QND Advance has an unspecified vulnerability

QualitySoft QND is a suite of IT asset management solutions from QualitySoft Japan. The solution features external media control, device operation log viewing and URL filtering. QND Advance 11.0.4i suffers from a Privilege Permission and Access Control Issue vulnerability that originates from an...

US Soldiers Exposed Nuclear Secrets on Digital Flash Ccards

Plus: A major hack in Japan, Citizen app run amok, and more of the week’s top security news...

Fujitsu SaaS Hack Sends Govt. of Japan Scrambling

Threat actors have stolen files from several official government agencies of Japan by hacking into Fujitsu’s software-as-a-service SaaS platform and gaining access to its systems. The Japan-based tech giant temporarily disabled ProjectWEB enterprise after learning of the attack, which is known to...

EC-CUBE cross-site scripting vulnerability (CNVD-2021-34683)

Ec-cube is an open source e-commerce system of the Japanese company Ec-cube . A cross-site scripting vulnerability exists in EC-CUBE versions 4.0.0 through 4.0.5. The vulnerability stems from a program that allows remote attackers to inject specially crafted script into specific input fields of E...

Mitsubishi Electric GOT and Tension Controller (Update A)

1. EXECUTIVE SUMMARY CVSS v3 5.9 ATTENTION: Exploitable remotely Vendor: Mitsubishi Electric Equipment: GOT and Tension Controller Vulnerability: Buffer Access with Incorrect Length Value 2. UPDATE INFORMATION This updated advisory is a follow-up to the original advisory titled ICSA-21-131-02...

Omron CX-One

1. EXECUTIVE SUMMARY CVSS v3 7.8 ATTENTION: Low attack complexity Vendor: Omron Equipment: CX-One Vulnerability: Stack-based Buffer Overflow 2. RISK EVALUATION Successful exploitation of this vulnerability may allow arbitrary code execution. 3. TECHNICAL DETAILS 3.1 AFFECTED PRODUCTS The...

Friday Squid Blogging: COVID Relief Funds

A town in Japan built a giant squid statue with its COVID relief grant. One local told the Chunichi Shimbun newspaper that while the statue may be effective in the long run, the money could have been used for "urgent support," such as for medical staff and long-term care facilities. But a...

New Panda Stealer Targets Cryptocurrency Wallets

In early April, we observed a new information stealer called Panda Stealer being delivered via spam emails. Based on Trend Micro's telemetry, United States, Australia, Japan, and Germany were among the most affected countries during a recent spam wave...

Buffalo WSR-2533DHPL2 and WSR-2533DHP3 Code Injection Vulnerability

Buffalo WSR-2533DHPL2 and WSR-2533DHP3 are routers from Buffalo Japan.The Buffalo WSR-2533DHPL2 and WSR-2533DHP3 are vulnerable to code injection, which can be exploited by attackers to remotely execute code...

Water Pamola Attacked Online Shops Via Malicious Orders

Since 2019, we have been tracking a threat campaign we dubbed as “Water Pamola.” The campaign initially compromised e-commerce online shops in Japan, Australia, and European countries via spam emails with malicious attachments...

Buffalo WSR-2533DHPL2 and WSR-2533DHP3 are vulnerable to path traversal

The Buffalo WSR-2533DHPL2 and WSR-2533DHP3 are routers from Buffalo Japan.The Buffalo WSR-2533DHPL2 and WSR-2533DHP3 suffer from a path traversal vulnerability, which stems from an input validation error when the web interface handles directory traversal sequences, and can be exploited by attacke...

Buffalo WSR-2533DHPL2 and WSR-2533DHP3 Access Control Error Vulnerability

Buffalo WSR-2533DHPL2 and WSR-2533DHP3 are routers from Buffalo Japan.The Buffalo WSR-2533DHPL2 and WSR-2533DHP3 are vulnerable to an access control error that could be exploited by an attacker to gain access to unauthorized content...

Buffalo WSR-2533DHPL2 授权问题漏洞

Buffalo WSR-2533DHPL2 and WSR-2533DHP3 are routers from Buffalo Japan.The Buffalo WSR-2533DHPL2 and WSR-2533DHP3 are vulnerable to an access control error that could be exploited by an attacker to gain access to unauthorized content...

Hackers are implanting multiple backdoors at industrial targets in Japan

Cybersecurity researchers on Tuesday disclosed details of a sophisticated campaign that deploys malicious backdoors for the purpose of exfiltrating information from a number of industry sectors located in Japan. Dubbed "A41APT" by Kaspersky researchers, the findings delve into a new slew of attac...

Hackers are implanting multiple backdoors at industrial targets in Japan

Cybersecurity researchers on Tuesday disclosed details of a sophisticated campaign that deploys malicious backdoors for the purpose of exfiltrating information from a number of industry sectors located in Japan. Dubbed "A41APT" by Kaspersky researchers, the findings delve into a new slew of attac...

Asus UX360CA BIOS through 303 安全漏洞

The Asus UX360CA BIOS through 303 is a laptop from Asus Japan. The UX360CA BIOS through 303 on ASUS contains a security vulnerability that can be exploited by an attacker to overwrite almost any physical memory location and execute arbitrary code in the SMM...

Kangtaike SolarView Compact SV-CPT-MC310 Cross-Site Scripting Vulnerability

Kangtaike SolarView Compact is an application system from Kangtaike, Japan. Kangtaike SolarView Compact SV-CPT-MC310 is vulnerable to cross-site scripting, which can be exploited by attackers to inject arbitrary scripts via unspecified vectors...

GROWI Cross-Site Scripting Vulnerability (CNVD-2021-19694)

Weseek GROWI is a suite of team collaboration software from Weseek Japan. A stored cross-site scripting vulnerability exists in the administrator page in GROWI 4.2.0 - 4.2.7. An attacker can exploit this vulnerability to execute arbitrary script in a logged-in user's web browser...

GROWI Cross-Site Scripting Vulnerability (CNVD-2021-19695)

Weseek GROWI is a suite of team collaboration software from Weseek Japan. A reflected cross-site scripting vulnerability exists in GROWI 4.2.0 - 4.2.7. The vulnerability stems from insufficient validation of URL query parameters. An attacker can exploit this vulnerability to execute arbitrary...

Kangtaike SolarView Compact SV-CPT-MC310 Access Control Error Vulnerability

Kangtaike SolarView Compact is an application system from Kangtaike Japan Inc. which provides photovoltaic power measurement systems. Kangtaike SolarView Compact SV-CPT-MC310 suffers from an access control error vulnerability that could be exploited by an attacker to obtain and/or change settings...