Oracle Transportation Management Unauthorized Access Vulnerability (CNVD-2021-102408)

Oracle Transportation Management OTM provides companies with a single platform to manage all transportation activities across the supply chain.Oracle Transportation Management Unauthorized Access Vulnerability. An attacker could exploit this vulnerability to gain access to sensitive information...

CISA Releases Automotive Cybersecurity Guide

The guide helps Transportation System Sector partners understand the cyber-physical risks related to AVs and discusses mitigation strategies they can implement...

Oracle Transportation Management Unauthorized Access Vulnerability

Oracle Transportation Management OTM provides companies with a single platform to manage all transportation activities across the supply chain. an unauthorized access vulnerability exists in the UI Infrastructure component of Oracle Transportation Management version 6.4.3. An attacker could explo...

Oracle Transportation Management 安全漏洞

Oracle Transportation Management OTM provides companies with a single platform to manage all transportation activities across the supply chain. an unauthorized access vulnerability exists in the UI Infrastructure component of Oracle Transportation Management version 6.4.3. An attacker could explo...

Oracle Transportation Management 安全漏洞

Oracle Transportation Management OTM provides companies with a single platform to manage all transportation activities across the supply chain.Oracle Transportation Management Unauthorized Access Vulnerability. An attacker could exploit this vulnerability to gain access to sensitive information...

Uffizio GPS Tracker

1. EXECUTIVE SUMMARY CVSS v3 9.8 ATTENTION: Exploitable remotely/low attack complexity Vendor: Uffizio Equipment: GPS Tracker Vulnerabilities: Improper Access Control, Unrestricted Upload of File with Dangerous Type, Open Redirect, Cross-site Scripting, Cross-site Request Forgery 2. RISK...

Iran-linked DEV-0343 targeting defense, GIS, and maritime sectors

DEV-0343 is a new activity cluster that the Microsoft Threat Intelligence Center MSTIC first observed and began tracking in late July 2021. MSTIC has observed DEV-0343 conducting extensive password spraying against more than 250 Office 365 tenants, with a focus on US and Israeli defense technolog...

A week in security (Sept 13 – Sept 19)

Last week on Malwarebytes Labs Why backups aren’t a “silver bullet” against ransomware, with Matt Crape: Lock and Code S02E17 The many tentacles of Magecart Group 8 Apple releases emergency update: Patch, but don’t panic Update now! Google Chrome fixes two in-the-wild zero-days Parts of the Dark...

Cybersecurity in the Infrastructure Bill

On August 10, 2021, the U.S. Senate passed the Infrastructure Investment and Jobs Act of 2021 H.R.3684. The bill comes in at 2,700+ pages, provides for $1.2T in spending, and includes several cybersecurity items. We expect this legislation to become law around late September and do not expect...

Security Bulletin: A security vulnerability has been identified in IBM WebSphere Application Server shipped with Asset and Service Management (CVE-2021-29736)

Summary IBM WebSphere Application Server is shipped as a component of Maximo Asset Management, Maximo Industry Solutions including Maximo for Nuclear Power, Maximo for Transportation, Maximo for Life Sciences, Maximo for Oil and Gas, and Maximo for Utilities, Maximo Adapter for Primavera,...

TripSpark VEO Transportation SQL Injection

Exploit Title: TripSpark VEO Transportation - 'editOEN' Blind SQL Injection Google Dork: inhtml:"Student Busing Information" Date: 07/27/2021 Exploit Author: Sedric Louissaint @LKn0w Vendor Homepage: https://www.tripspark.com Software Document Link:...

TripSpark VEO Transportation - Blind SQL Injection

Exploit Title: TripSpark VEO Transportation - 'editOEN' Blind SQL Injection Google Dork: inhtml:"Student Busing Information" Date: 07/27/2021 Exploit Author: Sedric Louissaint @LKn0w Vendor Homepage: https://www.tripspark.com Software Document Link:...

TripSpark VEO Transportation - Blind SQL Injection Vulnerability

Exploit Title: TripSpark VEO Transportation - 'editOEN' Blind SQL Injection Google Dork: inhtml:"Student Busing Information" Exploit Author: Sedric Louissaint @LKn0w Vendor Homepage: https://www.tripspark.com Software Document Link: https://www.tripspark.com/resourcefiles/veo-transportation.pdf...

Vulnerabilities fixed in Oracle Supply Chain Products Suite

Oracle has fixed vulnerabilities in the following products within the Supply Chain Products Suite: Transportation Management Agile Engineering Data Management Agile PLM Framework An unauthenticated malicious person could potentially exploit them to cause a denial-of-service. In addition the...

SQL Injection Vulnerability in Network Video Surveillance System of Tianmai Technology

Zhengzhou Tianmai Technology Co., Ltd. was founded in 2004, is located in Zhengzhou City, National High-tech Industrial Development Zone, is specializing in public transportation intelligent system solutions provider, is the "city intelligent bus solutions" and "3G/4G video, Beidou/GPS monitoring...

Command Execution Vulnerability in Guangzhou Traffic - Xingxun Tong

Guangzhou Transportation-Xingxuntong is a comprehensive transportation information service software launched by Guangzhou Public Transportation Group under the guidance of Guangzhou Transportation Bureau. A command execution vulnerability exists in Guangzhou Transportation - Xingxun Tong, which c...

Command execution vulnerability exists in KYTMS (CNVD-2021-53899)

KYTMS is a TMS transportation management system. KYTMS suffers from a command execution vulnerability that can be exploited by an attacker to gain server privileges...

XSS Vulnerability in Fenxian Chain Transportation Management Cloud Platform of Zhongtong Cloud Warehouse Technology Co.

Zhongtong Cloud Warehouse Technology is a logistics enterprise under Zhongtong Express Group, which provides professional warehousing and distribution integrated supply chain comprehensive services for e-commerce platforms, brand merchants, social e-commerce companies and live broadcasting...

All Bachmann M1 System Processor Modules

1. EXECUTIVE SUMMARY CVSS v3 7.2 ATTENTION: Exploitable remotely/low attack complexity Vendor: Bachmann Electronic, GmbH Equipment: All M-Base Controllers Vulnerability: Use of Password Hash with Insufficient Computational Effort 2. REPOSTED INFORMATION This updated advisory is a follow-up to the...

Security Bulletin: A security vulnerability has been identified in IBM WebSphere Application Server shipped with Asset and Service Management (CVE-2021-20517)

Summary IBM WebSphere Application Server is shipped as a component of Maximo Asset Management, Maximo Industry Solutions including Maximo for Nuclear Power, Maximo for Transportation, Maximo for Life Sciences, Maximo for Oil and Gas, and Maximo for Utilities, Maximo Adapter for Primavera,...