modified eCommerce 2.0.0.0 Rev 9678 SQL Injection

Title: Blind Injection modified eCommerce 2.0.0.0 rev 9678 Date: 16.04.2016 Category: webapps Vendor Homepage: http://www.modified-shop.org/download Software Link: http://www.modified-shop.org/forum/index.php?action=downloads;sa=downfile&id=96 Version: 2.0.0.0 rev 9678 Tested on: Apache/2.4.7, PH...

Microsoft Wins Widespread Support in Privacy Clash With Govt.

Microsoft’s lawsuit against the U.S. government for the right to tell its customers when a federal agency is looking at their emails is getting widespread support by privacy advocates. For many, Microsoft’s stance lends an important and powerful voice to ongoing efforts to reform the Electronic...

California Kills Phone Decryption Bill

Civil liberty groups and tech firms are celebrating the defeat of a controversial California bill that would have forced phone makers to decrypt their devices by court order. The proposed legislation, AB 1681, died when lawmakers refused to give the bill a vote. But opponents of the bill, who...

Microsoft Sues US Govt Over Unconstitutional Secret Data Requests

Microsoft is suing the Department of Justice DoJ to protest the gag order that prevents technology companies from telling their customers when their cloud data is handed over to authorities. In layman's terms, the Electronic Communications Privacy Act ECPA allows the government to issue gag order...

Anti-Encryption Bill Released, would Kill your Privacy and Security

The United States anti-encryption bill will kill your Privacy. In the wake of the Apple vs. FBI case, two leading Intelligence Committee Senators have introduced an anti-encryption bill that would effectively ban strong encryption. Senators Richard Burr R-NC and Dianne Feinstein D-CA released the...

Hack The Pentagon Bug Bounty Opens April 18

The Department of Defense announced today that registration for its Hack the Pentagon bug bounty trial program is open, and that the program will be run on the HackerOne platform. The trial of the government’s first bug bounty program will run April 18 to May 12. The DoD said only certain...

Facebook's Vice President Arrested in Brazil for Refusing to Share WhatsApp Data

Apple is not the only technology giant battling against authorities over a court order; Facebook is also facing the same. Brazil’s federal police arrested Facebook Latin America Vice President for failing to comply with court orders to help investigators in a drug trafficking case that involves...

Shopify: Injection via CSV Export feature in Admin Orders

i found out that the filtering of "=,-,+" is not working in all data. there's a way to bypass it. 1. Create a product with title =cmd|' /C calc'!'D2' 2. Add variants more than 2 variants then save it. 3. Go to Orders Create Order 4. search the product we made =cmd|' /C calc'!'D2' 5. Add 2 variant...

Shopify: XSS in Draft Orders in Timeline i SHOPIFY Admin Site!

Create an Draft with a product named "img src=x onerror=prompt'XSSP' 2. Send the Draft to someone and complete the order. Order is shown as Completed Drafts as order.png 3. Create a timeline and reference this Draft. As soon as you click POST you will be XSSEd xss.png Thanks...

Shopify: Stored XSS in /admin/orders

Hi , I have found a Stored XSS vulnerability in orders page. Steps to reproduce: 1. Create a new order with an item that requires shipping 2. Go to https://.myshopify.com/admin/orders/ 3. Click the Fulfill items button then fulfill the items 4. Now a new fulfillment with an id will be generated ,...

FBI Director Asks Tech Companies to At least Don't Offer End-to-End Encryption

FBI declared War against Encryption. Encryption is defeating government intelligence agencies to detect terrorist activities and after the recent ISIS-linked terror attacks in Paris and California, the issue has once again become a political target in Washington. ...and meanwhile, Kazakhstan plan...

spunlite.co.nz XSS vulnerability

Vulnerable URL: http://www.spunlite.co.nz/forms/orders.php?productname=%22%3E%3Csvg/onload=prompt%28/XSSPOSED/%29%3E Details: Description| Value ---|--- Patched:| No Latest check for patch:| 26.07.2017 Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa Rank| Unknown / Not...

xpshop网店系统sql注入两处（一处盲注）

简要描述： 详细说明： 漏洞位置：...order protected void PageLoadobject sender, EventArgs e if base.CurrentUser != null && base.CurrentUser.Name != "anonymous" this.member = base.CurrentUser; this.shipfree = new ShippingFreeDB.GetShippingFreeDetails1; if !base.IsPostBack if base.Request.QueryString"type" != null...

CloudFlare Transparency Report Shows Spike in Court Orders

In its latest transparency report, CloudFlare says that the number of subpoenas it has received has remained steady since last year, but the volume of court orders has more than doubled since the second half of last year. While much of the data from CloudFlare’s report for the first half of 2015...

FBI Director to Silicon Valley: 'Try Harder' to Find 'Going Dark' Solution

The United States government has eased off off its demands for “exceptional access” to encrypted communication, and instead volleyed the problem back to technology companies and asked them to try harder to come up with a solution. The government’s concern is that recent enhancements to encryption...

一采通电子采购系统多处SQL注入漏洞

简要描述： 一采通电子采购系统多处SQL注入漏洞 详细说明： google:inurl:companycglist.aspx?ComId= 1 漏洞存在于 /Orders/k3orderdetail.aspx，参数FINTERID 例如 http://eps.umgg.com.cn/Orders/k3orderdetail.aspx?FINTERID=1 2 漏洞存在于 /organization/GetUserList2.aspx，参数UserName 例如...

Shopify: Privilege Escalation - A `MEMBER` with no ACCESS to `ORDERS` can still access the orders by using `Order Printer APP`

This researcher pointed out that Shopify's app ecosystem has no built-in way of verifying who is using an app, and therefore most apps do not verify user privileges when requesting and displaying a store's data. To resolve this issue we implemented an "online access" mode in which an app can...

用友系统任意下载订单漏洞

简要描述： 用友系统任意下载订单漏洞 详细说明： http://uporder.yonyou.com/file/ 漏洞证明：...

Confusion Reigns Over FBI's Plans for National Security Letter Gag Orders

The way that National Security Letters are approved and used is one of the government’s more opaque processes. Now, you can add some more confusion into the mix, courtesy of some new comments from the FBI about when recipients are able to disclose the fact that they have received an NSL. More tha...

Canary Watch Site Launches to Track Warrant Canaries

In the years since Edward Snowden began putting much of the NSA‘s business in the street, including its reliance on the secret FISA court and National security Letters, warrant canaries have emerged as a key method for ISPs, telecoms and other technology providers to let the public know whether...