Huawei HarmonyOS Access Control Error Vulnerability (CNVD-2022-08327)

Huawei HarmonyOS is an operating system from Huawei, China. An access control error vulnerability exists in Huawei HarmonyOS, which stems from a component of the product that does not effectively authenticate the user's identity. No details of the vulnerability are currently available...

Huawei HarmonyOS Input Validation Error Vulnerability (CNVD-2022-08330)

Huawei HarmonyOS is an operating system from Huawei China. HUAWEI HarmonyOS is vulnerable to an input validation error, which stems from an input validation-type vulnerability in a component of HarmonyOS. No detailed vulnerability details are available...

Chinese APT Hackers Used Log4Shell Exploit to Target Academic Institution

A never-before-seen China-based targeted intrusion adversary dubbed Aquatic Panda has been observed leveraging critical flaws in the Apache Log4j logging library as an access vector to perform various post-exploitation operations, including reconnaissance and credential harvesting on targeted...

Zyxel NBG6604 Access Control Error Vulnerability

The Zyxel NBG6604 is a dual-band wireless router from China-based Hopkins Technology Zyxel. An access control error vulnerability exists in the Zyxel NBG6604 that originates from the product's CGI program allowing users with expired sessions to access the device. No details of the vulnerability a...

panorama Mobile One Time Password SQL Injection Vulnerability

panorama Mobile One Time Password MOTP is a mobile dynamic password system of China Panorama. With a solid two-factor authentication mechanism, through the OTP dynamic password constantly changing characteristics, effectively solve the problem of account, password theft, to ensure the security of...

Zyxel NBG6604 Information Disclosure Vulnerability

The Zyxel NBG6604 is a dual-band wireless router from China-based Hopkins Technology Zyxel. The Zyxel NBG6604 suffers from an information disclosure vulnerability that originates from the plaintext storage of sensitive information in the Zyxel NBG6604 firmware, which can be exploited by an...

QNAP NAS Buffer Overflow Vulnerability

QNAP NAS is an accessible and fast storage solution from China Weilian Technology QNAP. The QNAP NAS Surveillance Station suffers from a buffer overflow vulnerability that originates from a boundary error in the software's handling of requests, which can be exploited by an unauthenticated, remote...

Unspecified vulnerability in Carinal Tien Hospital Health Report System

Carinal Tien Hospital Health Report System 耕莘醫院健检報告查询系統 is a hospital health report query system of Keng Hsien Hospital in Taiwan, China. A security vulnerability exists in the Carinal Tien Hospital Health Report System, which can be exploited by an attacker to gain access to other users without...

Zyxel GS1900 Operating System Command Injection Vulnerability

Zyxel ZyXEL GS1900 is a managed switch from Zyxel Taiwan, China. An operating system command injection vulnerability exists in the Zyxel GS1900, which can be exploited by an attacker to invoke a function to execute arbitrary system commands...

NUUO Network Video Recorder NVRsolo Cross-Site Scripting Vulnerability

NUUO Network Video Recorder NVR is a network video recorder from NUUO, Taiwan, China. A cross-site scripting vulnerability exists in NUUO Network Video Recorder NVRsolo version 3.9.1, which stems from the lack of effective filtering and escaping of user-submitted request parameters, and can be...

ZyXEL GS1900 Access Control Error Vulnerability

Zyxel ZyXEL GS1900 is a managed switch from Zyxel Taiwan, China. An Access Control Error vulnerability exists in multiple Zyxel products, which stems from the product's TFTP client not adding privilege controls to the functions that can execute system commands. The vulnerability can be exploited ...

Qibosoft Cross-Site Scripting Vulnerability

Qibosoft qibosoft is a content management system CMS from Qibosoft, China. qibosoft has a cross-site scripting vulnerability that originates in the /admin/index.php?lfj=friendlink & action=add link of the admin component of the product. The vulnerability is caused by the...

ZTE Big Video Analysis Product Elevation of Privilege Vulnerability

An elevation of privilege vulnerability exists in ZTE Big Video Analysis Product, a large video analytics product from ZTE Corporation China, which stems from an attacker with normal user privileges gaining unauthorized access to ZTE Big Video Analysis Product due to improper management of timed...

Qibosoft qibosoft 跨站请求伪造漏洞

Qibosoft qibosoft is a content management system CMS from Qibosoft China. qibosoft suffers from a cross-site request forgery vulnerability, which can be exploited by attackers to publish malicious articles...

Huawei HarmonyOS Path Traversal Vulnerability (CNVD-2021-103534)

Huawei HarmonyOS is an operating system from Huawei, China. A path traversal vulnerability exists in Huawei HarmonyOS, which stems from a component in the product that causes directory traversal. An attacker could exploit the vulnerability to cause the deletion of any file...

TP-Link TL-WR802N OS Command Injection Vulnerability

TP-Link TL-WR802N is a wireless router from China Universal Link TP-Link.TP-Link TL-WR802N V4 suffers from an operating system command injection vulnerability, which stems from the fact that TP-Link wifi router TL-WR802N V4 is vulnerable to operating system command injection attacks. No detailed...

S-CMS Cross-Site Scripting Vulnerability in Zibo Shining Network Technology Co.

S-CMS is a PHP and MySQL based content management system CMS from Zibo Shining Network Technology Co., Ltd. in China. A security vulnerability exists in S-CMS Government Station Building System v5.0, which can be exploited by attackers to perform cross-site scripting attacks XSS...

China suspends deal with Alibaba for not sharing Log4j 0-day first with the government

China's internet regulator, the Ministry of Industry and Information Technology MIIT, has temporarily suspended a partnership with Alibaba Cloud, the cloud computing subsidiary of e-commerce giant Alibaba Group, for six months on account of the fact that it failed to promptly inform the governmen...

FBI: Another Zoho ManageEngine Zero-Day Under Active Attack

Another Zoho ManageEngine zero-day vulnerability is under active attack from an APT group, this time looking to override legitimate functions of servers running ManageEngine Desktop Central and elevate privileges — with an ultimate goal of dropping malware onto organizations’ networks, the FBI ha...

Wecon Technologies LeviStudioU 缓冲区错误漏洞

Wecon Technologies LeviStudioU is a suite of human-machine interface programming software from Wecon Technologies China. A security vulnerability exists in WECON LeviStudioU that stems from the affected product being susceptible to a heap-based buffer overflow, which could allow an attacker to...