mingSoft MCMS SQL Injection Vulnerability (CNVD-2022-09255)

MingSoft Mcms is China's Ming Fei MingSoft company a complete open source J2ee system . mingSoft MCMS suffers from a SQL injection vulnerability that stems from a lack of validation of externally entered SQL statements in database-based applications. An attacker can exploit this vulnerability to...

Reolink RLC-410W cgiserver.cgi Upgrade API Denial of Service Vulnerability

Reolink Rlc-410W is a Wifi security camera from Reolink China. A denial of service vulnerability exists in the Reolink RLC-410W v3.0.0.136 20121102 version, which stems from the cgiserver.cgi Upgrade API doing the right thing with incoming error messages, which can be triggered by an attacker by...

Reolink Rlc-410W 输入验证错误漏洞

Reolink Rlc-410W is a Wifi security camera from Reolink China.Reolink RLC-410W has a security vulnerability that can be exploited by attackers to cause a denial of service...

Reolink Rlc-410W 输入验证错误漏洞

Reolink Rlc-410W is a Wifi security camera from Reolink China.Reolink RLC-410W has a security vulnerability that can be exploited by attackers to cause a denial of service...

MCMS SQL Injection Vulnerability

Mcms is a complete open source J2ee system from China MingFei MingSoft. mcms v5.2.4 version has a SQL injection vulnerability, which originates in /ms/mdiy/model/importJson.do for the lack of filtering and escaping of SQL data. No detailed vulnerability details are available at this time...

MingSoft Mcms Trust Management Issue Vulnerability

MingSoft Mcms is a complete open source J2ee system from MingSoft, China. v5.2.4 of MingSoft Mcms contains a security vulnerability that stems from the existence of a hard-coded shiro-key in the software, which can be exploited by attackers to execute arbitrary code...

Taocms SQL Injection Vulnerability

Taocms is a micro Cms Content Management System in China. Taocms in v3.0.2 version exists SQL injection vulnerability, the vulnerability stems from taocmsincludeModelArticle.php for SQL statements lack of effective filtering and escaping. An attacker can exploit this vulnerability to execute...

JavaQuarkBBS Cross-Site Scripting Vulnerability

JavaQuarkBbs is a simple Java community based on Spring Boot implementation in China.JavaQuarkBBS in v2 and its previous versions suffers from a cross-site scripting vulnerability, which stems from a lack of data validation filtering of user-supplied data and output. An attacker could exploit thi...

Taocms path traversal vulnerability

Taocms is a micro Cms content management system in China. taocms in v3.0.2 version there is an arbitrary file reading vulnerability, the vulnerability stems from the lack of filtering and restrictions on the software's path parameters, an attacker can use the vulnerability to read arbitrary files...

China’s Olympics App Is Horribly Insecure

China is mandating that athletes download and use a health and travel app when they attend the Winter Olympics next month. Citizen Lab examined the app and found it riddled with security holes. Key Findings: MY2022, an app mandated for use by all attendees of the 2022 Olympic Games in Beijing, ha...

Hackers Attempt to Exploit New SolarWinds Serv-U Bug in Log4Shell Attacks

Microsoft on Wednesday disclosed details of a new security vulnerability in SolarWinds Serv-U software that it said was being weaponized by threat actors to propagate attacks leveraging the Log4j flaws to compromise targets. Tracked as CVE-2021-35247 CVSS score: 5.3, the issue is an "input...

CVE-2021-33965

China Mobile An Lianbao WF-1 V1.0.1 router provides a web interface /api/ZRMesh/setZRMesh which receives parameters by POST request, and the parameter meshenable and meshdevice have a command injection vulnerability. An attacker can use the vulnerability to execute remote commands...

Command injection

China Mobile An Lianbao WF-1 V1.0.1 router provides a web interface /api/ZRMesh/setZRMesh which receives parameters by POST request, and the parameter meshenable and meshdevice have a command injection vulnerability. An attacker can use the vulnerability to execute remote commands...

CVE-2021-33964

China Mobile An Lianbao WF-1 V1.0.1 router provides a web interface /api/ZRRuleFilter/setfirewalllevel which receives parameters by POST request, and the parameter firewalllevel has a command injection vulnerability. An attacker can use the vulnerability to execute remote commands...

CVE-2021-33964

China Mobile An Lianbao WF-1 V1.0.1 router provides a web interface /api/ZRRuleFilter/setfirewalllevel which receives parameters by POST request, and the parameter firewalllevel has a command injection vulnerability. An attacker can use the vulnerability to execute remote commands...

Command injection

China Mobile An Lianbao WF-1 V1.0.1 router provides a web interface /api/ZRRuleFilter/setfirewalllevel which receives parameters by POST request, and the parameter firewalllevel has a command injection vulnerability. An attacker can use the vulnerability to execute remote commands...

CVE-2021-33965

China Mobile An Lianbao WF-1 V1.0.1 router provides a web interface /api/ZRMesh/setZRMesh which receives parameters by POST request, and the parameter meshenable and meshdevice have a command injection vulnerability. An attacker can use the vulnerability to execute remote commands...

CVE-2021-33965

CVE-2021-33965 affects China Mobile An Lianbao WF-1 V1.0.1 router. The web interface at /api/ZRMesh/set_ZRMesh processes POST parameters mesh_enable and mesh_device and can be abused to perform command injection, enabling remote command execution. This is described across multiple feeds (NVD/Red ...

CVE-2021-33964

China Mobile An Lianbao WF-1 V1.0.1 router provides a web interface /api/ZRRuleFilter/setfirewalllevel which receives parameters by POST request, and the parameter firewalllevel has a command injection vulnerability. An attacker can use the vulnerability to execute remote commands...

CVE-2021-33964

CVE-2021-33964 affects the China Mobile An Lianbao WF-1 router (V1.0.1). The issue is a command injection in the web interface endpoint /api/ZRRuleFilter/set_firewall_level, where POSTing the firewall_level parameter can lead to remote command execution. Documented details identify the vulnerable...