PPE, COVID-19 Medical Supplies Targeted by BEC Scams

Much has been publicized about the shortage of personal protective equipment PPE and other supplies for healthcare facilities in the United States during the COVID-19 pandemic. Now, the FBI is warning that threat actors are taking advantage of efforts to procure PPE and critical equipment such as...

SQL Injection Vulnerability in Hospital Purchasing and Supply Collaboration Platform of Beijing Zhicheng Yuyuan Technology Co.

The hospital procurement and supply collaboration platform is a real-name procurement and supply collaboration service platform for medical institutions and supplier enterprises in the distribution chain of the pharmaceutical and equipment supply chain. There is a SQL injection vulnerability in t...

The vulnerability of the SAP Supplier Relationship Management procurement automation application, related to errors in the encoding of user-input data, allows a perpetrator to carry out cross-site scripting attacks.

The vulnerability of the SAP Supplier Relationship Management procurement automation application is related to errors in the encoding of user-input data. Exploiting this vulnerability allows a malicious actor to perform cross-site scripting attacks remotely...

SYS.2.2.2.A4

Ziel des Bausteins SYS.2.2.2 ist der Schutz von Informationen, die durch und auf Windows 8.1-Clients verarbeiten werden. Die Standard-Anforderung Copyright C 2019 Greenbone Networks GmbH SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can redistribute it and/or modify...

FedRAMP and Its Applicability to ISVs Hosted on FedRAMP-Authorized IaaS

Independent Software Vendors ISVs often ask Coalfire about the FedRAMP compliance framework and how it applies to them. They hear that all software procured by the U.S. federal government must be FedRAMP authorized, and they come to the experts to help them navigate the process. The good news is...

Document Uploading Vulnerability in Beijing Yizaitong E-Procurement System

Beijing Yizaitong Information Technology Co., Ltd. has been committed to enterprise procurement information technology, procurement consulting field, oriented to procurement management, group intensive procurement management, lean supply chain, strategic procurement, project supply chain,...

SQL Injection Vulnerability in Beijing Yizaitong E-procurement System

Beijing Yizaitong Information Technology Co., Ltd. has been committed to enterprise procurement information technology, procurement consulting field, oriented to procurement management, group intensive procurement management, lean supply chain, strategic procurement, project supply chain,...

Beijing Yizaitong E-procurement System Has Information Leakage Vulnerabilities

Beijing Yizaitong Information Technology Co., Ltd. has been committed to enterprise procurement information technology, procurement consulting field, oriented to procurement management, group intensive procurement management, lean supply chain, strategic procurement, project supply chain,...

Tackling the Collaboration Conundrum

It’s 8 a.m. and you’ve just polished off a full cup of dark-roast coffee to jump-start your day. After booting up your PC, you instinctively open up Outlook, along with Slack or Teams or TeamViewer. While chatting with a co-worker, you recall that you need to send administrative credentials to he...

Sn1per v7.0 - Automated Pentest Framework For Offensive Security Experts

Sn1per Community Edition is an automated scanner that can be used during a penetration test to enumerate and scan for vulnerabilities. Sn1per Professional is Xero Security's premium reporting addon for Professional Penetration Testers, Bug Bounty Researchers and Corporate Security teams to manage...

Unspecified Vulnerability in Oracle PeopleSoft Products (CNVD-2019-29277)

Oracle PeopleSoft Products is a suite of enterprise human capital management solutions from Oracle that provides human capital management, financial management, supplier relationship management, etc. PeopleSoft Enterprise SCM eProcurement is one of the online procurement components. PeopleSoft...

CVE-2019-2519

Vulnerability in the PeopleSoft Enterprise SCM eProcurement component of Oracle PeopleSoft Products subcomponent: Manage Requisition Status. The supported version that is affected is 9.2. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise...

Security Bulletins for Emptoris Services Procurement

Question Security Bulletins for Emptoris Services Procurement Answer This article tracks all Security Bulletins for Emptoris Services Procurement. IBM's Product Security Incident Response Team PSIRT follows the NIST guidelines for determining the severity rating of the reported vulnerability - se...

SQL Injection Vulnerability in Material Management System of Sunshine Printing Website

Sunshine Printing is an enterprise non-core affairs procurement platform, providing one-stop procurement services for customized products required in office, marketing, packaging and logistics, business gifts and other scenarios for enterprise users. SQL injection exists in the material managemen...

Hidden Cameras in Streetlights

Both the US Drug Enforcement Administration DEA and Immigration and Customs Enforcement ICE are hiding surveillance cameras in streetlights. According to government procurement data, the DEA has paid a Houston, Texas company called Cowboy Streetlight Concealments LLC roughly $22,000 since June 20...

SYS.2.2.3.A2

Ziel des Bausteins SYS.2.2.3 ist der Schutz von Informationen, die durch und auf Windows 10-Clients verarbeiten werden. Die Basis-Anforderung SPDX-FileCopyrightText: 2018 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right...

Threat Outbreak Alert RuleID33340: Email Messages Distributing Malicious Software on August 13, 2018

Medium Alert ID: 58734 First Published: 2018 August 15 12:27 GMT Version: 1 Summary Cisco Security has detected significant activity related to spam email messages distributing malicious software. Email messages that are related to this threat RuleID33340 may contain the following files: Name |...

Security Bulletin: Vulnerability in IBM WebSphere Application Server Affects IBM Emptoris Sourcing, IBM Emptoris Contract Management, IBM Emptoris Spend Analysis, IBM Emptoris Program Management and IBM Emptoris Service Procurement (CVE-2018-1621)

Summary The IBM Emptoris Sourcing, IBM Emptoris Contract Management, IBM Emptoris Spend Analysis, IBM Emptoris Program Management and IBM Emptoris Service Procurement products are affected by a vulnerability that exists in the IBM WebSphere Application Server. The security bulletin includes issue...

Security Bulletin: Vulnerability in IBM WebSphere Application Server Affects IBM Emptoris Sourcing, IBM Emptoris Contract Management, IBM Emptoris Spend Analysis, IBM Emptoris Program Management and IBM Emptoris Service Procurement (CVE-2018-1614)

Summary The IBM Emptoris Sourcing, IBM Emptoris Contract Management, IBM Emptoris Spend Analysis, IBM Emptoris Program Management and IBM Emptoris Service Procurement products are affected by a vulnerability that exists in the IBM WebSphere Application Server. The security bulletin includes issue...

Security Bulletin: Vulnerability in IBM WebSphere Application Server Affects IBM Emptoris Sourcing, IBM Emptoris Contract Management, IBM Emptoris Spend Analysis, IBM Emptoris Program Management and IBM Emptoris Service Procurement (CVE-2017-1741)

Summary The IBM Emptoris Sourcing, IBM Emptoris Contract Management, IBM Emptoris Spend Analysis, IBM Emptoris Program Management and IBM Emptoris Service Procurement products are affected by a vulnerability that exists in the IBM WebSphere Application Server. The security bulletin includes issue...