CVE-2018-18868

No-CMS 1.1.3 is prone to Persistent XSS via a contactus name parameter, as demonstrated by the VG48Z5PqVWname parameter...

PT-2018-14702

Name of the Vulnerable Software and Affected Versions No-CMS version 1.1.3 Description The issue allows for Persistent XSS attacks through the name parameter in the contact us functionality. This is demonstrated by exploiting the name parameter, such as the VG48Z5PqVWname parameter. Recommendatio...

Employee infects US govt network with malware after visiting 9,000 porn sites

By Uzair Amir Due to the carelessness of an employee, who apparently was a porn fan, the network of the satellite imaging facility, the U.S. Geological Survey USGS at the EROS Center, South Dakota got infected with malware. An audit carried out by the U.S. Department of the Interior’s inspector...

IoT Flaw Allows Hijacking of Connected Construction Cranes

A connected construction crane, from Telecrane, has a vulnerability that would allow cyberattackers to intercept its communications and take the equipment over. The internet of things IoT continues to add new types of objects to its footprint, as industries start leveraging connectivity to increa...

More on the Supermicro Spying Story

I've blogged twice about the Bloomberg story that China bugged Supermicro networking equipment destined to the US. We still don't know if the story is true, although I am increasingly skeptical because of the lack of corroborating evidence to emerge. We don't know anything more, but this is the...

Security Vulnerability in Internet-Connected Construction Cranes

This seems bad: The F25 software was found to contain a capture replay vulnerability -- basically an attacker would be able to eavesdrop on radio transmissions between the crane and the controller, and then send their own spoofed commands over the air to seize control of the crane. "These devices...

HackerOne: Proper verification is not done before sending invitations to researchers for certain private programs with rules e.g. "Participants must be US-based"

Hi, I would like to report something I just recently noticed upon receiving an automated invite from Hackerone for a private program. The program brief clearly states the following in program rules: █████ This is where I believe the issue is. I live in ███ and according to the program rules I...

Safeguarding the Nation’s Critical Infrastructure

In May of 1998, President Clinton issued Presidential Decision Directive 63: Protecting America’s Critical Infrastructures. This Directive proposed steps to enact the recommendations of the President’s Commission on Critical Infrastructure Protection, published in October 1997. Twenty years on, h...

Critical RCE Bugs Patched in Drupal 7 and 8

Drupal is urging users to upgrade to the latest release that fixes two critical remote code execution bugs impacting Drupal 7 and Drupal 8. Developers have also identified three additional “moderately critical” vulnerabilities. “A remote attacker could exploit some of these vulnerabilities to tak...

Russian Trolls Are Still Playing Both Sides—Even With the Mueller Probe

The latest indictment against Russian trolls shows how they sowed division in the US on wedge issues, including the investigation into their activity...

Major weapon systems developed by US DoD highly vulnerable to cyber attacks

By Uzair Amir Several Critical Vulnerabilities Identified in Major Weapon Systems Being Developed by US DoD. The advanced weapon systems developed by the US Department of Defense with a whopping estimated expenditure of $1.66 trillion are plagued with grave flaws, which make them a potential targ...

5 Takeaways From the #CbConnect18 “Women in Cybersecurity” Keynote

Wow, what a great few days here at Cb Connect. Sometimes with conferences, you go out with one problem to solve and leave with 50. Cb Connect really exposed some great ways to solve problems, no matter the size of the team or the Cb product in house. I also had some great takeaways from the 'Wome...

Bloomberg blunder highlights supply chain risks

Ooh boy! Talk about a back-and-forth, he said, she said story! No, we’re not talking about that Supreme Court nomination. Rather, we’re talking about Supermicro. Supermicro manufacturers the type of computer hardware that is used by technology behemoths like Amazon and Apple, as well as governmen...

Security Vulnerabilities in US Weapons Systems

The US Government Accounting Office just published a new report: "Weapons Systems Cyber Security: DOD Just Beginning to Grapple with Scale of Vulnerabilities" summary here. The upshot won't be a surprise to any of my regular readers: they're vulnerable. From the summary: Automation and connectivi...

Why Supply Chain Hacks Are a Cybersecurity Worse Case Scenario

A blockbuster report from Bloomberg says that China has compromised servers used by major US companies. It's a problem that experts have long feared, and still don't know how to resolve...

Chinese Spying Chips Found Hidden On Servers Used By US Companies

A media report today revealed details of a significant supply chain attack which appears to be one of the largest corporate espionage and hardware hacking programs from a nation-state. According to a lengthy report published today by Bloomberg, a tiny surveillance chip, not much bigger than a gra...

Bank Servers Hacked to Trick ATMs into Spitting Out Millions in Cash

The US-CERT has released a joint technical alert from the DHS, the FBI, and Treasury warning about a new ATM scheme being used by the prolific North Korean APT hacking group known as Hidden Cobra. Hidden Cobra, also known as Lazarus Group and Guardians of Peace, is believed to be backed by the...

jira.legal4.us XSS vulnerability

Open Bug Bounty ID: OBB-681742 Description| Value ---|--- Affected Website:| jira.legal4.us Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

Dark Web: US court seizes assets and properties of deceased AlphaBay operator

By Carolina AlphaBay was one of the largest dark web marketplaces - In 2017, its admin Alexandre Cazes committed suicide in a Thai prison. The Fresno Division of the U.S. District Court for the Eastern District of California has finally concluded a 14-month long civil forfeiture case and allowed...

WannaCry ransomware fame North Korean hacker tracked down by the US

By Waqas It is no secret that the US government has always suspected and even accused North Korea was carrying out ransomware attacks using the destructive WannaCry ransomware and for hacking Sony Pictures. But it merely has remained a suspicion so far. However, now the US authorities have found...