Command Execution Vulnerability in BIMe Data Collaboration Platform UE***.Net Component

Dongchen Gongyuan ProBIM was founded in 2014 as a software provider specializing in BIM cloud services. A command execution vulnerability exists in the UE.Net component of the BIMe data collaboration platform, which can be exploited by an attacker to gain control of the server...

BIME Mobile - External URLs, Suspicious files vulnerabilities

HackApp vulnerability scanner discovered that application BIME Mobile published at the 'play' market has multiple vulnerabilities...

Bime: Subdomain takeover at ws.bimedb.com due to unclaimed Amazon S3 bucket

The researcher found a subdomain takeover on ws.bimedb.com...

Bime: Urgent: attacker can access every data source on Bime

Vulnerability details I don't include words like "urgent" in my title very often, but I thought you might want to get onto this right away. An attacker can access the data source of any other customer on the BIME platform through the /cubemodels.json endpoint. This leaks, for example, the login...

Bime: Bime Unable to load Data Sources

The BIME unable to load the datasource, when user has created larger number of data source , and as a result it's throws error poppup and the enduser can't do any thing, the entire PAGE got broken, can't delete any datasources which leads entire BIME functionality broken This is Error Popup Messa...

Bime: Subdomain takeover due to unclaimed Amazon S3 bucket on a2.bime.io

I noticed BIME is primarily built on Amazon AWS, which spawned my interest. I started looking for DNS entries that were still pointing to S3 buckets that however no longer exist. It appears this was the case for a2.bime.io, which points to an Amazon S3 website bucket in the US East region. Steps ...

Bime: The JDBC driver used by the Vertica connector allows to create files on the backends

See title...

Bime: SSRF in the Connector Designer (REST and Elastic Search)

Server-Side Request Forgery SSRF in BIME connectors disclosed sensitive AWS metadata...

Bime: XXE in the Connector Designer

A XML External Entity XXE vulnerability allowed an attacker to read arbitrary files on the server...