Mitsubishi Electric MELSEC iQ-F, iQ-R Series

1. EXECUTIVE SUMMARY CVSS v3 5.9 ATTENTION: Exploitable remotely Vendor: Mitsubishi Electric Equipment: MELSEC iQ-F and iQ-R Series products Vulnerability: Predictable Seed in Pseudo-Random Number Generator PRNG 2. UPDATE OR REPOSTED INFORMATION This updated advisory is a follow-up to the...

kentjapan.com Cross Site Scripting vulnerability OBB-3152094

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

coexist-japan.com Cross Site Scripting vulnerability OBB-3130111

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

arpjapan.net Cross Site Scripting vulnerability OBB-3120832

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

BlueNoroff APT Hackers Using New Ways to Bypass Windows MotW Protection

BlueNoroff, a subcluster of the notorious Lazarus Group, has been observed adopting new techniques into its playbook that enable it to bypass Windows Mark of the Web MotW protections. This includes the use of optical disk image .ISO extension and virtual hard disk .VHD extension file formats as...

Omron CX-Programmer

1. EXECUTIVE SUMMARY CVSS v3 7.8 ATTENTION: Low attack complexity Vendor: Omron Equipment: CX-Programmer Vulnerability: Out-of-bounds Write 2. RISK EVALUATION Successful exploitation of this vulnerability could allow arbitrary code execution or loss of sensitive information if a user opens a...

Fuji Electric Tellus Lite V-Simulator

1. EXECUTIVE SUMMARY CVSS v3 7.8 ATTENTION: Low attack complexity Vendor: Fuji Electric Equipment: Tellus Lite V-Simulator Vulnerabilities: Out-of-bounds Write, Stack-based Buffer Overflow 2. RISK EVALUATION Successful exploitation of these vulnerabilities could allow an attacker to execute...

Researchers Uncover MirrorFace Cyber Attacks Targeting Japanese Political Entities

A Chinese-speaking advanced persistent threat APT actor codenamed MirrorFace has been attributed to a spear-phishing campaign targeting Japanese political establishments. The activity, dubbed Operation LiberalFace by ESET, specifically focused on members of an unnamed political party in the natio...

Japan Construction Information Center DENSHI NYUSATSU CORE SYSTEM 输入验证错误漏洞

Japan Construction Information Center DENSHI NYUSATSU CORE SYSTEM is a construction core management system from Japan Construction Information Center, Inc. A security vulnerability exists in the Japan Construction Information Center DENSHI NYUSATSU CORE SYSTEM that originates when a user accesses...

Japan Construction Information Center DENSHI NYUSATSU CORE SYSTEM 跨站脚本漏洞

Japan Construction Information Center DENSHI NYUSATSU CORE SYSTEM is a construction core management system from Japan Construction Information Center, Inc. A security vulnerability exists in the Japan Construction Information Center DENSHI NYUSATSU CORE SYSTEM that could allow an attacker to...

japan-pro.ru Cross Site Scripting vulnerability OBB-3081772

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

Mitsubishi Electric GOT2000

1. EXECUTIVE SUMMARY CVSS v3 5.3 ATTENTION: Exploitable remotely Vendor: Mitsubishi Electric Equipment: GOT2000 Series Vulnerability: Improper Input Validation 2. RISK EVALUATION Successful exploitation of this vulnerability could allow an attacker to cause a denial-of-service condition by...

ncasa-japan.jp Cross Site Scripting vulnerability OBB-3070748

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

Hitachi Energy PCM600 Information Disclosure Vulnerability

The Hitachi Energy PCM600 is a simplified management tool for protection and control relays from Hitachi, Japan. An information disclosure vulnerability exists in Hitachi Energy PCM600. The vulnerability stems from where IED credentials are stored in the PCM600 database in plaintext format. An...

Electricity/Energy Cybersecurity: Trends & Survey Response

Based on our survey of over 900 ICS security leaders in the United States, Germany, and Japan, we dig deeper into each industry's challenges and present Trend Micro's recommendations...

Mitsubishi Electric GT SoftGOT2000

1. EXECUTIVE SUMMARY CVSS v3 9.8 ATTENTION: Exploitable remotely/low attack complexity Vendor: Mitsubishi Electric Corporation Equipment: GT SoftGOT2000 Vulnerability: Operating System OS Command Injection 2. RISK EVALUATION Successful exploitation of this vulnerability could allow an attacker to...

Omron NJ/NX-series Machine Automation Controllers

1. EXECUTIVE SUMMARY CVSS v3 8.3 ATTENTION: Exploitable remotely, public exploits are available Vendor: Omron Equipment: NJ/NX-series Machine Automation Controllers Vulnerability: Active Debug Code 2. RISK EVALUATION Successful exploitation of this vulnerability could allow an attacker to obtain...

japan-renovation-support.jp Cross Site Scripting vulnerability OBB-3044597

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

7 Rapid Questions with Toshio Honda, Sr. Security Solutions Engineer

Toshio Honda, Sr. Security Solutions Engineer You have been with Rapid7 for 4 years now, what originally attracted you to work here? I worked for a cybersecurity company who is a leader for the “Prevention” area prior to joining Rapid7, and I was looking for the next opportunity based on 3...

APT10: Tracking down LODEINFO 2022, part I

Kaspersky has been tracking activities involving the LODEINFO malware family since 2019, looking for new modifications and thoroughly investigating any attacks utilizing those new variants. LODEINFO is sophisticated fileless malware first named in a blogpost from JPCERT/CC in February 2020. The...