Weak Password Vulnerability in TP-LINKE TL-ER3220G Router

The TL-ER3220G is a dual-core multi-WAN port Gigabit enterprise VPN router. The TP-LINKE TL-ER3220G router suffers from a weak password vulnerability that can be exploited by attackers to obtain sensitive information...

FUEL CMS Cross-Site Scripting Vulnerability (CNVD-2021-17199)

FUEL CMS is a content management system based on CodeIgniter. A cross-site scripting vulnerability exists in FUEL CMS 1.4.7. An attacker can exploit this vulnerability to conduct cross-site scripting attacks bypassing filters via /fuelCM/fuel/pages/edit/1?lang=english...

QEMU elevation of privilege vulnerability (CNVD-2021-39776)

QEMU is a suite of analog processor software. QEMU suffers from an elevation of privilege vulnerability that can be exploited by an attacker to bypass restrictions via QEMU's Virtiofsd Xattrmap option, thereby increasing privileges on the host system...

Unauthorized Access Vulnerability in yycms

yycms is a movie and television system. yycms has an unauthorized access vulnerability, which can be exploited by an attacker to gain unauthorized access and directly add friend link information in bulk...

Microsoft Exchange Server Remote Code Execution Vulnerability (CNVD-2021-14768)

Microsoft Exchange Server is a mail server and calendar server developed by Microsoft. A remote code execution vulnerability exists in Microsoft Exchange Server. An attacker could exploit this vulnerability to achieve remote code execution...

Google Chrome Compositing Security Bypass Vulnerability

Google Chrome is a web browser from Google, an American company. A security bypass vulnerability exists in Google Chrome Compositing. An attacker can exploit this vulnerability to bypass security restrictions...

Microsoft Exchange Server 安全漏洞

Microsoft Exchange Server is a mail server and calendar server developed by Microsoft. A remote code execution vulnerability exists in Microsoft Exchange Server. An attacker could exploit this vulnerability to achieve remote code execution...

Memory Corruption Vulnerability in Nitro Pro (CNVD-2021-21845)

Nitro pro is a PDF production and management software. A memory corruption vulnerability exists in Nitro Pro. An attacker could exploit this vulnerability to cause the program to crash...

Unauthorized Access Vulnerability in ZXHN F460 of ZTE Corporation

ZXHN F460 is ZTE's EPON mode optical cat. An unauthorized access vulnerability exists in the ZXHN F460 of ZTE Corporation, which can be exploited by attackers to obtain sensitive information...

Denial of Service Vulnerability in EasyBuilder Pro (CNVD-2021-16898)

EasyBuilder Pro is a configuration software developed by Wyland. A denial of service vulnerability exists in EasyBuilder Pro. An attacker can exploit this vulnerability to cause the process to fall into a dead loop, resulting in a denial of service...

Arbitrary File Download Vulnerability in AmarBCR of Shanghai Anshuo Information Technology Co.

AmarBCR is a big data correlation risk monitoring system developed by Shanghai Anshuo Information Technology Co. AmarBCR of Shanghai Anshuo Information Technology Co., Ltd. suffers from an arbitrary file download vulnerability, which can be exploited by an attacker to read or download arbitrary...

F5 BIG-IP Buffer Overflow Vulnerability

F5 BIG-IP is an application delivery platform from F5 USA that integrates network traffic management, application security management, load balancing and other functions. A buffer overflow vulnerability exists in BIG-IP, which originates when a network system or product performs an operation in...

Shining a Light on SolarCity: Practical Exploitation of the X2e IoT Device (Part One)

In 2019, Mandiant’s Red Team discovered a series of vulnerabilities present within Digi International’s ConnectPort X2e device, which allows for remote code execution as a privileged user. Specifically, Mandiant’s research focused on SolarCity’s now owned by Tesla rebranded ConnectPort X2e device...

Red Hat Ansible Information Disclosure Vulnerability (CNVD-2021-19700)

Red Hat Ansible is a computer system configuration manager from Red Hat, an American company. The product can be used to publish, manage, and organize computer systems. Red Hat ansible has an information disclosure vulnerability that can be exploited by an attacker to steal credentials...

The vulnerability of the Core component of the Oracle VM VirtualBox software allows a hacker to trigger a service failure.

The vulnerability of the Core component of the Oracle VM VirtualBox software is related to deficiencies in access control. Exploiting this vulnerability can allow an attacker to cause a service failure...

Unauthorized access vulnerability in Transmission web control

Transmission Web Control is the Transmission browser management interface. An unauthorized access vulnerability exists in Transmission web control, which can be exploited by an attacker to bypass authentication and arbitrarily control the download, delete, or upload functionality of an applicatio...

Denial of Service Vulnerability in MB80-CPU721E

Nanrui Automatic Control is a high-tech entity integrating software development, hardware development, technical service, equipment production and system integration. A denial of service vulnerability exists in MB80-CPU721E, which can be exploited by attackers to cause a denial of service...

Arbitrary File Deletion Vulnerability in the InRouter900 Industrial Router from Imagicom (CNVD-2021-10444)

The Johnton-InRouter900 series industrial router is a 4G industrial router. The InRouter900 Industrial Router suffers from an arbitrary file deletion vulnerability, which originates from the program failing to properly validate user data, and can be exploited by a remote attacker to delete...

Command Execution Vulnerability in the InRouter900 Industrial Router from Johnstone (CNVD-2021-10445)

The Johnton-InRouter900 series industrial router is a 4G industrial router. A command execution vulnerability exists in the InRouter900 Industrial Router. The vulnerability stems from the program's failure to properly validate user data and can be exploited by a remote attacker to execute arbitra...

Command Execution Vulnerability in the InRouter900 Industrial Router from Johnstone (CNVD-2021-10454)

The Johnton-InRouter900 series industrial router is a 4G industrial router. A command execution vulnerability exists in the InRouter900 Industrial Router. The vulnerability stems from the program's failure to properly validate user data and can be exploited by a remote attacker to execute arbitra...