175 matches found
Design/Logic Flaw
GAT-Ship Web Module before 1.40 suffers from a vulnerability allowing authenticated attackers to upload any file type to the server via the "Documents" area. This vulnerability is related to "uploadDocFile.aspx"...
CVE-2019-11028
GAT-Ship Web Module before 1.40 suffers from a vulnerability allowing authenticated attackers to upload any file type to the server via the "Documents" area. This vulnerability is related to "uploadDocFile.aspx"...
CVE-2019-11028
GAT-Ship Web Module is vulnerable to an authenticated unrestricted file upload in the Documents area (uploadDocFile.aspx) on versions before 1.40. The root cause is an improper validation allowing uploading of any file type to the server, enabling potential arbitrary content handling. There is no...
CVE-2019-11028
GAT-Ship Web Module before 1.40 suffers from a vulnerability allowing authenticated attackers to upload any file type to the server via the "Documents" area. This vulnerability is related to "uploadDocFile.aspx"...
Researcher: Not Hard for a Hacker to Capsize a Ship at Sea
Maritime transport still contributes in an important way to the world’s economy, with on-time shipments influencing everything from commodities availability and spot pricing to the stability of small countries. Unfortunately, capsizing a ship with a cyberattack is a relatively low-skill enterpris...
Sinking a ship and hiding the evidence
Our earlier work on Voyage Data Recorder manipulation got us thinking about how a malicious individual or organisation might bring about the demise of a ship and hide the evidence. There are plenty of ways to get malware on to a ship. Whether it’s via satcoms, phishing, USB, crew Wi-Fi, dodgy DVD...
Hacking floating hotels. Cruise ship compromise on the high seas
Modern cruise ships have all the amenities of a large resort hotel. Prior to entering the infosec space, I spent 5 years working in hotels. My experience of the security of both hotels and shipping indicates that the mix is not a good one for security. What’s the difference between a hotel and a...
Courts Hand Down Hard Jail Time for DDoS
Seldom do people responsible for launching crippling cyberattacks face justice, but increasingly courts around the world are making examples of the few who do get busted for such crimes. On Friday, a 34-year-old Connecticut man received a whopping 10-year prison sentence for carrying out...
CVE-2018-19340
Guriddo Form PHP 5.3 has XSS via the demos/jqform/defaultnodb/default.php OrderID, ShipName, ShipAddress, ShipCity, ShipPostalCode, ShipCountry, Freight, or details parameter...
Auto-Maskin DCU 210E RP 210E and Marine Pro Observer App
Overview Auto-Maskin RP remote panels and DCU controls units are used to monitor and control ship engines. The units have several authentication and encryption vulnerabilities which can allow attackers to access the units and control connected engines. Description CWE 798: Use of Hard-Coded...
Hacking Serial Networks on Ships
Three different ways to intercept and modify serial data on ship networks. The serial data that controls steering, engine control and so much more on board ship… How-to Vessels typically have two distinct networks on board; one IP/ethernet network for business systems, crew mail & web browsing an...
Chinese hackers stole 614 gigabytes of US Navy’s anti-ship missile data
By Waqas In January and February 2018, the computers belonging to a U.S. This is a post from HackRead.com Read the original post: Chinese hackers stole 614 gigabytes of US Navy's anti-ship missile data...
Hacking, tracking, stealing and sinking ships
At Infosecurity Europe this year, we demonstrated multiple methods to interrupt the shipping industry, several of which haven’t been demonstrated in public before, to our knowledge. Some of these issues were simply through poor security hygiene on board, but others were linked to the protocols us...
Cross site scripting
Persistent XSS exists in the web server on Cobham Sea Tel 116 build 222429 satellite communication system devices: remote attackers can inject malicious JavaScript code using the device's TELNET shell built-in commands, as demonstrated by the "set ship name" command. This is similar to a Cross...
CVE-2018-5071
Persistent XSS exists in the web server on Cobham Sea Tel 116 build 222429 satellite communication system devices: remote attackers can inject malicious JavaScript code using the device's TELNET shell built-in commands, as demonstrated by the "set ship name" command. This is similar to a Cross...
US Navy investigating whether its crashed ship was hacked (Updated)
By Carolina Its no surprise that ships can be hacked but did someone hack This is a post from HackRead.com Read the original post: US Navy investigating whether its crashed ship was hacked Updated...
August 8, 2017 – Morning Cyber Coffee Headlines – “Smokey the Bear” Edition
Good morning! Sit with Carbon Black this morning over a cup of coffee or tea and browse a few industry headlines to get the day started. We’ve got just enough information below to get you through that first cup…enjoy! August 8, 2017 - Headlines NetWorks Group Joins “Carbon Black Connect” Partner...
SQL Injection Vulnerability in Hanchao B2B2C Multi-User Mall System v2.1.3 change_ship_free method
Hanchao B2B2C multi-user mall system is a PHP multi-user mall website system source code developed in PHP + MySQL. A SQL injection vulnerability exists in the Hanchao B2B2C Multi-User Mall System v2.1.3 changeshipfree method. An attacker can exploit this vulnerability to obtain database informati...
Cruise Ship Cargo Simulator 3D - Customized SSL, Dangerous filesystem permissions, WebView SSL handling enabled vulnerabilities
HackApp vulnerability scanner discovered that application Cruise Ship Cargo Simulator 3D published at the 'play' market has multiple vulnerabilities...
Cruise Ship 3D Simulator - Customized SSL, WebView SSL handling enabled, WebView code execution vulnerabilities
HackApp vulnerability scanner discovered that application Cruise Ship 3D Simulator published at the 'play' market has multiple vulnerabilities...