Code execution vulnerability in KingView (CNVD-2020-45671)

KingView is an industrial automation configuration software produced by Beijing Asian Control Technology Development Co. A code execution vulnerability exists in KingView, which can be exploited by an attacker to gain control of a web server...

CVE-2020-9289

Use of a hard-coded cryptographic key to encrypt password data in CLI configuration in FortiManager 6.2.3 and below, FortiAnalyzer 6.2.3 and below may allow an attacker with access to the CLI configuration or the CLI backup file to decrypt the sensitive data, via knowledge of the hard-coded key...

Code Execution Vulnerability in MetInfo of Changsha Mito Information Technology Co.

MetInfo is an open source free CMS building system suitable for enterprise building. Changsha Mito Information Technology Co., Ltd MetInfo has a code execution vulnerability that can be exploited by attackers to obtain server control privileges...

Any Indian DigiLocker Account Could've Been Accessed Without Password

The Indian Government said it has addressed a critical vulnerability in its secure document wallet service Digilocker that could have potentially let a remote attacker bypass mobile one-time passwords OTP and sign in as other users. Discovered separately by two independent bug bounty researchers,...

Google Android Framework Data Leakage Vulnerability

Android is a Linux-based open source operating system from Google and the Open Handheld Alliance OHA, of which Framework is a component of the Android framework. A security vulnerability exists in Framework in Android version 10. An attacker could exploit the vulnerability to gain access to...

CVE-2020-1963

Apache Ignite uses H2 database to build SQL distributed execution engine. H2 provides SQL functions which could be used by attacker to access to a filesystem...

XSS Vulnerability in the Frontend of Tuan ah VIP Movie System

Tuan ah VIP movie system is a set of VIP movie video viewing website with registered member agent version. A XSS vulnerability exists in the frontend of Tuan Ah VIP Movie System. An attacker can exploit this vulnerability to obtain user cookie information...

The vulnerability in the web-based administration interface of the PAN-OS operating system allows a hacker to gain access to the device.

The vulnerability of the PAN-OS operating system’s administrative web interface is related to deficiencies in the authentication process. Exploiting this vulnerability can allow a malicious actor, operating remotely, to gain access to the device...

D-Link DSP-W215 Information Disclosure Vulnerability (CNVD-2020-33174)

The D-Link DSP-W215 is a smart plug product from Taiwan, China-based AUO D-Link. A security vulnerability exists in D-Link DSP-W215 version 1.26b03. An attacker can exploit the vulnerability to cause information disclosure...

CVE-2020-10706

A flaw was found in OpenShift Container Platform where OAuth tokens are not encrypted when the encryption of data at rest is enabled. This flaw allows an attacker with access to a backup to obtain OAuth tokens and then use them to log into the cluster as any user who logged into the cluster via t...

Design/Logic Flaw

IBM Maximo Anywhere 7.6.2.0, 7.6.2.1, 7.6.3.0, and 7.6.3.1 does not have device jailbreak detection which could result in an attacker gaining sensitive information about the device. IBM X-Force ID: 160199...

YouDianCMS suffers from SQL injection vulnerability (CNVD-2020-28102)

YouDianCMS set computer website, mobile website, micro letter, APP, small program in one, share space, data automatic synchronization, is the domestic open source five station one excellent solution. YouDianCMS has SQL injection vulnerability, attackers can use the vulnerability to obtain databas...

Information Disclosure Vulnerability in Multiple NETGEAR Products (CNVD-2020-31317)

NETGEAR WNR3500L and others are products of NETGEAR.WNR3500L is a wireless router.NETGEAR R7500 is a wireless router.NETGEAR D6220 is a wireless modem.NETGEAR R7500 is a wireless router.NETGEAR R7500 is a wireless router.NETGEAR R7500 is a wireless router.NETGEAR R7500 is a wireless router.NETGEA...

IBM UrbanCode Deploy Information Disclosure Vulnerability (CNVD-2020-24013)

IBM UrbanCode Deploy UCD is a set of application automation deployment tools from IBM in the United States. The tool is based on an application deployment automation management information model, and through remote agent technology, to realize the complex application in different environments, su...

CVE-2020-2904

Vulnerability in the MySQL Server product of Oracle MySQL component: Server: Optimizer. Supported versions that are affected are 8.0.19 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful...

SAP Business Objects Business Intelligence Platform Information Disclosure Vulnerability (CNVD-2020-23033)

SAP Business Objects Business Intelligence Platform is a suite of business intelligence software and enterprise performance solutions from SAP, Germany. The product features report generation, analytics, and data visualization. A security vulnerability exists in SAP Business Objects Business...

Missing permission check on resharing a board (NC-SA-2020-025)

Improper access control in Nextcloud Deck 0.8.0 allowed an attacker to reshare boards shared with them with more permissions than they had themselves...

Unauthorized Access Vulnerability in Xeondi Technology's One Card Communication Service Client

The XIONGDY Technology OneCard Communication Service Client is a one-card management system of XIONGDY Co. An unauthorized access vulnerability exists in the Xiondi Technology One Card Communication Service Client, which can be exploited by an attacker to gain unauthorized access to the system an...

Default credentials

An issue was discovered in Deskpro before 2019.8.0. The /api/emailaccounts endpoint failed to properly validate a user's privilege, allowing an attacker to retrieve cleartext credentials of all helpdesk email accounts, including incoming and outgoing email credentials. This enables an attacker to...

Samsung Mobile Device Buffer Overflow Vulnerability (CNVD-2020-34736)

Android is a free and open source operating system from Google based on the Linux kernel without GNU components. A buffer overflow vulnerability exists in Samsung mobile devices, which can be exploited by attackers to obtain sensitive information...