CVE-2021-35465

Certain Arm products before 2021-08-23 do not properly consider the effect of exceptions on a VLLDM instruction. A Non-secure handler may have read or write access to part of a Secure context. This affects Arm Cortex-M33 r0p0 through r1p0, Arm Cortex-M35P r0, Arm Cortex-M55 r0p0 through r1p0, and...

Code injection

Certain Arm products before 2021-08-23 do not properly consider the effect of exceptions on a VLLDM instruction. A Non-secure handler may have read or write access to part of a Secure context. This affects Arm Cortex-M33 r0p0 through r1p0, Arm Cortex-M35P r0, Arm Cortex-M55 r0p0 through r1p0, and...

A week in security (August 16 – August 22)

Last week on Malwarebytes Labs: Podcast: Katie Moussouris hacked Clubhouse. Her emails went unanswered for weeks. How to troubleshoot hardware problems that look like malware problems. Analysts “strongly believe” the Russian state colludes with ransomware gangs. macOS 11’s hidden security...

TOTOLINK A3002RU Cross-Site Scripting Vulnerability (CNVD-2022-13192)

Totolink TOTOLINK A3002RU is a wireless router product from Gion Electronics Totolink, Taiwan, China.A cross-site scripting vulnerability exists in TOTOLINK A3002R V1.1.1-B20200824, which stems from the lack of proper validation of client-side data by the WEB application. An attacker could use th...

Chinese State-Sponsored Cyber Operations: Observed TTPs

Summary This advisory uses the MITRE Adversarial Tactics, Techniques, and Common Knowledge ATT &CK® framework, Version 9, and MITRE D3FEND™ framework, version 0.9.2-BETA-3. See the ATT&CK for Enterprise for all referenced threat actor tactics and techniques and the D3FEND framework for referenced...

Eyoucms Cross-Site Scripting Vulnerability (CNVD-2022-13193)

Zanzan Network Technology EyouCms EyouCms is a ThinkPHP-based open source content management system CMS from Zanzan Network Technology in China.Eyoucms 1.4.7 and previous versions have a cross-site scripting vulnerability, which stems from the fact that the addonfieldext parameter is not validate...

China Aims Its Propaganda Firehose at the BBC

The alleged digital operation has deployed hundreds of websites and social media accounts to attack the broadcaster's reporting...

Mediatek 芯片输入验证错误漏洞

Mediatek chips are smartphone chipsets from China's MediaTek Mediatek. There is no information about this vulnerability yet, so stay tuned to CNNVD or vendor announcements...

Octopus Server 安全漏洞

Octopus Server is an automated deployment platform. A security vulnerability exists in Octopus Server. No information about the vulnerability is available at this time, please stay tuned to CNNVD or the vendor announcement...

编号撤回

This CVE number has been withdrawn...

Foxit PDF Reader and Foxit PDF Editor Denial of Service Vulnerability (CNVD-2021-66410)

Foxit PDF Reader is a PDF reader from Foxit China. versions prior to Foxit PDF Reader 11.0.1 and PDF Editor 11.0.1 have a security vulnerability that can be exploited by attackers stemming from the application allowing the use of stacks during recursive processing of embedded XML nodes...

Youxiang Technology DSL-2740R code problem vulnerability

The UDomain DSL-2740R is a high-performance ADSL router from D-Link, Taiwan, China. A security vulnerability exists in the D-Link DSL-2740R UK 1.01, which can be exploited by attackers to cause a denial of service on the device...

Eyoucms Cross-Site Scripting Vulnerability (CNVD-2022-13194)

Zanzan Network Technology EyouCms EyouCms is a ThinkPHP-based open source content management system CMS from Zanzan Network Technology in China. version v1.4.1 of Eyoucms has a security vulnerability. An attacker can use the vulnerability to execute arbitrary web scripts or HTML...

TIETEN Acronis Cyber Protect代码问题漏洞

TIETEN Acronis Cyber Protect is an application from TIETEN Acronis Cyber Protect TIETEN, China. provides the ability to unify your network protection by integrating backup, disaster recovery, AI-based malware protection, remote assistance, and security into a single, reliable tool. A security...

Foxit PDF Reader and Foxit PDF Editor file writing vulnerability

Foxit PDF Reader and Foxit PDF Editor are both products of Foxit China. Foxit PDF Reader is a PDF reader and Foxit PDF Editor is a PDF editor. A security vulnerability exists in versions prior to 11.0.1, which can be exploited to allow an attacker to write arbitrary files via submitForm...

Hackers Steal Over $600 Million Worth of Cryptocurrencies from Poly Network

Hackers have siphoned $611 million worth of cryptocurrencies from a blockchain-based financial network in what's believed to be one of the largest heists targeting the digital asset industry, putting it ahead of breaches targeting exchanges Coincheck and Mt. Gox in recent years. Poly Network, a...

Totolink A720R License Issue Vulnerability

The Totolink A720R is a wireless router from Taiwan, China's Gion Electronics Totolink. The Totolink A720R suffers from an authorization issue vulnerability in version V4.1.5cu.470B20200911, which stems from an improper implementation of the form login feature in the software version, and can be...

SQL Injection Vulnerability in Flash Flood Monitoring and Early Warning Distribution Platform of Sichuang Technology Co.

Siltronic Ltd. is an information service provider for disaster reduction and profitability in China. A SQL injection vulnerability exists in the flash flood monitoring and early warning distribution platform of Siltronic, which can be exploited by attackers to obtain sensitive information from th...

Totolink A720R Access Control Error Vulnerability

The Totolink A720R is a wireless router from Taiwan, China's Gion Electronics Totolink. A security vulnerability exists in the TOTOLINK A720R that originates from a network system or product that does not properly restrict access to resources from unauthorized roles. An attacker can exploit the...

Russian Federal Agencies Were Attacked With Chinese Webdav-O Virus

An amalgam of multiple state-sponsored threat groups from China may have been behind a string of targeted attacks against Russian federal executive authorities in 2020. The latest research, published by Singapore-headquartered company Group-IB, delves into a piece of computer virus called...