Security Bulletin: Multiple Oracle Database Server Security Vulnerabilities Affect IBM Emptoris Supplier Lifecycle Mgmt

Summary Multiple Oracle Database Server Security Vulnerabilities Affect IBM Emptoris Supplier Lifecycle Mgmt Vulnerability Details CVEID: CVE-2020-2734 DESCRIPTION: An unspecified vulnerability in Oracle Database Server related to the RDBMS/Optimizer component could allow an authenticated attacke...

Security Bulletin: Multiple DB2 Database Server Security Vulnerabilities Affect IBM Emptoris Supplier Lifecycle Mgmt

Summary Security Bulletin: Multiple DB2 Database Server Security Vulnerabilities Affect IBM Emptoris Supplier Lifecycle Mgmt Vulnerability Details CVEID: CVE-2020-4230 DESCRIPTION: IBM DB2 for Linux, UNIX and Windows includes DB2 Connect Server 11.1 and 11.5 is vulnerable to an escalation of...

Security Bulletin: Multiple Oracle Database Server Security Vulnerabilities Affect IBM Emptoris Supplier Lifecycle Mgmt

Summary Oracle Database Server Publicly disclosed vulnerability affects IBM Emptoris Supplier Lifecycle Mgmt. Vulnerability Details CVEID: CVE-2020-2527 DESCRIPTION: An unspecified vulnerability in Oracle Database Server related to the Core RDBMS component could allow an authenticated attacker to...

Security Bulletin: Multiple Oracle Database Server Security Vulnerabilities Affect IBM Emptoris Supplier Lifecycle Mgmt

Summary Oracle Database Server Publicly disclosed vulnerability affects IBM Emptoris Supplier Lifecycle Mgmt. Vulnerability Details CVEID: CVE-2019-2734 DESCRIPTION: An unspecified vulnerability in Oracle Database Server related to the Core RDBMS component could allow an authenticated attacker to...

SQL Injection Vulnerability in Supplier Inquiry System Co***.aspx Page

Shanghai Haidian Software Co., Ltd. is a provider of informatization solutions focusing on the pharmaceutical distribution industry. A SQL injection vulnerability exists in the Co.aspx page of the supplier query system, which can be exploited by an attacker to obtain sensitive information from th...

The vulnerability of the Supplier Change component in the Oracle PeopleSoft Enterprise SCM Purchasing application allows a perpetrator to gain unauthorized access to protected information.

The vulnerability of the Supplier Change component in the Oracle PeopleSoft Enterprise SCM Purchasing application is related to deficiencies in access control. Exploiting this vulnerability could allow a malicious actor, operating remotely, to gain unauthorized access to protected information usi...

Vendor Inquiry System of Shanghai Haidian Software Co.

Shanghai Haidian Software Co., Ltd. is a provider of informatization solutions focusing on the pharmaceutical distribution industry. A universal password login vulnerability exists in the supplier query system of Shanghai Haidian Software Co., Ltd. that can be exploited by attackers to obtain...

ABB Telephone Gateway TG/S and Busch-Jaeger Telefon-Gateway Authorization Issues Vulnerabilities

The ABB Telephone Gateway TG/S and the Busch-Jaeger 6186/11 Telefon-Gateway are both a telephone gateway product from ABB Switzerland. An authorization issue vulnerability exists in ABB Telephone Gateway TG/S version 3.2 and Busch-Jaeger Telefon-Gateway version 6186/11, which arises from a progra...

SQL Injection Vulnerability in Hospital Purchasing and Supply Collaboration Platform of Beijing Zhicheng Yuyuan Technology Co.

The hospital procurement and supply collaboration platform is a real-name procurement and supply collaboration service platform for medical institutions and supplier enterprises in the distribution chain of the pharmaceutical and equipment supply chain. There is a SQL injection vulnerability in t...

The vulnerability of the SAP Supplier Relationship Management procurement automation application, related to errors in the encoding of user-input data, allows a perpetrator to carry out cross-site scripting attacks.

The vulnerability of the SAP Supplier Relationship Management procurement automation application is related to errors in the encoding of user-input data. Exploiting this vulnerability allows a malicious actor to perform cross-site scripting attacks remotely...

SAP Supplier Relationship Management Cross-Site Scripting Vulnerability (CNVD-2020-04284)

SAP Supplier Relationship Management SRM is a supplier relationship management solution from SAP. The product automates purchasing and acquisition processes within an organization and between suppliers, and provides functions such as invoicing. A cross-site scripting vulnerability exists in SAP S...

Birth Certificate Data Laid Bare on the Web in Multiple States

A third-party government supplier has exposed hundreds of thousands of applications containing birth-certificate data. The trove of information is owned by a company that provides an online platform to state governments – including California, New York and Texas – that allows residents to request...

Why This New Cybergang is Heralding a New Age For BEC

A newly-uncovered business email compromise BEC cybergang, dubbed Silent Starling, has found success using a tricky technique to swindle funds from more than 500 organizations worldwide. The West African cybergang has been using a method that researchers with Agari – who discovered them in late...

CVE-2019-0361

SAP Supplier Relationship Management Master Data Management Catalog - SRMMDMCAT, before versions 3.73, 7.31, 7.32 does not sufficiently encode user-controlled inputs, resulting in Cross-Site Scripting XSS vulnerability...

Smart TV and then exposed vulnerabilities--Supra Smart Cloud TV vulnerability can cause the device to be hijacking-vulnerability warning-the black bar safety net

An attacker can take advantage of a smart TV vulnerability, the attack connected to the home router to get remote access. Supra smart TV in a not patched the vulnerability so that the same Wi-Fi network, the attacker can hijack the TV device, play their own content, such as a fake emergency...

Sales ERP 8.1 - Multiple SQL Injection

=========================================================================================== Exploit Title: SalesERP v.8.1 SQL Inj. Dork: N/A Date: 13-05-2019 Exploit Author: Mehmet EMIROGLU Vendor Homepage: https://codecanyon.net/category/php-scripts?term=sales%20erp Version: v8.1 Category: Webap...

Security Bulletin: Detailed Error Messages are Revealed in IBM Emptoris Supplier Lifecycle Management

Summary IBM Emptoris Supplier Lifecycle Management product reveals detailed error messages in certain features. Vulnerability Details CVEID: CVE-2018-1942 DESCRIPTION: IBM Emptoris Supplier Lifecycle Management could disclose highly sensitive information in detailed error messages. CVSS Base Scor...

Security Bulletin: Multiple Vulnerabilities in IBM Java SDK Affect IBM Emptoris Strategic Supply Management Suite of Products and IBM Emptoris Services Procurement

Summary The IBM Emptoris Strategic Supply Management suite of products are affected by multiple security vulnerabilities that exist in the IBM SDK Java Technology Edition that is shipped with IBM WebSphere Application Server. The security bulletin includes issues that were disclosed as part of th...

Security Bulletins for Emptoris Supplier Lifecycle Management

Question Security Bulletins for Emptoris Supplier Lifecycle Management Answer This article tracks all Security Bulletins for Emptoris Supplier Lifecycle Management. IBM's Product Security Incident Response Team PSIRT follows the NIST guidelines for determining the severity rating of the reported...

Exposure of Sensitive information in authentikat-jwt

A time-sensitive equality check on the JWT signature in the JsonWebToken.validate method in main/scala/authentikat/jwt/JsonWebToken.scala in authentikat-jwt aka com.jason-goodwin/authentikat-jwt version 0.4.5 and earlier allows the supplier of a JWT token to guess bit after bit of the signature b...