German Authorities Issue Arrest Warrants for Three Suspected Chinese Spies

German authorities said they have issued arrest warrants against three citizens on suspicion of spying for China. The full names of the defendants were not disclosed by the Office of the Federal Prosecutor aka Generalbundesanwalt, but it includes Herwig F., Ina F., and Thomas R. "The suspects are...

procurementroundtable.org Cross Site Scripting vulnerability OBB-3904851

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

procurement.it Cross Site Scripting vulnerability OBB-3887941

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

healthcareprocurement.com Cross Site Scripting vulnerability OBB-3848700

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

Malicious code in optimize-procurement-and-inventory-with-ai (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 1d4a974419b1ab87d44f6d1c5cfd7fac97f037b476328f114d344113cf6bbd6f The OpenSSF Package Analysis project identified 'optimize-procurement-and-inventory-with-ai' @ 6.1.8 npm as malicious. It is considered maliciou...

Add Unique Asset Context with Custom Attributes in CSAM

There is no such thing as “too much context” when it comes to asset management. Continuous discovery and comprehensive, normalized asset data create the foundation for streamlined risk detection and response. The more reliable asset data a security team has, the better it can operationalize an...

Estonian National Charged in U.S. for Acquiring Electronics and Metasploit Pro for Russian Military

An Estonian national has been charged in the U.S. for purchasing U.S.-made electronics on behalf of the Russian government and military. The 45-year-old individual, Andrey Shevlyakov, was arrested on March 28, 2023, in Tallinn. He has been indicted with 18 counts of conspiracy and other charges. ...

SolarWinds and Market Incentives

In early 2021, IEEE Security and Privacy asked a number of board members for brief perspectives on the SolarWinds incident while it was still breaking news. This was my response. The penetration of government and corporate networks worldwide is the result of inadequate cyberdefenses across the...

ZOHO ManageEngine ServiceDesk Plus 跨站脚本漏洞

ZOHO ManageEngine ServiceDesk Plus SDP is the United States ZhuoHao ZOHO company's set of ITIL-based architecture of IT service management software. The software integrates Incident Management, Problem Management, Asset Management IT Project Management, Procurement and Contract Management modules...

Rapid7 Now Available Through Carahsoft’s NASPO ValuePoint

We are happy to announce that Rapid7’s solutions have been added to the NASPO ValuePoint Cloud Solutions contract held by Carahsoft Technology Corp. The addition of this contract enables Carahsoft and its reseller partners to provide Rapid7’s Insight platform to participating States, Local...

OSINT your OT suppliers

There is much talk about supply chain security and reviewing your suppliers for cyber security. But how much information do they intentionally and unintentionally leak about your organisation online? We see this particularly in the industrial controls sector as its cyber security maturity is...

SQL Injection Vulnerability in Nippon Steel's Procurement E-Commerce Platform

hereinafter referred to as Rizhao Iron & Steel Holding Group, whose main products include hot rolled coils, hot rolled sheets, cold formed sheets, pickled sheets, galvanized sheets, profiled steel, etc., is currently the world's very large-scale ESP product production, processing base, etc.. A SQ...

ZOHO ManageEngine ServiceDesk Plus Information Disclosure Vulnerability (CNVD-2022-29863)

ZOHO ManageEngine ServiceDesk Plus SDP is a set of ITIL-based IT service management software from ZOHO, USA. The software integrates incident management, issue management, asset management IT project management, procurement and contract management, and other functional modules.ZOHO ManageEngine...

Greenwashing or Legit?

I think we can all agree that sustainability is one of the most important topics that we will discuss this year. It's driving consumer habits, business practices, and investment decisions. And it’s a discussion that’s happening at every level of the business; from procurement all the way up to th...

ZOHO ManageEngine ServiceDesk Plus Licensing Issue Vulnerability

ZOHO ManageEngine ServiceDesk Plus SDP is a set of ITIL-based IT service management software from ZOHO. The software integrates incident management, issue management, asset management IT project management, procurement and contract management, etc. An authorization issue vulnerability exists in...

CISA Insights on Risk Considerations for Managed Service Provider Customers

CISA has released a new CISA Insights, Risk Considerations for Managed Service Provider Customers MSPs, which provides Managed Service Provider MSP customers a framework for reducing risk. This framework is designed for government and private sector organizations of all sizes, and it suggests...

Logic flaws and vulnerabilities in the government procurement transaction system of Hangzhou Pinming Information Technology Co.

Hangzhou Pinming Information Technology Co., Ltd. is a high-tech enterprise dedicated to building a domestic leading public resource transaction informationization field. A logic flaw vulnerability exists in the government procurement transaction system of Hangzhou Pinming Information Technology...

Unauthorized Access Vulnerability in QSI Purchase System PURCHASE

Purchase is an application for office purchasing. An unauthorized access vulnerability exists in Qixing Procurement System Purchase, which can be exploited by attackers to obtain sensitive information...

New US Executive Order on Cybersecurity

President Biden signed an executive order to improve government cybersecurity, setting new security standards for software sold to the federal government. For the first time, the United States will require all software purchased by the federal government to meet, within six months, a series of ne...

Oracle PeopleSoft Enterprise SCM eProcurement 输入验证错误漏洞

Oracle PeopleSoft Enterprise SCM eProcurement is an application from Oracle America, Inc. used for temporary user request items.Oracle PeopleSoft Enterprise SCM eProcurement is vulnerable to an input validation error that could be exploited by an attacker to update, insert, or delete accessible...