Johnson Controls Software House C-CURE 9000 and American Dynamics victor VMS

1. EXECUTIVE SUMMARY CVSS v3 9.9 ATTENTION: Exploitable remotely/low skill level to exploit Vendor: Sensormatic Electronics, LLC, a subsidiary of Johnson Controls Equipment: Software House C•CURE 9000 and American Dynamics victor Video Management System Vulnerability: Cleartext Storage of...

Success in security: reining in entropy

Your network is unique. It’s a living, breathing system evolving over time. Data is created. Data is processed. Data is accessed. Data is manipulated. Data can be forgotten. The applications and users performing these actions are all unique parts of the system, adding degrees of disorder and...

A week in security (May 11 – May 17)

Last week on Malwarebytes Labs, we explained why RevenueWire has to pay $6.7 million to settle FTC charges, how CVSS works: characterizing and scoring vulnerabilities, and we talked about how and why hackers hit a major law firm with Sodinokibi ransomware. We also launched another episode of our...

SQL Injection Vulnerability in Health Collection and Reporting System of Shanxi Xianqi Technology Co.

The health collection and reporting system is developed by PHP+mysql and the code is completely open source for secondary development. Shanxi Xianqi Technology Co., Ltd. health collection and reporting system SQL injection vulnerability, attackers can use the vulnerability to obtain sensitive...

XSS Vulnerability in the Health Collection and Reporting System of Shanxi Xianqi Technology Co.

Health Collection and Reporting System is a data management system developed using PHP+mysql. Shanxi Xianqi Technology Co., Ltd Health Collection and Reporting System has an XSS vulnerability that can be exploited by attackers to obtain an administrator cookie...

Utah Says No to Apple/Google COVID-19 Tracing; Debuts Startup App

The state of Utah has settled on a contact-tracing mobile app that collects detailed user location information to track the spread of COVID-19 among citizens – eschewing the API model proposed by Apple and Google in April. The app is called “Healthy Together” and it was created by a startup calle...

careers.eisenhowerhealth.org Cross Site Scripting vulnerability

Open Bug Bounty ID: OBB-1161202 Following coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: &nbsp&nbsp&nbsp&nbsp&nbsp&nbspa. verified the vulnerability and confirmed its existence; &nbsp&nbsp&nbsp&nbsp&nbsp&nbspb. notified the website...

SQL Injection Vulnerability in Health Collection Reporting System (CNVD-2020-30198)

The health collection and reporting system is developed by PHP+mysql and the code is completely open source for secondary development. Health collection and reporting system has a SQL injection vulnerability, attackers can exploit the vulnerability to obtain sensitive database information...

Leaked NHS Docs Reveal Roadmap, Concerns Around Contact-Tracing App

A COVID-19 contact-tracing app to be rolled out by the UK’s National Health Service NHS has been thrust into the spotlight thanks to sensitive documents being leaked via a public Google Drive link. Contact tracing has emerged as a top idea for dealing with the coronavirus pandemic and is consider...

health-essence.com.au Cross Site Scripting vulnerability

Open Bug Bounty ID: OBB-1160109 Following coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: &nbsp&nbsp&nbsp&nbsp&nbsp&nbspa. verified the vulnerability and confirmed its existence; &nbsp&nbsp&nbsp&nbsp&nbsp&nbspb. notified the website...

SQL Injection Vulnerability in Health Collection and Reporting System of Shanxi Xianqi Technology Co.

Ltd. is a high-tech enterprise specializing in the research, development and sales of wireless smart home system. Shanxi Xianqi Technology Co., Ltd. health collection reporting system SQL injection vulnerability, attackers can use the vulnerability to obtain sensitive information database...

SQL Injection Vulnerability in the Health Collection and Reporting System of Shanxi Xianqi Technology Co. Ltd (CNVD-2020-30209)

Ltd. is a high-tech enterprise specializing in the research, development and sales of wireless smart home system. Shanxi Xianqi Technology Co., Ltd. health collection reporting system SQL injection vulnerability, attackers can use the vulnerability to obtain sensitive information database...

SQL Injection Vulnerability in the Health Collection and Reporting System of Shanxi Xianqi Technology Co. Ltd (CNVD-2020-30210)

Ltd. is a high-tech enterprise specializing in the research, development and sales of wireless smart home system. Shanxi Xianqi Technology Co., Ltd. health collection reporting system SQL injection vulnerability, attackers can use the vulnerability to obtain sensitive information database...

File Upload Vulnerability in Health Collection Reporting System

Health Collection and Reporting System is a general-purpose website system designed in PHP+MySQL architecture. A command execution vulnerability exists in the Health Collection and Reporting System. An attacker can exploit the vulnerability to gain control of the server...

Black Hat USA, DEF CON 28 Go Virtual

Cybersecurity conferences Black Hat USA and DEF CON 28 will not be held in person this year due to the coronavirus pandemic. The conferences will both instead be transformed into completely virtualized events. Both back-to-back annual conferences were set to take place in Las Vegas this year; Bla...

pdtableau.cardinalhealth.net Cross Site Scripting vulnerability

Open Bug Bounty ID: OBB-1149582 Security Researcher OakdaleHutch Helped patch 26 vulnerabilities Received 1 Coordinated Disclosure badges , a holder of 1 badges for responsible and coordinated disclosure, found a security vulnerability affecting pdtableau.cardinalhealth.net website and its users...

A Dozen Nation-Backed APTs Tap COVID-19 to Cover Spy Attacks

Cybercriminals have seized on the novel coronavirus as a theme in their attacks, and it turns out that the most sophisticated players on that scene are no exception. According to Google’s Threat Analysis Group TAG, more than a dozen nation-state-backed APTs are using the COVID-19 pandemic as a...

Staying Healthy, Focused, and Above All Grateful During the COVID-19 Crisis

By now, we are all subject in one way or another to the far-reaching impact of COVID-19. As we see on the news each day, the numbers of those infected by this deadly coronavirus continue to grow in terrifying increments. And even for those of us without family members or friends directly impacted...

Important: Red Hat Security Advisory: ipmitool security update

An update for ipmitool is now available for Red Hat Enterprise Linux 7.5 Extended Update Support. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available fo...

Mass surveillance alone will not save us from coronavirus

As the pattern-shattering truth of our new lives drains heavy—as coronavirus rends routines, raids our wellbeing, and whiplashes us between anxiety and fear—we should not look to mass digital surveillance to bring us back to normal. Already, governments have cast vast digital nets. South Koreans...