219 matches found
China suspends deal with Alibaba for not sharing Log4j 0-day first with the government
China's internet regulator, the Ministry of Industry and Information Technology MIIT, has temporarily suspended a partnership with Alibaba Cloud, the cloud computing subsidiary of e-commerce giant Alibaba Group, for six months on account of the fact that it failed to promptly inform the governmen...
The Bug Report – October Edition
ARCHIVED STORY The Bug Report – October Edition By Douglas McKee · November 02, 2021 Your Cyber Security Comic Relief Figure 1. Apache server version 2.4.50 CVE-2021-42013 Why am I here? Regardless of the origins, you’ve arrived at Advanced Threat Research team’s monthly bug digest – an overview ...
Acronis True Image 安全漏洞
Acronis True Image is a famous data backup and restore software from Acronis Singapore. The software can be used to create drive and disk images and can restore the image when a clean system is needed. Acronis True Image suffers from a security vulnerability that stems from an insecure XPC servic...
SQL Injection Vulnerability in PatrolFlow Multiservice Security Gateway Intelligent Management Platform (CNVD-2021-40138)
Beijing Byzoro Network Technology Co., Ltd. is a high-tech enterprise dedicated to building the next-generation secure Internet. PatrolFlow Multi-service Security Gateway Intelligent Management Platform suffers from a SQL injection vulnerability, which can be exploited by attackers to obtain...
SQL Injection Vulnerability in VTS Management System of Shenzhen Yingzhijie Network Technology Co.
Shenzhen Yingzhijie Network Technology Co., Ltd. is a subsidiary of Intex Group, which is committed to providing valuable product services for enterprises. A SQL injection vulnerability exists in the VTS management system of Shenzhen Yingzhijie Network Technology Co. An attacker can utilize the...
Huawei USG9500 Information Disclosure Vulnerability (CNVD-2021-24917)
Huawei USG9500 is a data center firewall product. An information disclosure vulnerability exists in the Huawei USG9500. The vulnerability stems from the program not properly handling information during user login. An attacker can exploit this vulnerability to perform certain operations to obtain...
Information Leakage Vulnerability in VNet Web Management System of Zhonghai Da
Guangzhou Zhonghaida Satellite Navigation Technology Co., Ltd stock code: 300177 is the first and so far the only listed company in the field of domestic surveying, mapping and geographic information technology equipment. An information leakage vulnerability exists in ZHIDA's VNet web management...
Cloudflare WARP for Windows Code Issue Vulnerability
Cloudflare Warp Cloudflare Vpn is a client application for secure connections from Cloudflare, Inc. in the United States. A security vulnerability exists in Cloudflare WARP for Windows that stems from an unreferenced service path. An attacker can become an administrator by abusing the unreference...
Security Update Guide Supports CVEs Assigned by Industry Partners
Hi Folks, This month we are introducing a new data element for each CVE in the Security Update Guide, called Assigning CNA. First let me back up a bit and give some information about the CVE program. The purpose of a CVE is to uniquely identify a cybersecurity vulnerability. The CVE program was...
Security Update Guide Supports CVEs Assigned by Industry Partners
Hi Folks, This month we are introducing a new data element for each CVE in the Security Update Guide, called Assigning CNA. First let me back up a bit and give some information about the CVE program. The purpose of a CVE is to uniquely identify a cybersecurity vulnerability. The CVE program was...
Security Update Guide Supports CVEs Assigned by Industry Partners
Hi Folks, This month we are introducing a new data element for each CVE in the Security Update Guide, called Assigning CNA. First let me back up a bit and give some information about the CVE program. The purpose of a CVE is to uniquely identify a cybersecurity vulnerability. The CVE program was...
CVE-2020-16012
creationtimestamp| type| source ---|---|--- 2021-01-08 22:42:14+00:00| seen| https://t.me/cibsecurity/21864 2021-01-14 11:04:01+00:00| published-proof-of-concept| https://t.me/CyberSecurityTechnologies/2491 2025-06-15 21:02:19+00:00| seen|...
Directory Traversal Vulnerability in Phantom Route X18G Web Server
Phantom Router X18G is a router from Shenzhen Meike Star Communication Technology Co. A directory traversal vulnerability exists in the Mirage Router X18G Web Server, which can be exploited by an attacker to obtain sensitive information...
SQL Injection Vulnerability in Smart City Management Platforms
Ltd. is a high-tech enterprise certified by Beijing Municipality and a software enterprise with a number of independent intellectual property rights, specializing in the development and promotion of e-government and GIS application platforms. An SQL injection vulnerability exists in the intellige...
Command Execution Vulnerability in Youyou Firewall Gateway Management System
Yoyo is a registered trademark of Shenzhen Hechen Communication Technology Co., Ltd, founded in 1998, the main products are Mailgard Yoyo series mail servers, mail archiving, spam filtering gateway, mail gateway, global mail gateway, mail load balancing gateway, firewalls, VPNs, etc. Yoyo is the...
CVE-2020-5412
creationtimestamp| type| source ---|---|--- 2020-09-01 20:40:11+00:00| published-proof-of-concept| https://t.me/cKure/2044 2022-07-04 14:39:14+00:00| published-proof-of-concept| https://t.me/CyberSecurityTechnologies/1683 2025-02-26 21:02:00+00:00| seen|...
CVE-2020-8218
creationtimestamp| type| source ---|---|--- 2020-08-27 04:00:00+00:00| seen| https://www.govcert.gov.hk/en/alertsdetail.php?id=506 2020-08-29 11:05:49+00:00| published-proof-of-concept| https://t.me/cKure/2007 2020-08-29 11:29:34+00:00| published-proof-of-concept|...
CVE-2020-13404
The ATOS/Sips aka Atos-Magento community module 3.0.0 to 3.0.5 for Magento allows command injection...
Design/Logic Flaw
Phoenix Hemodialysis Delivery System SW 3.36 and 3.40, The Phoenix Hemodialysis device does not support data-in-transit encryption e.g., TLS/SSL when transmitting treatment and prescription data on the network between the Phoenix system and the Exalis dialysis data management tool. An attacker wi...