CVE-2021-27458

CVE-2021-27458 affects JTEKT TOYOPUC product series (PC10 and TOYOPUC-Plus/PC3J/PC2J lines). The root cause is improper resource shutdown or release (CWE-404): when Ethernet is left open, a remote attacker can prevent Ethernet communications from being established with other devices, depending on...

CVE-2021-20992

In Fibaro Home Center 2 and Lite devices in all versions provide a web based management interface over unencrypted HTTP protocol. Communication between the user and the device can be eavesdropped to hijack sessions, tokens and passwords...

Weak Password Vulnerability in RMP Router Management Platform of Xiamen Sihsin Communication Technology Co.

Xiamen Sihsin Communication Technology Co., Ltd. focuses on the research and development, production, promotion and service of high-end wireless communication transmission equipment in the industrial field, and is a backbone enterprise in the field of wireless communication of the Internet of...

Synology DSM synoagentregisterd server finder out-of-bounds write vulnerability

Summary An out-of-bounds write vulnerability exists in the synoagentregisterd server finder functionality of Synology DSM 6.2.3 25426 DS120j. A specially crafted HTTP response can lead to remote code execution. An attacker can use man-in-the-middle techniques to trigger this vulnerability. Tested...

Command execution vulnerability in Four-Faith build 2781M router

Four-Faith is a router product of Xiamen Four-Faith Communication Technology Co. A command execution vulnerability exists in the Four-Faith build 2781M router, which can be exploited by an attacker to gain control of the server...

There are multiple vulnerabilities in BlueLine OA

BlueLine OA Office System is an OA office tool for instant office communication. There are multiple vulnerabilities in BlueLine OA that can be exploited by attackers to gain control of the server...

CVE-2021-3460

The Motorola MH702x devices, prior to version 2.0.0.301, do not properly verify the server certificate during communication with the support server which could lead to the communication channel being accessible by an attacker...

Design/Logic Flaw

The Motorola MH702x devices, prior to version 2.0.0.301, do not properly verify the server certificate during communication with the support server which could lead to the communication channel being accessible by an attacker...

CVE-2021-3460

The Motorola MH702x devices, prior to version 2.0.0.301, do not properly verify the server certificate during communication with the support server which could lead to the communication channel being accessible by an attacker...

CVE-2021-3460

The CVE-2021-3460 entry concerns Motorola MH702x devices (pre-2.0.0.301) where the device does not properly verify the server certificate when communicating with the support server, allowing potential eavesdropping or channel access by an attacker. Affected component: trust management during TLS/...

Siemens SIMATIC Communication Processor Vulnerability (Update C)

1. EXECUTIVE SUMMARY CVSS v3 9.8 ATTENTION: Exploitable remotely/low attack complexity Vendor: Siemens Equipment: SIMATIC Communication Processor Vulnerability: Authentication Bypass Issues 2. UPDATE INFORMATION This updated advisory is a follow-up to the advisory update titled ICSA-15-335-03...

JTEKT TOYOPUC-Plus 安全漏洞

JTEKT TOYOPUC-Plus is a PLC from JTEKT Japan. A security vulnerability exists in several TOYOPUC products. The vulnerability stems from the inability to establish Ethernet communication with other devices when the product's Ethernet communication is in the open state, depending on the settings of...

HTTPS over HTTP: A Supply Chain Attack on Azure DevOps Server 2020

We provide the technical details of a supply chain attack on an improperly configured Azure DevOps Server 2020, specifically in the continuous integration and continuous delivery CI/CD Pipeline Agent communicating without TLS...

Security Bulletin: IBM InfoSphere Information Server has a network layer security vulnerability

Summary A network layer security vulnerability in InfoSphere Information Server can lead to privilege escalation or unauthorized access. An unauthorized user could intercept and view communication between client and server. They could also modify or replay certain DataStage commands to get...

DEBIAN-CVE-2021-21198

Out of bounds read in IPC in Google Chrome prior to 89.0.4389.114 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page...

CVE-2021-21198

Out of bounds read in IPC in Google Chrome prior to 89.0.4389.114 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page...

The vulnerability of the implementation of the Google Chrome browser’s IPC technology allows a perpetrator to gain unauthorized access to protected information.

The vulnerability of the Google Chrome browser’s IPC implementation relates to the execution of operations beyond the buffer in memory. Exploiting this vulnerability could allow a remote attacker to gain unauthorized access to protected information...

The vulnerability of the XPC service in Kaspersky Internet Security’s antivirus protection software for MacOS systems allows a hacker to disable the antivirus protection.

The vulnerability of Kaspersky Internet Security’s XPC service for the MacOS operating system is related to errors in the authentication process. Exploiting this vulnerability could allow a hacker to disable the antivirus protection...

Driving the Citrix Receiver Self-Service Plug-in Programmatically

This article is intended for Citrix administrators and technical teams only. Non-admin users must contact their company’s Help Desk/IT support team and can refer to CTX297149 for more information. The Self-Service Plugin SSP is the component within Receiver 4.0 onwards that is responsible for...

CVE-2021-27899

The Proofpoint Insider Threat Management Agents formerly ObserveIT Agent for MacOS and Linux perform improper validation of the ITM Server's certificate, which enables a remote attacker to intercept and alter these communications using a man-in-the-middle attack. All versions before 7.11.1 are...