A New Map Shows the Inescapable Creep of Surveillance

The Atlas of Surveillance shows which tech law enforcement agencies across the country have acquired. It's a sobering look at the present-day panopticon...

Logic Flaw Vulnerability in Resource Access Control System (WebVPN) of Beijing Netrad Technology Co.(CNVD-2020-48923)

Ltd. resource access control system WebVPN provides users with a client-free tool for easy access to resources. A logic flaw vulnerability exists in the Resource Access Control System WebVPN of Beijing Netreda Technology Co. An attacker can exploit this vulnerability to obtain sensitive informati...

Arbitrary File Deletion Vulnerability in MCMS

MCMS is a website building system of MINGFEI TECHNOLOGY CO. MCMS suffers from an arbitrary file deletion vulnerability. An attacker can exploit this vulnerability to delete arbitrary files from the server...

Directory Traversal Vulnerability in MCMS

MCMS is a website building system of MINGFEI TECHNOLOGY CO. MCMS suffers from a directory traversal vulnerability. An attacker can exploit the vulnerability to read the contents of any file on the server...

Arbitrary File Read Vulnerability in MTS Transcoding Server of Suzhou Kedar Technology Co.

Ltd. is a provider of video and security products and solutions, dedicated to video conferencing, video surveillance and video application solutions to help various government and enterprise customers to solve visual communication and management challenges. An arbitrary file read vulnerability...

Financially Motivated Actors Are Expanding Access Into OT: Analysis of Kill Lists That Include OT Processes Used With Seven Malware Families

Mandiant Threat Intelligence has researched and written extensively on the increasing financially motivated threat activity directly impacting operational technology OT networks. Some of this research is available in our previous blog posts on industrial post-compromise ransomware and FireEye's...

Security Bulletin: Multiple vulnerabilities in IBM Java SDK affect IBM eDiscovery Analyzer

Summary There are multiple vulnerabilities in IBM® SDK Java™ Technology Edition, Java™ Version 6 and Java™ Version 7 that is used by IBM eDiscovery Analyzer. These issues were disclosed as part of the IBM Java SDK updates in Apr 2020. Vulnerability Details CVEID: CVE-2020-2830 DESCRIPTION: An...

SQL Injection Vulnerability in Shenglian Technology's Enterprise Information Management Platform

Enterprise information management system is a management of people, money, things, to manage people, i.e., customer resource management, sales team management as the core, while integrating procurement, inventory, financial management, after-sales service, OA office automation in one of the...

Memory Corruption Vulnerability in MP500 PC Software at Taian Technology (Wuxi) Co.

Ltd. is a wholly foreign owned enterprise established in China on July 1, 2000 by Antai International Investment Singapore Pte Ltd, a subsidiary of TECO Group, a renowned Taiwanese multinational corporation. A memory corruption vulnerability exists in the MP500 host computer software of Taian...

SQL Injection Vulnerability in the Website Building System of Ruian Uber Technology Co. Ltd (CNVD-2020-48644)

Ltd. is a social mass to provide web design and production, Baidu / Google SEO optimization and promotion, cell phone website, WeChat public platform, foreign trade monitoring enterprise mailboxes and other network information consulting services, product albums catalogs, corporate CD-ROM design...

Yixing Xingsheng Information Technology Co., Ltd. website building system has SQL injection vulnerabilities

Yixing Xing Sheng Information Technology Co., Ltd. is a collection of network interactive media, planning, consulting, film and television, in one of the new network interactive service providers. Yixing Xing Sheng Information Technology Co., Ltd. station building system SQL injection...

Secret Service Creates Cyber Fraud Task Forces

The U.S. Secret Service has created the Cyber Fraud Task Forces CFTFs, aimed at preventing, detecting and mitigating complex cyber-enabled financial crime – including making arrests and convictions. The CFTF is the result of a formal merging of two of the Secret Service’s existing units into a...

Ask Me Anything – Celebrating The Fifth Anniversary Of My Monthly Threat Webinar

In July 2015, I did my first threat webinar. I had planned to do it on a monthly basis, and never imagined I would still be doing it five years later, but here I am, still creating monthly webinars. I still do. I started the webinar series to help people understand the different threats targeting...

Command Execution Vulnerability in AmarBCR of Shanghai Anshuo Information Technology Co.

AmarBCR is a big data correlation risk monitoring system developed by Shanghai Anshuo Information Technology Co. AmarBCR of Shanghai Anshuo Information Technology Co. Ltd. suffers from a command execution vulnerability that can be exploited by an attacker to execute arbitrary commands...

SQL Injection Vulnerability in Shandong Chengtong Technology Co.

Ltd. is a company dedicated to the industry enterprise informatization, cloud computing platform, human resources management system research and development and technical consulting services company Shandong Chengtong Technology Co., Ltd. station building system SQL injection vulnerability,...

File Upload Vulnerability in PHPOK of Shenzhen Kunshuo Technology Co., Ltd (CNVD-2020-47296)

PHPOK is a content management system for website construction developed by Shenzhen KunHei Technology Co. A file upload vulnerability exists in PHPOK, which can be exploited by attackers to gain control of the web server...

Command Execution Vulnerability in Cscms File of Guilin Chongsheng Network Technology Co.

Cscms is a multi-functional network information management system developed by Chongsheng Network Technology. Cscms file has a command execution vulnerability that can be exploited by an attacker to gain control of the web server...

Security Bulletin: Multiple vulnerabilities in the IBM SDK, Java Technology Edition affects IBM Performance Management products

Summary CVE-2019-2949 deferred from Oracle Oct 2019 CPU Vulnerability Details CVEID: CVE-2019-2949 DESCRIPTION: An unspecified vulnerability in Java SE related to the Kerberos component could allow an unauthenticated attacker to obtain sensitive information resulting in a high confidentiality...

Security Bulletin: Multiple vulnerabilities in the IBM SDK, Java Technology Edition affects IBM Performance Management products

Summary CVE-2020-2654 deferred from Oracle Jan 2020 CPU Vulnerability Details CVEID: CVE-2020-2654 DESCRIPTION: An unspecified vulnerability in Java SE related to the Java SE Libraries component could allow an unauthenticated attacker to cause a denial of service resulting in a low availability...

File Upload Vulnerability in MCMS of MFI Technology Ltd.

MCMS is a website building system of MINGFEI TECHNOLOGY CO. A file upload vulnerability exists in MCMS of MINGFEI TECHNOLOGY LIMITED, which can be exploited by an attacker to execute arbitrary commands...