government Demands for Verizon Customer Data Drop

The number of subpoenas, total orders and warrants that the United States government delivered to Verizon all dropped in the second half of 2014, according to the company’s latest transparency report. The giant telecom provider released data on Thursday that showed a decrease in subpoenas of abou...

Phone to grab votes APP“train up”to the presence of high-risk vulnerabilities in the user's personal information and other data leaks-bug warning-the black bar safety net

Data 3 6 0 patch-day vulnerability response platform shows that the domestic popular mobile phone to grab votes APP“train up”to the presence of high-risk vulnerabilities, including millions of tickets, ticket orders user ID number, username, plaintext password, detailed ticket information and oth...

phpyun v3.2 (20141222) 三处注入

简要描述： 20141222 详细说明： 第一处在 api/alipay/alipayto.php 现在的少了以前的验证。 errorreporting0; requireonce"alipayconfig.php"; requireonce"class/alipayservice.php"; requireoncedirnamedirnamedirnameFILE."/data/db.config.php"; requireoncedirnamedirnamedirnameFILE."/plus/config.php";...

cmseasy设计逻辑缺陷可以不花钱买东西

简要描述： cmseasy设计逻辑缺陷可以不花钱买东西 详细说明： archiveact.php: function ordersaction $this-view-aid = trimfront::get'aid'; if front::post'submit' $this-orders = new orders; $row = $this-orders-getrow"","adddate DESC"; //vardumptime; if$row'adddate' && time - $row'adddate' view-user'userid' ?...

Government Requests for Facebook User Data Increasing

Facebook’s latest transparency report shows that U.S law enforcement agencies issued a greater number of total requests for user data related to criminal investigations in the first six months of 2014 than they have over any previous such period. This report, per Justice Department reporting...

AOL Releases Transparency Report Lobbies for USA FREEDOM Act

Noting that Saturday was the 13th anniversary of the passage of the USA PATRIOT Act, the Web giant AOL this week released its latest transparency report, detailing estimations of how many Foreign Intelligence Surveillance Act FISA orders and National Security Letters NSLs it’s received in the las...