Unisys Data Exchange Management Studio 跨站脚本漏洞

Unisys Data Exchange Management Studio is a data exchange component from the American company Unisys. A cross-site scripting vulnerability exists in Unisys Data Exchange Management Studio version 5.0.34 and prior versions, which originates from input that is not cleared from HTML document fields,...

Swiss Army knife For Information Security: What is Comprehensive Protection?

Written by Sergey Ozhegov, CEO of SearchInform In the early days of information security, we used to rely on antivirus and firewall in our arsenal. Once I even “caught” a leak with the help of the firewall logs: I noticed an atypically large data upload and found out that the user was uploading...

The vulnerability in Mozilla Firefox, Firefox ESR, and the email client Thunderbird arises from incorrect handling of zero bytes or NULL values during data exchange. This allows an attacker to exploit their privileges or cause service failures.

The vulnerabilities of Mozilla Firefox, Firefox ESR, and the email client Thunderbird are related to incorrect handling of zero bytes or NULL values during data exchange. Exploiting these vulnerabilities can allow an attacker to increase their privileges or cause service failures...

CVE-2020-27148

The TIBCO EBX Add-on for Oracle Hyperion EPM, TIBCO EBX Data Exchange Add-on, and TIBCO EBX Insight Add-on components of TIBCO Software Inc.'s TIBCO EBX Add-ons contain a vulnerability that theoretically allows a low privileged attacker with network access to execute an XML External Entity XXE...

Kepware Linkmaster Permission License and Access Control Issues Vulnerability

Kepware Linkmaster is the U.S. Kepware company's a Windows platform for industrial applications to support the exchange of data between OPC DA server software. The software provides a method of linking data between OPC servers, thus becoming a common bridge for OPC systems, and OPC servers act as...

HCL Notes 安全漏洞

HCL Notes is an enterprise email client. A buffer overflow vulnerability exists in DXL in HCL Notes 9, 10, and 11. The vulnerability stems from improper validation of user input. An attacker could exploit the vulnerability to cause Notes to crash or execute attacker-controlled code on the server...

RegTech explained: a crucial toolset for the financial industry

Every organization in the financial industry needs to meet certain regulatory obligations, even if it’s just filing a tax return or submitting an annual report. In certain industries, such as financial services, theyve added their own additional sets of rules that must be adhered to. For example,...

Wave-Share - Serverless, Peer-To-Peer, Local File Sharing Through Sound

A proof-of-concept for WebRTC signaling using sound. Works with all devices that have microphone + speakers. Runs in the browser. Nearby devices negotiate the WebRTC connection by exchanging the necessary Session Description Protocol SDP data via a sequence of audio tones. Upon successful...

CVE-2020-7314

Privilege Escalation Vulnerability in the installer in McAfee Data Exchange Layer DXL Client for Mac shipped with McAfee Agent MA for Mac prior to MA 5.6.6 allows local users to run commands as root via incorrectly applied permissions on temporary files...

CVE-2020-7314

Privilege Escalation Vulnerability in the installer in McAfee Data Exchange Layer DXL Client for Mac shipped with McAfee Agent MA for Mac prior to MA 5.6.6 allows local users to run commands as root via incorrectly applied permissions on temporary files...

New Web-Based Credit Card Stealer Uses Telegram Messenger to Exfiltrate Data

Cybercriminal groups are constantly evolving to find new ways to pilfer financial information, and the latest trick in their arsenal is to leverage the messaging app Telegram to their benefit. In what's a new tactic adopted by Magecart groups, the encrypted messaging service is being used to send...

The vulnerability of the s390/s390x memory controller component in Linux operating systems allows attackers to disclose sensitive information that should be protected.

The vulnerability of the s390/s390x memory controller component in Linux operating systems is related to incorrect handling of zero bytes or Nul characters during data exchange. Exploiting this vulnerability can allow an attacker to disclose sensitive information that is protected by security...

Exploit for Improper Restriction of Operations within the Bounds of a Memory Buffer in Microsoft

PoC exploit for CVE-2017-11826, a Microsoft Office Word vulnerability allowing arbitrary code execution through DDE injection. The exploit targets Microsoft Office Word, specifically the vulnerability class of remote code execution RCE via DDE Dynamic Data Exchange injection. The probable entry...

Chinese APT group targets India and Hong Kong using new variant of MgBot malware

This blog post was authored by Hossein Jazi and Jérôme Segura On July 2, we found an archive file with an embedded document pretending to be from the government of India. This file used template injection to drop a malicious template which loaded a variant of Cobalt Strike. One day later, the sam...

OpenMRS Input Validation Error Vulnerability

OpenMRS is an open source electronic medical record system from OpenMRS, Inc. in the United States. OpenMRS suffers from an input validation error vulnerability that stems from the export function of the data exchange module not properly redirecting to the login page. An attacker could exploit th...

OpenMRS Input Validation Error Vulnerability (CNVD-2020-26250)

OpenMRS is an open source electronic medical record system from OpenMRS, Inc. in the United States. OpenMRS suffers from an input validation error vulnerability that stems from the import function of the data exchange module not properly redirecting to the login page. An attacker could exploit th...

CVE-2020-5733

In OpenMRS 2.9 and prior, the export functionality of the Data Exchange Module does not properly redirect to a login page when an unauthenticated user attempts to access it. This allows the export of potentially sensitive information...

CVE-2020-5732

In OpenMRS 2.9 and prior, he import functionality of the Data Exchange Module does not properly redirect to a login page when an unauthenticated user attempts to access it. This allows unauthenticated users to use a feature typically restricted to administrators...

CVE-2020-5732

In OpenMRS 2.9 and prior, he import functionality of the Data Exchange Module does not properly redirect to a login page when an unauthenticated user attempts to access it. This allows unauthenticated users to use a feature typically restricted to administrators...

CVE-2020-5733

In OpenMRS 2.9 and prior, the export functionality of the Data Exchange Module does not properly redirect to a login page when an unauthenticated user attempts to access it. This allows the export of potentially sensitive information...