Addressing the OT-IT Risk and Asset Inventory Gap

Cyber-espionage and exploitation from nation-state-sanctioned actors have only become more prevalent in recent years, with recent examples including the SolarWinds attack, which was attributed to nation-state actors with alleged Russian ties. There are suspicions that sensitive information has be...

Security Bulletin: IBM SDK, Java Technology Edition Quarterly CPU - Apr 2020 - Includes Oracle Apr 2020 CPU minus CVE-2020-2773 affects IBM Tivoli Composite Application Manager for Transactions-Robotic Response Time

Summary There are multiple vulnerabilities in IBM® SDK Java™ Technology Edition, Version 7 ,version 8, that is used by IBM Tivoli Composite Application Manager for Transactions - Robotic Response Time. These issues were disclosed as part of the IBM Java SDK updates in Apr 2020. Vulnerability...

SQL injection vulnerability in ab***.aspx page of website building system of Hangzhou Orange Promise Technology Co.

Hangzhou Orange Promise Technology Co., Ltd. is a company focusing on Internet branding and online marketing, specializing in the following areas: branded website customization, WeChat application development, e-commerce platform development, mobile application development. Hangzhou Orange Promis...

Information Disclosure Vulnerability in BMG700, an Edge Computing Gateway from Baima Technology

Xiamen Baima Technology Co., Ltd. focuses on Industrial Internet of Things IIoT: Industrial Internet of Things, providing users with industrial-grade data acquisition, communication networking, cloud platform and other intelligent products and solutions. An information leakage vulnerability exist...

WordPress 5.0.0 Remote Code Execution

Exploit Title: WordPress 5.0.0 - Image Remote Code Execution Date: 2020-02-01 Exploit Authors: OUSSAMA RAHALI aka V0lck3r Discovery Author : RIPSTECH Technology Version: WordPress 5.0.0 and :/ ' printusage url = sys.argv1 username = sys.argv2 password = sys.argv3 wptheme = sys.argv4 wpscan result...

Directory Traversal Vulnerability in M18G of Shenzhen Meike Star Communication Technology Co.

The M18G is a wireless router. A directory traversal vulnerability exists in the M18G of Shenzhen Meike Star Communication Technology Co. An attacker can exploit the vulnerability to access arbitrary directories on the file system and read sensitive files...

Directory Traversal Vulnerability in Collaborative Business Platform of Guangzhou Consulting Technology Co.

Guangzhou Consultative Technology Co., Ltd. specializes in large-scale manufacturing product development and management of collaborative business software consulting and services. A directory traversal vulnerability exists in the collaborative business platform of Guangzhou Consultative Technolog...

User Management System 1.0 - 'uid' SQL Injection

Exploit Title: User Management System 1.0 - 'uid' SQL Injection Google Dork: N/A Date: 29/1/2021 Exploit Author: Zeyad Azima Vendor Homepage: https://phpgurukul.com/ Software Link: https://phpgurukul.com/user-management-system-in-php-using-stored-procedure/ Version: V1 Tested on: Windows Identify...

SQL Injection Vulnerability in ne***.asp page of website building system of Ruian City Business Enterprise Network Technology Co.

Ruian Business Enterprise Network Technology Co., Ltd. is a high-tech enterprise dedicated to the design and production of enterprise and commercial websites, to improve the level of SMEs' network marketing applications, and to enhance the comprehensive competitiveness of enterprises in the...

SQL injection vulnerability in the ne***.asp page of the website building system of Shenyang Numerical Information Technology Company Limited (CNVD-2021-12826)

Shenyang Numerical Information Technology Co., Ltd. is a new technology enterprise engaged in Internet information service, e-commerce application and enterprise application system development. Shenyang number industry information technology limited company to build the system ne.asp page there i...

SQL injection vulnerability in c***-c***.asp page of website building system of Tianjin Qipeng Technology Development Co.

Tianjin Qipeng Technology Development Co., Ltd. is a professional for enterprises or individuals to provide website design and production, website construction, enterprise official website production, small program development, Baidu keyword promotion and optimization, APP development of a compan...

SQL injection vulnerability in pr***.asp page of website building system of Shenyang Numerical Information Technology Co.

Shenyang Numerical Information Technology Co., Ltd. is a new technology enterprise engaged in Internet information service, e-commerce application and enterprise application system development. Shenyang number industry information technology limited company building system pr.asp page there is a...

Arbitrary File Read Vulnerability in Great Practice Series Teaching Management System of Guojin Information Technology Co.

Kok Jin Information Technology Limited is an educational software and information technology service provider. An arbitrary file read vulnerability exists in the Great Practice Series Teaching Management System of Guojin Information Technology Limited, which can be exploited by attackers to obtai...

SQL injection vulnerability in the pr***.asp page of the website building system of Shenyang Numerical Information Technology Co., Ltd. (CNVD-2021-12831)

Shenyang Numerical Information Technology Co., Ltd. is a new technology enterprise engaged in Internet information service, e-commerce application and enterprise application system development. Shenyang number industry information technology limited company building system pr.asp page there is a...

SQL injection vulnerability in ne***_de*** page of website building system of Shanghai Zhihu Information Technology Co.

Shanghai Zhihu Information Technology Co., Ltd. is a technology enterprise focusing on software customization and product development. Shanghai Zhihu Information Technology Co., Ltd. building system nede page there is a SQL injection vulnerability, the attacker can use the vulnerability to obtain...

Shanghai Zhihu Information Technology Co., Ltd. builds website system pr*** page with SQL injection vulnerability

Shanghai Zhihu Information Technology Co., Ltd. is a technology enterprise focusing on software customization and product development. Shanghai Zhihu Information Technology Co., Ltd. station-building system pr page there is a SQL injection vulnerability, the attacker can use the vulnerability to...

SQL injection vulnerability in pr***_su*** page of website building system of Shanghai Zhihu Information Technology Co.

Shanghai Zhihu Information Technology Co., Ltd. is a technology enterprise focusing on software customization and product development. Shanghai Zhihu Information Technology Co., Ltd. building system prsu page SQL injection vulnerability, attackers can use the vulnerability to obtain sensitive...

2021 KuppingerCole Leadership Compass names Imperva an overall leader for Database and Big Data Security

It is my pleasure to report that in their 2021 overview of the market for Database and Big Data Security solutions, leading technology analyst KuppingerCole has identified Imperva as an Overall Leader for the first time. Imperva scored five out of five for product security, functionality,...

Talos Takes Ep. #39: SolarWinds' implications for IoT and OT

The latest episode of Talos Takes is available now. Download this episode and subscribe to Talos Takes using the buttons below, or visit the Talos Takes page. This week, we're continuing our deep dive into the SolarWinds campaign. After Nick Biasini gave us a broad overview of supply chain attack...

SQL injection vulnerability in WeiPHP lo***.php page of Shenzhen Yuanmeng Cloud Technology Co.

WeiPHP is a microsoft development platform, which is based on oneThink, a content management framework. Ltd. WeiPHP lo.php page has a SQL injection vulnerability, which can be exploited by attackers to obtain sensitive information from the database...