Security Bulletin: A security vulnerability has been identified in IBM WebSphere Application Server shipped with Asset and Service Management (CVE-2019-10086)

Summary IBM WebSphere Application Server is shipped as a component of Maximo Asset Management, Maximo Asset Management Essentials, Maximo Industry Solutions including Maximo for Energy Optimization, Maximo for Government, Maximo for Nuclear Power, Maximo for Transportation, Maximo for Life...

Security Bulletin: IBM Maximo Asset Management is vulnerable to Information Disclosure (CVE-2018-1697)

Summary IBM Maximo Asset Management could allow an authenticated user to enumerate usernames using a specially crafted HTTP request. Vulnerability Details CVEID: CVE-2018-1697 DESCRIPTION: IBM Maximo Asset Management could allow an authenticated user to enumerate usernames using a specially craft...

Improve cyber supply chain risk management with Microsoft Azure

For years, Microsoft has tracked threat actors exploiting federal cyber supply chain vulnerabilities. Supply chain attacks target software developers, systems integrators, and technology companies. Tactics often include obtaining source code, build processes, or update mechanisms to compromise...

Snipe-IT Open Source Asset Management 4.7.5 - Persistent Cross-Site Scripting

Exploit Title: Snipe-IT Open Source Asset Management 4.7.5 - Persistent Cross-Site Scripting Exploit Author: Metin Yunus Kandemir kandemir Vendor Homepage: https://snipeitapp.com/ Software Link: https://github.com/snipe/snipe-it/releases/tag/v4.7.5 Version: 4.7.5 Category: Webapps Tested on: Xamp...

Security Bulletin: IBM Maximo Asset Management is vulnerable to cross-site scripting (CVE-2019-11358)

Summary IBM Maximo Asset Management is vulnerable to cross-site scripting. Vulnerability Details CVEID: CVE-2019-11358 DESCRIPTION: jQuery, as used in Drupal core, is vulnerable to cross-site scripting, caused by improper validation of user-supplied input. A remote authenticated attacker could...

Detectify Asset Inventory and Monitoring

Continuing the topic about perimeter services. As I mentioned earlier, I don't think that the external perimeter services should be considered as a fully functional replacement for custom Vulnerability Management processes. I would rather see their results as an additional feed showing the proble...

CVE-2019-19245

NAPC Xinet Elegant 6 Asset Library 6.1.655 allows Pre-Authentication SQL Injection via the /elegant6/login LoginFormusername field when double quotes are used...

CVE-2019-19245

NAPC Xinet Elegant 6 Asset Library 6.1.655 allows Pre-Authentication SQL Injection via the /elegant6/login LoginFormusername field when double quotes are used...

Sql injection

NAPC Xinet Elegant 6 Asset Library 6.1.655 allows Pre-Authentication SQL Injection via the /elegant6/login LoginFormusername field when double quotes are used...

CVE-2019-19245

NAPC Xinet Elegant 6 Asset Library Web Interface v6.1.655 is affected by a Pre-Authentication SQL Injection in the /elegant6/login endpoint via the LoginForm[username] field when double quotes are used. Root cause is lack of input validation allowing SQL statements to be injected before authentic...

CVE-2019-19245

NAPC Xinet Elegant 6 Asset Library 6.1.655 allows Pre-Authentication SQL Injection via the /elegant6/login LoginFormusername field when double quotes are used...

PT-2019-15790 · Napc Xinet · Napc Xinet Elegant 6 Asset Library

Name of the Vulnerable Software and Affected Versions: NAPC Xinet Elegant 6 Asset Library version 6.1.655 Description: The issue allows for Pre-Authentication SQL Injection via the "/elegant6/login" API endpoint, specifically through the username field in the LoginForm when double quotes are used...

NAPC Xinet Elegant 6 Asset Library Web Interface SQL Injection Vulnerability

The NAPC Xinet interface Elegant 6 Asset Library is a web-based interface to the XIET asset management solution. A SQL injection vulnerability exists in NAPC Xinet interface Elegant 6 Asset Library version 6.1.655. The vulnerability stems from a lack of validation of externally entered SQL...

Xinet Elegant 6 Asset Library Web Interface 6.1.655 SQL Injection Vulnerability

NAPC Xinet interface Elegant 6 Asset Library version 6.1.655 allows pre-authentication error-based SQL injection via the /elegant6/login LoginFormusername field when double quotes are used. + Credits: hyp3rlinx + Website: hyp3rlinx.altervista.org + Source:...

Xinet Elegant 6 Asset Library Web Interface 6.1.655 SQL Injection

Credits: hyp3rlinx + Website: hyp3rlinx.altervista.org + Source: http://hyp3rlinx.altervista.org/advisories/NAPC-XINET-ELEGANT-6-ASSET-LIBRARY-WEB-INTERFACE-PRE-AUTH-SQL-INJECTION.txt + ISR: ApparitionSec Vendor www.napc.com Product Xinet Elegant 6 Asset Library Web Interface v6.1.655 Web based...

CVE-2019-4530

IBM Maximo Asset Management 7.6, 7.6.1, and 7.6.1.1 could allow an authenticated user to delete a record that they should not normally be able to. IBM X-Force ID: 165586...

CVE-2019-4530

IBM Maximo Asset Management 7.6, 7.6.1, and 7.6.1.1 could allow an authenticated user to delete a record that they should not normally be able to. IBM X-Force ID: 165586...

Code injection

IBM Maximo Asset Management 7.6, 7.6.1, and 7.6.1.1 could allow an authenticated user to delete a record that they should not normally be able to. IBM X-Force ID: 165586...

CVE-2019-4530

IBM Maximo Asset Management 7.6, 7.6.1, and 7.6.1.1 could allow an authenticated user to delete a record that they should not normally be able to. IBM X-Force ID: 165586...

CVE-2019-4530

CVE-2019-4530 concerns IBM Maximo Asset Management versions 7.6, 7.6.1, and 7.6.1.1, where an authenticated user could delete a record they should not normally be able to. The IBM security bulletin documents a privilege-escalation issue tied to DELETE access on MXAPIWODETAIL; images show affected...