CVE-2021-32993

IntelliBridge EC 40 and 60 Hub C.00.04 and prior contains hard-coded credentials, such as a password or a cryptographic key, which it uses for its own inbound authentication, outbound communication to external components, or encryption of internal data...

CVE-2021-33017

The standard access path of the IntelliBridge EC 40 and 60 Hub C.00.04 and prior requires authentication, but the product has an alternate path or channel that does not require authentication...

CVE-2021-33017

CVE-2021-33017 affects Philips IntelliBridge EC40 Hub (C.00.04 and prior) and EC80 Hub, exposing an authentication bypass via an alternate path or channel that does not require authentication. The ICS-CISA advisory documents an authentication bypass vulnerability (CWE-288) with CVSS v3 base score...

CVE-2021-32993

The CVE-2021-32993 issue affects Philips IntelliBridge EC 40 Hub (C.00.04 and prior) and EC 80 Hub (C.00.04 and prior). The vulnerability arises from hard-coded credentials used for inbound authentication, outbound communication to external components, or encryption of internal data (CWE-798). Re...

CVE-2021-45015

taocms 3.0.2 is vulnerable to arbitrary file deletion via taocms\include\Model\file.php from line 60 to line 72...

CVE-2021-34544

An issue was discovered in Solar-Log 500 before 2.8.2 Build 52 23.04.2013. In /export.html, email.html, and sms.html, cleartext passwords are stored. This may allow sensitive information to be read by someone with access to the device. Fixed with 3.0.0-60 11.10.2013 for SL 200, 500, 1000 / not...

PT-2021-20539 · Unknown · Solar-Log 200 +2

Name of the Vulnerable Software and Affected Versions: Solar-Log 500 versions prior to 2.8.2 Build 52 23.04.2013 Solar-Log 200 versions prior to 3.0.0-60 11.10.2013 Solar-Log 1000 versions prior to 3.0.0-60 11.10.2013 Description: An issue was discovered in the affected software where cleartext...

PT-2021-20538 · Unknown · Solar-Log 500

Name of the Vulnerable Software and Affected Versions: Solar-Log 500 versions prior to 2.8.2 Build 52 Description: The web administration server does not require authentication, allowing remote attackers to gain administrative privileges by connecting to the server. This enables the attacker to...

New High Impact Scenarios and Awards for the Azure Bounty Program

Microsoft is excited to announce new Azure Bounty Program awards up to $60,000 to encourage and reward vulnerability research focused on the highest potential impact to customer security. These increased awards are a part of our ongoing investment in partnership with the security research...

What Happened to Facebook, Instagram, & WhatsApp?

Facebook and its sister properties Instagram and WhatsApp are suffering from ongoing, global outages. We dont yet know why this happened, but the how is clear: Earlier this morning, something inside Facebook caused the company to revoke key digital records that tell computers and other...

PDF Light Viewer < 1.4.12 - Authenticated Command Injection

The plugin allows users with Author roles to execute arbitrary OS command on the server via OS Command Injection when invoking Ghostscript. 1 Go to Import PDF. 2 Select PDF file. 3 Set compression as 60 | calc | echo 4 Toggle import the first checkbox 5 Publish or update 6 Command executes...

Adobe Captivate <= 11.5.5 Privilege Escalation (APSB21-60)

The version of Adobe Captivate installed on the remote macOS or Mac OS X host is 11.5.5 or prior. It is, therefore, affected by privilege escalation vulnerability as referenced in the apsb21-69 advisory, due to the creation of a temporary file in a directory with incorrect permissions. Note that...

Talos Takes Ep. #60: Everything you need to know about the Kaseya situation

By Jon Munshaw. The latest episode of Talos Takes is available now. Download this episode and subscribe to Talos Takes using the buttons below, or visit the Talos Takes page. In this special "XL edition" of Talos Takes, we're bringing you the audio version of our live stream this week... This is...

Backdoor.Win32.Noknok.60 Insecure Permissions

Discovery / credits: Malvuln - malvuln.com c 2021 Original source: https://malvuln.com/advisory/ecaf6a123fdf1f5660692dfc4c67a933.txt Contact: [email protected] Media: twitter.com/malvuln Threat: Backdoor.Win32.Noknok.60 Vulnerability: Insecure Permissions Description: When generating an...

mj-moto-60.com Cross Site Scripting vulnerability OBB-1435522

Following coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: &nbsp&nbsp&nbsp&nbsp&nbsp&nbspa. verified the vulnerability and confirmed its existence; &nbsp&nbsp&nbsp&nbsp&nbsp&nbspb. notified the website operator about its existence...

CVE-2020-7357

Cayin CMS suffers from an authenticated OS semi-blind command injection vulnerability using default credentials. This can be exploited to inject and execute arbitrary shell commands as the root user through the 'NTPServerIP' HTTP POST parameter in system.cgi page. This issue affects several...

CVE-2020-7357

CVE-2020-7357 relates to Cayin CMS where an authenticated OS semi-blind command injection is possible via the NTP_Server_IP/NTP IP parameter in system.cgi. The issue requires authentication (default credentials) and can allow execution of arbitrary shell commands as root. Affected are multiple Ca...

Secure Your Global Remote Workforce

Update June 9, 2020: Qualys adds Malware Detection to Free 60-Day Remote Endpoint Protection offering. This post has been updated to reflect this new Malware Detection capability. IT organizations around the world are responding to the challenge posed by COVID-19 by ensuring that employees are ab...

CVE-2018-5167

The web console and JavaScript debugger do not sanitize all output that can be hyperlinked. Both will display "chrome:" links as active, clickable hyperlinks in their output. Web sites should not be able to directly link to internal chrome pages. Additionally, the JavaScript debugger will display...

CVE-2020-6794

If a user saved passwords before Thunderbird 60 and then later set a master password, an unencrypted copy of these passwords is still accessible. This is because the older stored password file was not deleted when the data was copied to a new format starting in Thunderbird 60. The new master...