Cayin Content Management Server 11.0 Root Remote Command Injection

Summary CAYIN Technology provides Digital Signage solutions, including media players, servers, and software designed for the DOOH Digital Out-of-home networks. We develop industrial-grade digital signage appliances and tailored services so you don't have to do the hard work. Description CAYIN CMS...

Engel & Völkers Technology GmbH: Information disclosure at https://printshop.engelvoelkers.com/packages/.bash_history

Hello! I found .bashhistory in the home directory and this file was accessible through the web screenshot in attachment. This file exposes sensitive information history commands, directories, software version that could help a malicious user to prepare more advanced attacks. POC:...

Teaching from home might become part of every teachers’ job description

“Hey Joe, I wanted to remind you that starting next Monday you will be expected to teach from home. The lesson material is in your inbox along with the list of pupils that are expected to follow them. We are sure it will take some adjustments, but we trust that by working together we can make the...

BJDCTF2020_March

本届BJDCTF由江苏科技大学、北京工业大学、西南民族大学、杭州师范大学、 江苏大学、湖南工业大学（排名不分先后）联合举办,刷题就到buu,感谢赵总大力支持...

Security Bulletin: Multiple vulnerabilities in IBM WebSphere Application Server and WebSphere Application Server Liberty affects IBM Engineering ELM products on IBM Jazz technology.

Summary There are multiple vulnerabilities in IBM WebSphere Application Server and WebSphere Application Server Liberty that affect IBM Engineering Products based on IBM Jazz technology. Vulnerability Details Refer to the security bulletinss listed in the Remediation/Fixes section Affected Produc...

Security Bulletin: IBM SDK, Java Technology Edition Quarterly CPU - Jan 2020 - Includes Oracle Jan 2020 CPU minus CVE-2020-2585, CVE-2020-2654, and CVE-2020-2590

Summary There are multiple vulnerabilities in IBM® SDK Java™ Technology Edition, Versions 8 that are used by Rational Software Architect Designer and Rational Software Architect Designer for Websphere Software. These issues were disclosed as part of the IBM Java SDK updates in Jan 2020...

Security Bulletin: CVE-2020-2654 may affect IBM® SDK, Java™ Technology Edition

Summary CVE-2020-2654 was disclosed as part of the Oracle January 2020 Critical Patch Update. Vulnerability Details CVEID: CVE-2020-2654 DESCRIPTION: An unspecified vulnerability in Java SE related to the Java SE Libraries component could allow an unauthenticated attacker to cause a denial of...

Fedora: Security Advisory for perl-Mojolicious (FEDORA-2020-cc7deffbf1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2020 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Unauthorized Access Vulnerability in UFIDA NC Cloud at UFIDA Network Technology Co.

NC Cloud is a new-generation cloud ERP product developed by UFIDA's IoT, big data, artificial intelligence and other technologies. An unauthorized access vulnerability exists in UFIDA NC Cloud, which can be exploited by attackers to cause data and information leakage...

EyouCMS 1.4.6 - Persistent Cross-Site Scripting Vulnerability

Exploit for php platform in category web applications Exploit Title: EyouCMS 1.4.6 - Persistent Cross-Site Scripting Exploit Author: China Banking and Insurance Information Technology Management Co.,Ltd. Vendor Homepage: https://eyoucms.com Software Link:...

Security Bulletin: Multiple vulnerabilities in current releases of the IBM® SDK, Java™ Technology Edition affect IBM Tivoli Network Manager.

Summary There are multiple vulnerabilities in IBM® SDK Java™ Technology Edition, Version 8, which is used by IBM Tivoli Network Manager IP Edition v4.1.1 and v4.2, which were disclosed in the Oracle January 2020 Critical Patch Update. Vulnerability Details Refer to the security bulletins listed i...

Security Bulletin: IBM Planning Analytics has addressed multiple Security Vulnerabilities

Summary This Security Bulletin addresses security vulnerabilities that have been remediated in IBM Planning Analytics 2.0.9.1. There are multiple vulnerabilities in IBM® Runtime Environment Java™ Version 8 used by IBM Planning Analytics. These issues were disclosed as part of the IBM Java SDK...

Security Bulletin: Denial of Service vulnerability may affect IBM SDK, Java Technology Edition shipped with Predictive Maintenance and Quality

Summary IBM SDK, Java Technology Edition is shipped with IBM Predictive Maintenance and Quality. Information about some Denial of Service security vulnerability affecting IBM SDK, Java Technology Edition has been published. Vulnerability Details Refer to the security bulletins listed in the...

Managing cybersecurity like a business risk: Part 1—Modeling opportunities and threats

In recent years, cybersecurity has been elevated to a C-suite and board-level concern. This is appropriate given the stakes. Data breaches can have significant impact on a company’s reputation and profits. But, although businesses now consider cyberattacks a business risk, management of cyber ris...

Reverse Engineering a 5g ‘Bioshield’

Six months ago the UK's Glastonbury Town Council set up a 5g Advisory Committee to explore the safety of the technology, and last month the local paper reported their findings. This statement is in their recommended measures report page 31 of this PDF: 5G Bioshield https://5gbioshield.com/ We use...

EyouCMS 1.4.6 Cross Site Scripting

Exploit Title: EyouCMS 1.4.6 - Persistent Cross-Site Scripting Date: 2020-05-28 Exploit Author: China Banking and Insurance Information Technology Management Co.,Ltd. Vendor Homepage: https://eyoucms.com Software Link: https://qiniu.eyoucms.com/EyouCMS-V1.4.6-UTF8-SP2.zip Version: EyouCMS V1.4.6...

Extreme Viewing suffers from a buffer overflow vulnerability (CNVD-2020-38489)

Extreme Viewer is a picture viewing software developed by Malpais Shanghai Software Technology Co. A buffer overflow vulnerability exists, which can be exploited to cause a denial of service...

MCMS suffers from a file upload vulnerability (CNVD-2020-38496)

MCMS is a website building system of MINGFEI TECHNOLOGY CO. MCMS suffers from a file upload vulnerability that can be exploited by an attacker to gain control of a web server...

Bringing Intrinsic Security to Containers: VMware Acquires Octarine

UPDATE: On May 27, 2020 VMware officially closed its acquisition of Octarine. The blog post below has been amended to reflect that announcement. Today is a very exciting day for VMware and for our customers as we announce our acquisition of Octarine, whose innovative security platform for...

Logic flaw vulnerability in LJCMS of Beijing Liangjing Zhicheng Technology Co., Ltd (CNVD-2020-33125)

LJCMS is a free and open source content management system. A logic flaw vulnerability exists in LJCMS of Beijing Liangjingzhicheng Technology Co. Ltd. that can be exploited by attackers to obtain sensitive information...