CVE-2021-38432

CVE-2021-38432 affects FATEK Automation Communication Server (Versions 1.13 and prior). The vulnerability is a stack-based buffer overflow caused by lack of proper validation of user-supplied data, enabling remote code execution via network access (no authentication required per ZDI/CISA). Exploi...

CVE-2021-38432 FATEK Automation Communication Server

FATEK Automation Communication Server Versions 1.13 and prior lacks proper validation of user-supplied data, which could result in a stack-based buffer overflow condition and allow an attacker to remotely execute code...

Inside Apple: How Apple’s attitude impacts security

Last week saw the fourth occurrence of the Objective by the Sea OBTS security conference, which is the only security conference to focus exclusively on Apples ecosystem. As such, it draws many of the top minds in the field. This year, those minds, having been starved of a good security conference...

Fatek Automation Communication Server Stack-based Buffer Overflow Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Fatek Automation Communication Server. Authentication is not required to exploit this vulnerability. The specific flaw exists within the processing of data sent to the Facon Server, which listens on...

SAP NetWeaver AS ABAP Multiple Vulnerabilities (Oct 2021)

Multiple vulnerabilities may be present in SAP NetWeaver Application Server ABAP, including the following: - SAP NetWeaver AS ABAP and ABAP Platform - versions 700, 701, 702, 730, 731, 740, 750, 751, 752, 753, 754, 755, 756, allows an attacker to prevent legitimate users from accessing a service,...

What is Graphql ❓ Definition with Example

Anyone who is involved in app development will be familiar with GraphQL, a highly useful query language making tons of things right for app developers and security managers. When handled perfectly and diligently, GraphQL holds the power to empower the traditional process of data retrievals,...

CVE-2021-40496

SAP Internet Communication framework ICM - versions 700, 701, 702, 730, 731, 740, 750, 751, 752, 753, 754, 755, 756, 785, allows an attacker with logon functionality, to exploit the authentication function by using POST and form field to repeat executions of the initial command by a GET request a...

Command injection

SAP Internet Communication framework ICM - versions 700, 701, 702, 730, 731, 740, 750, 751, 752, 753, 754, 755, 756, 785, allows an attacker with logon functionality, to exploit the authentication function by using POST and form field to repeat executions of the initial command by a GET request a...

PT-2021-22902 · Sap · Sap Internet Communication Framework

Name of the Vulnerable Software and Affected Versions: SAP Internet Communication framework ICM versions 700, 701, 702, 730, 731, 740, 750, 751, 752, 753, 754, 755, 756, 785 Description: The issue allows an attacker with logon functionality to exploit the authentication function. This can be done...

Sap Internet Communication Framework 访问控制错误漏洞

Sap Internet Communication Framework is an Internet communication framework from Sap, a German company. A security vulnerability exists in SAP Internet Communication framework, which arises from a configuration or other error in the operation of a network system or product. An unauthorized attack...

API security — Wiki: What is ❓ Why ❓ For PenTest & Best Practice

API security — Wiki: What is ❓ Why ❓ For PenTest & Best Practice What does api mean? For beginners, API refers to the Application Programming Interface designed for effortless communication between two different applications. This is why it’s often referred to as the middle person for the...

PT-2021-7315 · Linux +5 · Linux Kernel +5

Name of the Vulnerable Software and Affected Versions: Linux kernel affected versions not specified Description: A use-after-free vulnerability in the NFC stack of the Linux kernel can lead to a threat to confidentiality, integrity, and system availability. The vulnerability is related to the NFC...

Moxa MXview Improper Access Control Vulnerability

An improper access control vulnerability exists in Moxa MXview, a network management software used to monitor and diagnose industrial networks. The vulnerability stems from the fact that the affected product has a misconfigured service that allows remote connections to internal communication...

FATEK Communication Server 安全漏洞

FATEK Communication Server is a video communication server from China's Yonghong Electric FATEK. A security vulnerability exists in FATEK Communication Server that stems from a lack of proper validation of user-supplied data in the affected product, which could lead to a stack-based buffer overfl...

FATEK Automation Communication Server

1. EXECUTIVE SUMMARY CVSS v3 9.8 ATTENTION: Exploitable remotely/low attack complexity Vendor: FATEK Automation Equipment: Communication Server Vulnerability: Stack-based Buffer Overflow 2. RISK EVALUATION Successful exploitation of this vulnerability may allow remote code execution. 3...

CVE-2021-34788

A vulnerability in the shared library loading mechanism of Cisco AnyConnect Secure Mobility Client for Linux and Mac OS could allow an authenticated, local attacker to perform a shared library hijacking attack on an affected device if the VPN Posture HostScan Module is installed on the AnyConnect...

CVE-2021-34788

A vulnerability in the shared library loading mechanism of Cisco AnyConnect Secure Mobility Client for Linux and Mac OS could allow an authenticated, local attacker to perform a shared library hijacking attack on an affected device if the VPN Posture HostScan Module is installed on the AnyConnect...

How to Build an Incident-Response Plan, Before Security Disaster Strikes

In a startling discovery, a recent report found that 98 percent of companies have experienced at least one cloud data breach in the past 18 months, compared to 79 percent last year. The same report disclosed that nearly 60 percent of the 200 CISOs and security decision-makers surveyed considered...

Cheating on Tests

Interesting story of test-takers in India using Bluetooth-connected flip-flops to communicate with accomplices while taking a test. Whats interesting is how this cheating was discovered. Its not that someone noticed the communication devices. Its that the proctors noticed that cheating test taker...

[SECURITY] Fedora 35 Update: openssl-1.1.1l-1.fc35

The OpenSSL toolkit provides support for secure communications between machines. OpenSSL includes a certificate management tool and shared libraries which provide various cryptographic algorithms and protocols...