Command Execution Vulnerability in the Control System of Next-Generation Firewall of Shenzhen Zhongke NetWizard Technology Co. Ltd (CNVD-2021-44000)

ZKNETWORTH's next-generation firewall control system products are based on L2-7 layer access application control, integrating firewall, IPS intrusion detection, DDoS/DOS protection, AV virus protection; realizing comprehensive security protection for intranet, and providing security firewall...

IGSS Definition 缓冲区错误漏洞

The Schneider Electric Interactive Graphical SCADA System IGSS is an advanced SCADA system for monitoring and controlling industrial processes. A security vulnerability exists in the Definition module of Interactive Graphical SCADA System IGSS versions 15.0.0.21140 and earlier. The vulnerability...

Johnson Controls Metasys

1. EXECUTIVE SUMMARY CVSS v3 8.8 ATTENTION: Exploitable remotely/low attack complexity Vendor: Johnson Controls Equipment: Metasys Servers, Engines, and Tools Vulnerability: Improper Privilege Management 2. RISK EVALUATION Successful exploitation of this vulnerability could give an authenticated...

Advantech iView

1. EXECUTIVE SUMMARY CVSS v3 9.1 ATTENTION: Exploitable remotely/low attack complexity Vendor: Advantech Equipment: iView Vulnerabilities: Missing Authentication for Critical Function, SQL Injection 2. RISK EVALUATION Successful exploitation of these vulnerabilities could allow an attacker to...

Understanding the threat landscape and risks of OT environments

The security community is continuously changing, growing, and learning from each other to better position the world against cyber threats. In the latest Voice of the Community blog series post, Microsoft Product Marketing Manager Natalia Godyla talks with Chris Sistrunk, Technical Manager in...

A New Bug in Siemens PLCs Could Let Hackers Run Malicious Code Remotely

Siemens on Friday shipped firmware updates to address a severe vulnerability in SIMATIC S7-1200 and S7-1500 programmable logic controllers PLCs that could be exploited by a malicious actor to remotely gain access to protected areas of the memory and achieve unrestricted and undetected code...

Weak Password Vulnerability in Control System of ZKNW Next-Generation Firewall

Ltd. is a high-tech enterprise specializing in the research, development and sales of network information security products, providing network information security overall solutions and security services. A weak password vulnerability exists in the control system of ZKNW's next-generation firewal...

Information Leakage Vulnerability in the Control System of Beijing Zhongke NetWizard Next-Generation Firewall System

Ltd. is a high-tech enterprise specializing in the research, development and sales of network information security products, providing network information security overall solutions and security services. An information leakage vulnerability exists in the control system of Beijing ZKNW Next...

Weak Password Vulnerability in ZKNW Security Control System

Ltd. is a national high-tech enterprise, double soft enterprise; the earliest domestic VPN R & D manufacturers, professional network security products R & D manufacturers Weak password vulnerability exists in the security control system of ZKNW, which can be exploited by attackers to obtain...

Weak Password Vulnerability in Next-Generation Firewall Control System of Beijing Zhongke NetWizard Information Technology Co.

Ltd. is the predecessor of the Chinese Academy of Sciences in 1996 established the "Network Security Studio", is China's earlier engaged in the development of independently controllable network security products and technology enterprises. A weak password vulnerability exists in the control syste...

Mitigate OT security threats with these best practices

The security community is continuously changing, growing, and learning from each other to better position the world against cyber threats. In the latest Voice of the Community blog series post, Microsoft Product Marketing Manager Natalia Godyla talks with Chris Sistrunk, Technical Manager in...

ALEA-2021:1813 new module: subversion:1.14

Subversion SVN is a concurrent version control system which enables one or more users to collaborate in developing and maintaining a hierarchy of files and directories while keeping a history of all changes. This enhancement update adds the subversion:1.14 module to AlmaLinux BZ1844947 For detail...

new module: subversion:1.14

Subversion SVN is a concurrent version control system which enables one or more users to collaborate in developing and maintaining a hierarchy of files and directories while keeping a history of all changes. This enhancement update adds the subversion:1.14 module to AlmaLinux BZ1844947 For detail...

JetBrains WebStrom Local Code Execution Vulnerability

JetBrains WebStorm is a JavaScript integrated development environment from Czech software development company JetBrains. versions prior to JetBrains WebStorm 2021.1 have a local code execution vulnerability that could be exploited by an attacker to make WebStrom execute local code when pulling co...

CVE-2021-29263

In JetBrains IntelliJ IDEA 2020.3.3, local code execution was possible because of insufficient checks when getting the project from VCS...

SQL Injection Vulnerability in ECS Production, Supply, and Marketing Management and Control Integration System

Ltd. is an Internet software development and system integration enterprise relying on Internet information and Internet of Things IoT technology to provide enterprises with complete smart factory solutions. A SQL injection vulnerability exists in Easys' integrated production, supply, and marketin...

CVE-2020-21999

CVE-2020-21999 affects iWT FaceSentry Access Control System (Firmware 6.4.8, 5.7.x) where an authenticated OS command injection is possible via the strInIP POST parameter in pingTest.php. The vulnerability uses default credentials and executes sudo ping with user-supplied input, enabling arbitrar...

CVE-2020-21999

iWT Ltd FaceSentry Access Control System 6.4.8 suffers from an authenticated OS command injection vulnerability using default credentials. This can be exploited to inject and execute arbitrary shell commands as the root user via the 'strInIP' POST parameter in pingTest PHP script...

PT-2021-10714

Name of the Vulnerable Software and Affected Versions iWT Ltd FaceSentry Access Control System version 6.4.8 Description The issue allows for authenticated OS command injection using default credentials. This can be exploited to inject and execute arbitrary shell commands as the root user via the...

CVE-2020-21999: Improper Neutralization of Special Elements used in an OS Command

iWT Ltd FaceSentry Access Control System 6.4.8 suffers from an authenticated OS command injection vulnerability using default credentials. This can be exploited to inject and execute arbitrary shell commands as the root user via the 'strInIP' POST parameter in pingTest PHP script...