[Security Nation] Jonathan Cran on demystifying startup funding for security companies

!\Security Nation\ Jonathan Cran on demystifying startup funding for security companieshttps://blog.rapid7.com/content/images/2021/07/securitynationlogo.jpg In this episode of Security Nation, we’re joined by Jonathan Cran. We wade into uncharted territory with Jonathan, as he claims the title of...

County-level flash flood monitoring and early warning system of Suzhou Mengtu Geographic Information System Co., Ltd. suffers from unauthorized access vulnerability

Suzhou Mengtu Geographic Information System Limited Liability Company is a high-tech company specializing in the research and development of geographic information system platform and the development of industry application software. Suzhou Mengtu Geographic Information System Limited Liability...

File upload vulnerability in county-level flash flood monitoring and early warning system of Suzhou Mengtu Geographic Information System Co., Ltd (CNVD-2021-51387)

Suzhou Mengtu Geographic Information System Limited Liability Company is a high-tech company specializing in the research and development of geographic information system platform and the development of industry application software. Suzhou Mengtu Geographic Information System Limited Liability...

SQL injection vulnerability in county-level flash flood monitoring and early warning system of Suzhou Mengtu Geographic Information System Co.

Suzhou Mengtu Geographic Information System Limited Liability Company is a high-tech company specializing in the research and development of geographic information system platform and the development of industry application software. Suzhou Mengtu Geographic Information System Limited Liability...

Directory traversal vulnerability in county-level flash flood monitoring and early warning system of Suzhou Mengtu Geographic Information System Co.

Suzhou Mengtu Geographic Information System Limited Liability Company is a high-tech company specializing in the research and development of geographic information system platform and the development of industry application software. Suzhou Mengtu Geographic Information System Limited Liability...

NinjaRMM 访问控制错误漏洞

NinjaRMM is a remote monitoring and management software from NinjaRMM USA. Improve business efficiency by combining monitoring, alerting, patching, antivirus, backup and IT automation all in a single management platform. An Access Control Error vulnerability exists in NinjaRMM, which arises from...

Top 8 Database Security Best Practices

There is a large body of knowledge on what activities are required in order to secure databases and in order to comply with regulations and requirements. We’ve gathered the top 8 best practices for ensuring database security. Databases are arguably the most important and, unfortunately, also the...

Logic Flaw Vulnerability in Dahua DSS Configuration System, In-vehicle Surveillance Platform

Zhejiang Dahua Technology Co., Ltd. is the world's leading video-based intelligent IOT solution provider and operation service provider. A logic flaw vulnerability exists in the Dahua DSS configuration system and vehicle monitoring platform, which can be exploited by attackers to compromise the...

Shijiazhuang Hejia Technology Co., Ltd. dynamic ring monitoring system has information leakage vulnerability

Shijiazhuang Hejia Technology Co., Ltd. is a high-tech enterprise specializing in the development and application of computer room environment and power equipment monitoring system products. Shijiazhuang Hejia Technology Co., Ltd. dynamic ring monitoring system information leakage vulnerability,...

Weak Password Vulnerability in Dynamic Ring Monitoring System of Shijiazhuang Hejia Technology Co.

Shijiazhuang Hejia Technology Co., Ltd. is a high-tech enterprise specializing in the development and application of computer room environment and power equipment monitoring system products. Shijiazhuang Hejia Technology Co., Ltd. dynamic ring monitoring system has a weak password vulnerability,...

Compliance When Migrating to the Cloud: SQL Server Running on Azure vs. On- Premise

In the age of the data era, where data storage is increasing at an exponential rate and access to information is getting easier and faster, data security is a major concern. There are many cases where we can’t prevent people from accessing data, but we can track and investigate suspicious...

CISA-FBI Guidance for MSPs and their Customers Affected by the Kaseya VSA Supply-Chain Ransomware Attack

CISA and the Federal Bureau of Investigation FBI continue to respond to the recent supply-chain ransomware attack leveraging a vulnerability in Kaseya VSA software against multiple managed service providers MSPs and their customers. CISA and FBI strongly urge affected MSPs and their customers to...

Pandora FMS Information Disclosure Vulnerability

Pandora FMS is a monitoring system from Spanish company Artica. The system monitors networks, servers, virtual infrastructures, applications, etc. in a visual way. An information disclosure vulnerability exists in the File Manager component of Pandora FMS 754 and earlier versions. An attacker cou...

Information Disclosure Vulnerability in Kyan Network Monitoring Appliance (CNVD-2021-49589)

Kyan is a network monitoring device. An information disclosure vulnerability exists in the Kyan network monitoring device, which can be exploited by attackers to obtain sensitive information...

Malicious owner can arbitrarily change fee to any % value

Handle 0xRajeev Vulnerability details Impact Tracer protocol like any other allows market creators to charge fees for trades. However, a malicious/greedy owner can arbitrarily change fee to any % value and without an event to observe this change or a timelock to react, there is no easy way for...

SQL Injection Vulnerability in WDECP-IC IC Card Prepaid Monitoring Platform

WDECP-IC IC card prepaid monitoring platform is a management platform developed by the application of IC card technology in the field of intelligent water conservancy. WDECP-IC IC card prepaid monitoring platform has a SQL injection vulnerability, which can be exploited by attackers to obtain...

Unauthorized Access Vulnerability in the Flash Flood Monitoring and Early Warning Distribution System of Fujian SiChuang Software Co. Ltd (CNVD-2021-50614)

Fujian SiChuang Software Co., Ltd. is a technology-based enterprise dedicated to the cause of disaster prevention and mitigation in China. An unauthorized access vulnerability exists in the Flash Flood Monitoring and Early Warning Distribution System of Fujian Sichuang Software Co. Ltd, which can...

Unauthorized Access Vulnerability in the Flash Flood Monitoring and Early Warning Distribution System of Fujian SiChuang Software Co. Ltd (CNVD-2021-50615)

Fujian SiChuang Software Co., Ltd. is a technology-based enterprise dedicated to the cause of disaster prevention and mitigation in China. An unauthorized access vulnerability exists in the Flash Flood Monitoring and Early Warning Distribution System of Fujian Sichuang Software Co. Ltd, which can...

Apache Airflow Cross-Site Scripting Vulnerability (CNVD-2022-09242)

Apache Airflow is the United States Apache Apache Foundation's set of open source platform for creating, managing and monitoring workflow. The platform is scalable and dynamic monitoring and other characteristics. A cross-site scripting vulnerability exists in Apache Airflow. The vulnerability...

CVE-2021-32718

RabbitMQ is a multi-protocol messaging broker. In rabbitmq-server prior to version 3.8.17, a new user being added via management UI could lead to the user's bane being rendered in a confirmation message without proper tag sanitization, potentially allowing for JavaScript code execution in the...