CVE-2018-19436

An issue was discovered in the Manufacturing component in webERP 4.15. CollectiveWorkOrderCost.php has Blind SQL Injection via the SearchParts parameter...

CVE-2018-19436

CVE-2018-19436 affects webERP v4.15, specifically the Manufacturing component. The vulnerability is a Blind SQL Injection in CollectiveWorkOrderCost.php exposed via the SearchParts parameter. This is documented across multiple feeds (NVD entry and mirrored records) and is described as a SQL injec...

webERP Manufacturing Component SQL Injection Vulnerability

webERP is an open source inventory and financial management system ERP system. The system supports inventory management , rights role management , order management and financial management , etc. Manufacturing is one of the components . webERP 4.15 version of the Manufacturing component of the...

Siemens SIMATIC IT LMS, SIMATIC IT Production Suite and SIMATIC IT UA Discrete Manufacturing License Issue Vulnerabilities

Siemens SIMATIC IT LMS, SIMATIC IT Production Suite, and SIMATIC IT UA Discrete Manufacturing are products of Siemens, Germany.Siemens SIMATIC IT LMS is a line monitoring system for overall equipment effectiveness OEE. Siemens SIMATIC IT LMS is a line monitoring system for Overall Equipment...

ICSA-18-317-07 Siemens SIMATIC IT Production Suite

1. EXECUTIVE SUMMARY CVSS v3 7.7 ATTENTION: Exploitable remotely Vendor: Siemens Equipment: SIMATIC IT Production Suite Vulnerability: Improper Authentication 2. RISK EVALUATION Successful exploitation of this vulnerability could allow an attacker to compromise confidentiality, integrity and...

products.mcguiremfg.com XSS vulnerability

Open Bug Bounty ID: OBB-687739 Description| Value ---|--- Affected Website:| products.mcguiremfg.com Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| hidden until disclosure Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:|...

Fuji Electric Energy Savings Estimator

1. EXECUTIVE SUMMARY CVSS v3 7.3 Vendor: Fuji Electric Equipment: Fuji Electric Energy Savings Estimator Vulnerability: Uncontrolled Search Path Element 2. RISK EVALUATION Successful exploitation of this vulnerability may allow an attacker to load a malicious DLL and execute code on the affected...

Honeywell Mobile Computers with Android Operating Systems

1. EXECUTIVE SUMMARY CVSS v3 7.6 ATTENTION: Exploitable remotely Vendor: Honeywell Equipment: Mobile Computers Vulnerability: Improper Privilege Management 2. RISK EVALUATION A vulnerability in a system service on CT60, CN80, CT40, CK75, CN75, CT50, D75e, CN51, and EDA series mobile computers...

Back to Basics: Why We Need to Encourage More Secure IoT Development

The Internet of Things IoT is radically reshaping the way we live and work. Before our very eyes, organizations are becoming more agile, efficient and cost effective to run, all while consumers marvel at the wonders of the smart home, fitness trackers and connected cars. There’s just one major...

Threatlist: Manufacturing, a Top Target for Espionage

When it comes to cyberattack-related reconnaissance and lateral movement activity, the manufacturing industry exhibits higher than normal rates. That’s according to Vectra’s 2018 Spotlight Report on Manufacturing, which crunched data from more than 4 million devices and workloads from customer...

TSMC Chip Maker Blames WannaCry Malware for Production Halt

Taiwan Semiconductor Manufacturing Company TSMC—the world's largest makers of semiconductors and processors—was forced to shut down several of its chip-fabrication factories over the weekend after being hit by a computer virus. Now, it turns out that the computer virus outbreak at Taiwan chipmake...

Johnson Controls Metasys and BCPro

1. EXECUTIVE SUMMARY CVSS v3 4.3 ATTENTION : Exploitable on an adjacent network/low skill level to exploit Vendor : Johnson Controls Equipment : Metasys and BCPro Vulnerability : Information Exposure Through an Error Message 2. RISK EVALUATION Successful exploitation of this vulnerability could...

Don't let your factory plant become the next cybersecurity victim

In 2014, a smart refrigerator had been caught red-handed for spawning over 750,000 spam emails after hijacked by a botnet attack. It is the first documented attack worldwide for Internet of Things to have fallen prey to hackersi. A more recent case in the US concerns an internet connected...

womeninmanufacturing.org XSS vulnerability

Open Bug Bounty ID: OBB-648940 Description| Value ---|--- Affected Website:| womeninmanufacturing.org Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

Security Bulletin: IBM Integration Bus Manufacturing pack is affected by Cross-site scripting

Summary IBM Integration Bus Manufacturing pack is vulnerable to cross-site scripting XSS Vulnerability Details CVE-ID: CVE-2014-4820 CVSS Base Score: 4.3 CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/95457 for the current score CVSS Environmental Score: Undefined...

Yokogawa STARDOM Controllers (Update A)

1. EXECUTIVE SUMMARY CVSS v3 9.8 ATTENTION: Exploitable remotely/low skill level to exploit Vendor: Yokogawa Equipment: STARDOM Controllers --------- Begin Update A Part 1 of 5 -------- Vulnerabilities: Use of Hard-coded Credentials, Session Fixation, Insufficiently Protected Credentials,...

GE PACSystems CPE305/310, CPE330, CPE400, RSTi-EP CPE 100, CPU320/CRU320, RXi

1. EXECUTIVE SUMMARY CVSS v3 7.5 ATTENTION : Exploitable remotely/low skill level to exploit Vendor : GE Equipment : PACSystems CPE305/310, CPE330, CPE400, RSTi-EP CPE 100, CPU320/CRU320, RXi Vulnerability : Improper Input Validation 2. RISK EVALUATION Successful exploitation of this...

Vega Stealer Malware Takes Aim at Chrome, Firefox

A malware dubbed Vega Stealer has been uncovered, looking to make off with saved credentials and credit-card information in the Chrome and Firefox browsers. While it’s a simple payload for now, researchers said it has the ability to evolve into something more concerning in the future. Proofpoint,...

Supply-Chain Security

Earlier this month, the Pentagon stopped selling phones made by the Chinese companies ZTE and Huawei on military bases because they might be used to spy on their users. It's a legitimate fear, and perhaps a prudent action. But it's just one instance of the much larger issue of securing our supply...

WECON Technology Co., Ltd. LeviStudio HMI Editor and PI Studio HMI Project Programmer

1. EXECUTIVE SUMMARY CVSS v3 5.9 ATTENTION : Low skill level to exploit. Vendor : WECON Technology Co., Ltd. WECON Equipment : LeviStudio HMI Editor, and PI Studio HMI Project Programmer Vulnerabilities : Stack-based Buffer Overflow 2. RISK EVALUATION Successful exploitation of these...