ZZCMS SQL Injection Vulnerability (CNVD-2021-101691)

ZZCMS is a content management system CMS from the Zzcms team in China.ZZCMS is vulnerable to SQL injection in 2021, which stems from a lack of validation of external input SQL statements in the askbigclassid parameter of /admin/ask.php in the application. An attacker could use this vulnerability ...

taocms arbitrary file deletion vulnerability

Taocms is a micro Cms Content Management System in China. Taocms in version 3.0.2 contains an arbitrary file deletion vulnerability, which stems from a design or implementation impropriety in the code development process of the web system or product. An attacker through can exploit this...

taocms SQL Injection Vulnerability (CNVD-2021-101663)

Taocms is a micro Cms Content Management System in China.Taocms has a SQL injection vulnerability in version 3.0.2, which stems from the application's lack of validation of externally entered SQL statements. An attacker could use this vulnerability to execute illegal SQL commands to steal sensiti...

Fiberhome FiberHome ONU GPON OS Command Injection Vulnerability

Fiberhome FiberHome ONU GPON is a router from Fiberhome, China.FiberHome ONU GPON AN5506-04-F RP2617 is vulnerable to an operating system command injection vulnerability, which originates from FiberHome ONU GPON AN5506-04-F RP2617 is affected by an operating system command injection vulnerability...

ThinkPHP SQL Injection Vulnerability (CNVD-2021-103660)

ThinkPHP is a set of PHP-based, open source, lightweight Web application development framework from China Top Think Information Technology. thinkPHP has SQL injection vulnerability, there is no detailed vulnerability details provided...

QNAP Kazoo Server Cross-Site Scripting Vulnerability

Qnap Kazoo Server is a server from China Welllink Technology Qnap. QNAP Kazoo Server suffers from a cross-site scripting vulnerability, which can be exploited by attackers to inject malicious code...

A week in security (Dec 6 – 12)

Last week on Malwarebytes Labs: Log4j zero-day “Log4Shell” arrives just in time to ruin your weekend Click “OK” to defeat MFA Fake job interviews plague major game developers like Riot Games and Rockstar Has your WordPress site been backdoored by a skimmer? What is a search engine and why does...

Exploit for Incorrect Authorization in Apache Druid

CVE-2021-36749 Apache Druid LoadData arbitrary file reading...

ZZCMS dl_sendmail.php SQL Injection Vulnerability

ZZCMS is a content management system CMS from the Zzcms team in China. ZZCMS is vulnerable to SQL injection, which stems from a missing validation of externally entered SQL statements in the id parameter of admin/dlsendmail.php. An attacker could use this vulnerability to execute illegal SQL...

ZZZCMS Cross-Site Scripting Vulnerability

ZZZCMS is a content management system CMS from the ZZZCMS team in China. ZZZCMS suffers from a cross-site scripting vulnerability that stems from a lack of data validation filtering of user-supplied and output data in the editfile action of /adminxxx/save.php. An attacker could exploit the...

ZZCMS SQL Injection Vulnerability (CNVD-2021-103084)

ZZCMS is a content management system CMS from the Zzcms team in China. A SQL injection vulnerability exists in ZZCMS, which stems from a lack of validation of externally entered SQL statements when registering regular users in dl/dldownload.php. An attacker could use this vulnerability to execute...

74 CMS Cross-Site Scripting Vulnerability (CNVD-2021-99667)

74cms is a PHP and MySQL-based online recruitment system from China Xunyi Technology Co. 74CMS has a cross-site scripting vulnerability in version v6.0.4, which originates from /index.php?m=&c=help&a=helplist&key missing a data validation filter for user-supplied data and output. An attacker coul...

DouPHP Cross-Site Scripting Vulnerability (CNVD-2022-03909)

DouPHP is a lightweight enterprise content management system CMS from China DouShell Network Technology, Inc. A cross-site scripting vulnerability exists in DouPHP, which stems from a lack of data validation filtering of user-supplied and output data in /admin/cloud.php. An attacker could exploit...

ZZCMS Access Control Error Vulnerability

ZZCMS is a content management system CMS from the Zzcms team in China. ZZCMS suffers from an access control error vulnerability that stems from an incorrect access control vulnerability in zzcms via admin.php, which can be exploited by an attacker to directly access the administrator console afte...

zzcms SQL Injection Vulnerability (CNVD-2021-99763)

ZZCMS is a content management system CMS from the Zzcms team in China. zzcms is vulnerable to SQL injection, which allows an attacker to use the id parameter in admin/bad.php with a lack of validation for external input SQL statements. An attacker can use the vulnerability to execute illegal SQL...

TP-Link AX10 has an unspecified vulnerability

TP-Link AX10 is a router from Tp-link, China. TP-Link AX10 has a security vulnerability that could be exploited to disconnect a connected wireless client by sending a spoofed authentication frame specific to the wireless adapter...

Microsoft disrupts China-based hacking group Nickel

Microsoft has taken control of 42 web domains that a hacking group was using to try to breach its targets. On December 2, the Microsoft Digital Crimes Unit DCU filed pleadings with the US District Court for the Eastern District of Virginia seeking authority to take control of the sites that it...

Unspecified vulnerability in Huawei HarmonyOS HwConnectivityExService service

A security vulnerability exists in the Huawei HarmonyOS Wearables, an electronic watch from Huawei of China Huawei, and the Huawei HarmonyOS HwConnectivityExService service. An attacker could exploit the vulnerability to cause the system to crash and reboot...

Huawei HarmonyOS Wearables encryption issue vulnerability

Huawei HarmonyOS Wearables is an electronic watch from Huawei of China Huawei.A security vulnerability exists in the Huawei HarmonyOS Wearables fingerprint module. An attacker could exploit the vulnerability to cause confidentiality to be compromised...

Huawei HarmonyOS Wearables Access Control Improper Vulnerability

Huawei HarmonyOS Wearables, an electronic watch from Huawei of China Huawei, is vulnerable to an improper access control vulnerability in the Huawei HarmonyOS Wearables distributed data service component. An attacker could exploit this vulnerability to cause confidentiality to be compromised...