Arbitrary File Download Vulnerability in Yonghong Z-Suite of Beijing Yonghong Business Intelligence Technology Co.

Yonghong Z-Suite is a one-stop big data analytics platform. Yonghong Z-Suite has an arbitrary file download vulnerability that can be exploited by attackers to obtain sensitive information...

Magic Security Dust

Adam Shostack is selling magic security dust. Its about time someone is commercializing this essential technology...

SQL Injection Vulnerability in Crypto M6 Integration Management Platform System of Xiamen Crypto Information Technology Co.

Ltd. is an innovative high-tech enterprise dedicated to the research and development of information integration management system. Xiamen FSP Information Technology Co., Ltd. FSP M6 integration management platform system has a SQL injection vulnerability, which can be exploited by attackers to...

Information Leakage Vulnerability in Data Leakage Protection (DLP) System of Beijing Yisaitong Technology Development Co.

Beijing Yisetong Technology Development Co., Ltd. is a domestic data security, network security and security services provider of three major business. There is an information leakage vulnerability in the Data Leakage Protection DLP system of Beijing Yisetong Technology Development Co., Ltd. that...

CVE-2024-29667

SQL Injection vulnerability in Tongtianxing Technology Co., Ltd CMSV6 v.7.31.0.2 through v.7.31.0.3 allows a remote attacker to escalate privileges and obtain sensitive information via the ids parameter...

CVE-2024-29667

SQL Injection vulnerability in Tongtianxing Technology Co., Ltd CMSV6 v.7.31.0.2 through v.7.31.0.3 allows a remote attacker to escalate privileges and obtain sensitive information via the ids parameter...

CVE-2024-29667

Affected: Tongtianxing CMSV6 v7.31.0.2–7.31.0.3. Issue: SQL injection via the ids parameter, enabling remote privilege escalation and access to sensitive data. Root cause: improper input handling allowing SQL injection. Impact: high (privilege escalation, data disclosure). Remediation: no patch/v...

PT-2024-22956 · Tongtianxing Technology Co. · Cmsv6

Name of the Vulnerable Software and Affected Versions: Tongtianxing Technology Co., Ltd CMSV6 versions 7.31.0.2 through 7.31.0.3 Description: The issue allows a remote attacker to escalate privileges and obtain sensitive information via the ids parameter. This is a SQL Injection vulnerability...

CVE-2024-29667

SQL Injection vulnerability in Tongtianxing Technology Co., Ltd CMSV6 v.7.31.0.2 through v.7.31.0.3 allows a remote attacker to escalate privileges and obtain sensitive information via the ids parameter...

CVE-2024-3039

A vulnerability classified as critical has been found in Shanghai Brad Technology BladeX 3.4.0. Affected is an unknown function of the file /api/blade-user/export-user of the component API. The manipulation with the input updatexml1,concat0x3f,md5123456,0x3f,1=1 leads to sql injection. It is...

CVE-2024-3039

Affected software: Shanghai Brad Technology BladeX 3.4.0. Vulnerable component: API endpoint /api/blade-user/export-user. Root cause: SQL injection via input manipulation using updatexml(1,concat(0x3f,md5(123456),0x3f),1)=1). Impact: potential remote exploitation allowing unauthorized access or d...

CVE-2024-3039 Shanghai Brad Technology BladeX API export-user sql injection

A vulnerability classified as critical has been found in Shanghai Brad Technology BladeX 3.4.0. Affected is an unknown function of the file /api/blade-user/export-user of the component API. The manipulation with the input updatexml1,concat0x3f,md5123456,0x3f,1=1 leads to sql injection. It is...

CVE-2024-3039 Shanghai Brad Technology BladeX API export-user sql injection

A vulnerability classified as critical has been found in Shanghai Brad Technology BladeX 3.4.0. Affected is an unknown function of the file /api/blade-user/export-user of the component API. The manipulation with the input updatexml1,concat0x3f,md5123456,0x3f,1=1 leads to sql injection. It is...

Command Execution Vulnerability in RG-UAC Ruijie Unified Internet Behavior Management and Audit System of Beijing StarNet Ruijie Network Technology Co.

RG-UAC Ruijie Unified Internet Behavior Management and Auditing System is an Internet behavior management and auditing product. A command execution vulnerability exists in the RG-UAC Ruijie Unified Internet Behavior Management and Audit System of Beijing StarNet Ruijie Network Technology Co. Ltd,...

Command Execution Vulnerability in RG-UAC Ruijie Unified Internet Behavior Management and Audit System of Beijing StarNet Ruijie Network Technology Co. Ltd (CNVD-2024-19347)

Beijing StarNet Ruijie Network Technology Co., Ltd. is an enterprise mainly engaged in software and information technology service industry. A command execution vulnerability exists in the RG-UAC Ruijie Unified Internet Behavior Management and Audit System of Beijing StarNet Ruijie Network...

On Secure Voting Systems

Andrew Appel shepherded a public comment--signed by twenty election cybersecurity experts, including myself--on best practices for ballot marking devices and vote tabulation. It was written for the Pennsylvania legislature, but its general in nature. From the executive summary: We believe that no...

U.S. Sanctions 3 Cryptocurrency Exchanges for Helping Russia Evade Sanctions

The U.S. Department of the Treasury's Office of Foreign Assets Control OFAC sanctioned three cryptocurrency exchanges for offering services used to evade economic restrictions imposed on Russia following its invasion of Ukraine in early 2022. This includes Bitpapa IC FZC LLC, Crypto Explorer DMCC...

Dell Grab 安全漏洞

Dell Grab is a configuration technology from Dell, Inc. It is used to collect data on hosts connected to Dell EMC storage devices. A security vulnerability exists in Dell Grab 5.0.4 and prior versions, which stems from a vulnerability in application folder permissions that could be exploited by a...

CISA and FBI Release Secure by Design Alert to Urge Manufacturers to Eliminate SQL Injection Vulnerabilities

Today, CISA and the Federal Bureau of Investigation FBI released a joint Secure by Design Alert, Eliminating SQL Injection Vulnerabilities in Software. This Alert was crafted in response to a recent, well-publicized exploitation of SQL injection SQLi defects in a managed file transfer application...

Command Execution Vulnerability in Hikvision Integrated Security Management Platform of Hangzhou Hikvision Digital Technology Co.

Hangzhou Hikvision Digital Technology Co., Ltd. is a technology company that focuses on technological innovation. A command execution vulnerability exists in the Hikvision Integrated Security Management Platform of Hangzhou Hikvision Digital Technology Company Limited, which can be exploited by...