SolarWinds and Market Incentives

In early 2021, IEEE Security and Privacy asked a number of board members for brief perspectives on the SolarWinds incident while it was still breaking news. This was my response. The penetration of government and corporate networks worldwide is the result of inadequate cyberdefenses across the...

ZOHO ManageEngine ServiceDesk Plus 跨站脚本漏洞

ZOHO ManageEngine ServiceDesk Plus SDP is the United States ZhuoHao ZOHO company's set of ITIL-based architecture of IT service management software. The software integrates Incident Management, Problem Management, Asset Management IT Project Management, Procurement and Contract Management modules...

Rapid7 Now Available Through Carahsoft’s NASPO ValuePoint

We are happy to announce that Rapid7’s solutions have been added to the NASPO ValuePoint Cloud Solutions contract held by Carahsoft Technology Corp. The addition of this contract enables Carahsoft and its reseller partners to provide Rapid7’s Insight platform to participating States, Local...

OSINT your OT suppliers

There is much talk about supply chain security and reviewing your suppliers for cyber security. But how much information do they intentionally and unintentionally leak about your organisation online? We see this particularly in the industrial controls sector as its cyber security maturity is...

SQL Injection Vulnerability in Nippon Steel's Procurement E-Commerce Platform

hereinafter referred to as Rizhao Iron & Steel Holding Group, whose main products include hot rolled coils, hot rolled sheets, cold formed sheets, pickled sheets, galvanized sheets, profiled steel, etc., is currently the world's very large-scale ESP product production, processing base, etc.. A SQ...

ZOHO ManageEngine ServiceDesk Plus Information Disclosure Vulnerability (CNVD-2022-29863)

ZOHO ManageEngine ServiceDesk Plus SDP is a set of ITIL-based IT service management software from ZOHO, USA. The software integrates incident management, issue management, asset management IT project management, procurement and contract management, and other functional modules.ZOHO ManageEngine...

Greenwashing or Legit?

I think we can all agree that sustainability is one of the most important topics that we will discuss this year. It's driving consumer habits, business practices, and investment decisions. And it’s a discussion that’s happening at every level of the business; from procurement all the way up to th...

CISA Insights on Risk Considerations for Managed Service Provider Customers

CISA has released a new CISA Insights, Risk Considerations for Managed Service Provider Customers MSPs, which provides Managed Service Provider MSP customers a framework for reducing risk. This framework is designed for government and private sector organizations of all sizes, and it suggests...

ZOHO ManageEngine ServiceDesk Plus Licensing Issue Vulnerability

ZOHO ManageEngine ServiceDesk Plus SDP is a set of ITIL-based IT service management software from ZOHO. The software integrates incident management, issue management, asset management IT project management, procurement and contract management, etc. An authorization issue vulnerability exists in...

Logic flaws and vulnerabilities in the government procurement transaction system of Hangzhou Pinming Information Technology Co.

Hangzhou Pinming Information Technology Co., Ltd. is a high-tech enterprise dedicated to building a domestic leading public resource transaction informationization field. A logic flaw vulnerability exists in the government procurement transaction system of Hangzhou Pinming Information Technology...

Unauthorized Access Vulnerability in QSI Purchase System PURCHASE

Purchase is an application for office purchasing. An unauthorized access vulnerability exists in Qixing Procurement System Purchase, which can be exploited by attackers to obtain sensitive information...

New US Executive Order on Cybersecurity

President Biden signed an executive order to improve government cybersecurity, setting new security standards for software sold to the federal government. For the first time, the United States will require all software purchased by the federal government to meet, within six months, a series of ne...

Oracle PeopleSoft Enterprise SCM eProcurement 输入验证错误漏洞

Oracle PeopleSoft Enterprise SCM eProcurement is an application from Oracle America, Inc. used for temporary user request items.Oracle PeopleSoft Enterprise SCM eProcurement is vulnerable to an input validation error that could be exploited by an attacker to update, insert, or delete accessible...

Shanghai Zhenyun Information Technology Co., Ltd. SRM Integrated Digital Procurement Management Platform Has Logical Flaws and Vulnerabilities

SRM All-in-One Digital Procurement Management Platform is a self-contained and cloud-based deployment of an enterprise-class procurement management platform. A logic flaw exists in the SRM integrated digital procurement management platform of Shanghai Zhenyun Information Technology Co., Ltd. that...

Document Uploading Vulnerability in Bidding and Procurement Management System of Guangdong Guangling Information Technology Co.

Founded in April 1998 and headquartered in Jinshan Park of Tianhe Software Park, a national software industry base, Guangdong Guangling Information Technology Co., Ltd. has been focusing on the fields of Big Data, Cloud Computing and Artificial Intelligence. A file upload vulnerability exists in...

You Can Now Buy (And Renew) Five More Rapid7 Products Through AWS Marketplace

Purchasing software through AWS Marketplace has to be one of the most under-appreciated perks of being an Amazon Web Services AWS customer. For starters, products you purchase through Marketplace automatically show up on your next AWS bill, which can really simplify your procurement process. In...

SQL Injection Vulnerability in Us***_Se***.aspx Page of Qixing Procurement System

The QI Procurement System is the system used for material procurement. An SQL injection vulnerability exists in the UsSe.aspx page of the Qixing Procurement System, which can be exploited by an attacker to obtain sensitive information from the database...

SQL Injection Vulnerability in Us***_Li***.aspx Page of Qixing Procurement System

The QI Procurement System is the system used for material procurement. An SQL injection vulnerability exists in the UsLi.aspx page of the Qixing Procurement System, which can be exploited by an attacker to obtain sensitive information from the database...

IoT Cybersecurity Improvement Act Passed, Heads to President's Desk

Security experts are applauding the recent stamp of approval by the U.S. Senate on a groundbreaking internet-of-things IoT security regulatory effort. The IoT Cybersecurity Improvement Act, which was led in bipartisan sponsorship by Reps. Will Hurd R-Texas and Robin Kelly D-Ill., would require th...

File Upload Vulnerability in Kaixin Procurement System

Qixing Purchasing System is a system for material purchasing and management, which is developed using ASP.NET language. A file upload vulnerability exists in the Qixing Procurement System. An attacker can exploit the vulnerability to upload a webshell and gain server privileges...