CVE-2020-2936

CVE-2020-2936 affects Oracle Financial Services Balance Sheet Planning (Oracle Financial Services Applications), component: User Interface, with affected version 8.0.8. The vulnerability is described as easily exploitable: a low-privileged attacker with network access via HTTP can compromise data...

CVE-2020-2936

Vulnerability in the Oracle Financial Services Balance Sheet Planning product of Oracle Financial Services Applications component: User Interface. The supported version that is affected is 8.0.8. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to...

CVE-2020-2936

Vulnerability in the Oracle Financial Services Balance Sheet Planning product of Oracle Financial Services Applications component: User Interface. The supported version that is affected is 8.0.8. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to...

Unspecified Vulnerability in SAP S/4 HANA

SAP S/4HANA is a financial product ledger from SAP in Germany. SAP S/4 HANA has a security vulnerability that can be exploited by an attacker to cause the system to slow down...

Huainan Yintai Software Technology Co., Ltd. billing master there are SQL injection vulnerabilities

Billing Master is open source customizable real estate agent ERP management system. Huainan Yintai Software Technology Co., Ltd Billing Master suffers from a SQL injection vulnerability, which can be exploited by attackers to obtain sensitive information from the database...

webERP SQL Injection Vulnerability (CNVD-2020-20677)

webERP is an open source inventory and financial management system ERP system. The system supports inventory management , rights role management , order management and financial management . A SQL injection vulnerability exists in webERP 4.15. The vulnerability stems from a lack of validation of...

IBM TM1 / Planning Analytics - Unauthenticated Remote Code Execution Exploit (2)

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'openssl' class MetasploitModule "IBM TM1 / Planning Analytics Unauthenticated Remote Code Execution", 'Description' = %q This module exploits a vulnerability in...

IBM TM1 / Planning Analytics - Unauthenticated Remote Code Execution (Metasploit)

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'openssl' class MetasploitModule "IBM TM1 / Planning Analytics Unauthenticated Remote Code Execution", 'Description' = %q This module exploits a vulnerability in...

IBM Cognos TM1 / IBM Planning Analytics Server Configuration Overwrite / Code Execution Exploit

IBM Cognos TM1 Server / Planning Analytics Server TM1 suffers from a configuration overwrite vulnerability that can be leveraged to achieve code execution as SYSTEM via TM1 scripting. Extensive research is included in this advisory as well as the Metasploit module. IBM PA / TM1, dating back to...

IBM Cognos TM1 / IBM Planning Analytics Server Configuration Overwrite / Code Execution

Hi, Here's a fun one I have been working on for some time. tl;dr IBM PA / TM1, dating back to 2014, maybe 2009 is vulnerable to a unauthenticated configuration overwrite; this is abused to "fake authenticate" to it, and finally execute code as root / SYSTEM using TM1 scripting. Advisory below,...

Coronavirus impacts security conferences and events: check your schedule

With coronavirus starting to take hold globally, international travel restrictions are kicking in and more workplaces are advising to work from home whenever possible. When self-isolation is a potential solution, public gatherings are increasingly looking like a terrible idea. Events are becoming...

The Ultimate Security Budget Excel Template

Sound security budget planning and execution are essential for the CIO’s/CISO’s success. Now, for the first time, The Ultimate Security Budget Plan & Track Excel template download here provides security executives a clear and intuitive tool to keep track of planned vs. actual spend, ensuring that...

SAP ERP and SAP S/4 HANA Authorization Issues Vulnerabilities

SAP ERP and SAP S/4 HANA are both integrated intelligent ERP systems. ERP is an enterprise resource management system that integrates enterprise management concepts, business processes, basic data, human and material resources, computer hardware and software. An authorization issue vulnerability...

Apache OFBiz Cross-Site Scripting Vulnerability (CNVD-2020-16521)

Apache OFBiz is the United States Apache Apache Software Foundation of a set of enterprise resource planning ERP system. The system provides a set of Java-based Web application components and tools. A cross-site scripting vulnerability exists in Apache OFBiz. The vulnerability stems from the WEB...

IT Operations and Security: It’s Time to Build Something Better Together

Having been in the industry for longer than I care admit, I have seen the growth pre and post public internet. With that growth, there have been many changes with how organizations address the balance of IT Operations and Security, where tension still exists. IT Ops must keep the business running...

The Game Changing Role of Performance Testing (Part 1)

In two previous blogs, VMware Carbon Black software engineers discussed how important it was to maintain a balance of latency, scale, and cost as they built out and enhanced the company’s reputation services. They also provided some insights into the challenges they encountered with various...

Security Bulletin: Multiple vulnerabilities in IBM Java Runtime affect IBM Planning Analytics.

Summary There are multiple vulnerabilities in IBM® Runtime Environment Java™ Version 7 used by IBM Planning Analytics. These issues were disclosed as part of the IBM Java SDK updates in April 2017 and July 2017. Vulnerability Details CVEID: CVE-2017-3511 DESCRIPTION: An unspecified vulnerability...

Security Bulletin: Multiple vulnerabilities in IBM Java Runtime affect IBM Planning Analytics.

Summary This Security Bulletin addresses multiple vulnerabilities that have been remediated in IBM Planning Analytics 2.0.6. There are multiple vulnerabilities in IBM® Runtime Environment Java™ used by IBM Planning Analytics 2.0.5 and lower. IBM Planning Analytics 2.0.6 has addressed the applicab...

Security Bulletin: Multiple vulnerabilities exist in IBM Planning Analytics Local

Summary Vulnerabilities found in several components have been addressed in IBM Planning Analytics 2.0.5. There are vulnerabilities in IBM® Runtime Environment Java™ Version 7. These issues were disclosed as part of the IBM Java SDK updates in October 2017. Multiple vulnerabilities affect componen...

SOPlanning Cross-Site Request Forgery Vulnerability (CNVD-2020-10484)

SOPlanning is an online planning tool for efficiently organizing projects and tasks. SOPlanning 1.45 suffers from a cross-site request forgery vulnerability. An attacker can exploit this vulnerability to arbitrarily change the administrator password via process/xajaxserver.php...