File Containment Vulnerability in Netnifty Next Generation Extreme Firewall

NetShen Information Technology Beijing Co., Ltd. is a high-tech information security solution, product and service provider integrating technology research and development, manufacturing and comprehensive service. A file inclusion vulnerability exists in NetShen's next-generation Extreme Firewall...

CVE-2021-24295

It was possible to exploit an Unauthenticated Time-Based Blind SQL Injection vulnerability in the Spam protection, AntiSpam, FireWall by CleanTalk WordPress Plugin before 5.153.4. The updatelog function in lib/Cleantalk/ApbctWP/Firewall/SFW.php included a vulnerable query that could be injected v...

Sql injection

It was possible to exploit an Unauthenticated Time-Based Blind SQL Injection vulnerability in the Spam protection, AntiSpam, FireWall by CleanTalk WordPress Plugin before 5.153.4. The updatelog function in lib/Cleantalk/ApbctWP/Firewall/SFW.php included a vulnerable query that could be injected v...

CVE-2021-24295

Summary: CVE-2021-24295 affects the WordPress plugin “Spam protection, AntiSpam, FireWall by CleanTalk” (versions before 5.153.4). The vulnerability arises from an unsafe query in the update_log function of lib/Cleantalk/ApbctWP/Firewall/SFW.php, which could be injected via the User-Agent header ...

CVE-2021-24295 Time-based Blind SQL Injection in Spam protection, AntiSpam, FireWall by CleanTalk < 5.153.4

It was possible to exploit an Unauthenticated Time-Based Blind SQL Injection vulnerability in the Spam protection, AntiSpam, FireWall by CleanTalk WordPress Plugin before 5.153.4. The updatelog function in lib/Cleantalk/ApbctWP/Firewall/SFW.php included a vulnerable query that could be injected v...

PT-2021-3413

Name of the Vulnerable Software and Affected Versions Spam protection, AntiSpam, FireWall by CleanTalk WordPress Plugin versions prior to 5.153.4 Description The issue is related to the update log function in the lib/Cleantalk/ApbctWP/Firewall/SFW.php module, which does not properly protect the S...

ByeIntegrity-UAC - Bypass UAC By Hijacking A DLL Located In The Native Image Cache

Bypass User Account Control UAC to gain elevated Administrator privileges to run any program at a high integrity level. Requirements Administrator account UAC notification level set to default or lower How it works ByeIntegrity hijacks a DLL located in the Native Image Cache NIC. The NIC is used ...

GlassWire: GlassWire 2.1.167 vulnerability - MSVR 56639

Arbitrary code execution vulnerability within the firewall software, GlassWire version 2.1.167 Impact After the program is installed, on first execution, it will attempt to load Wtsapi32.dll.dll from the user's PATH without doing any checks to see if the file is signed. Attached is a demo...

CVE-2021-23892

By exploiting a time of check to time of use TOCTOU race condition during the Endpoint Security for Linux Threat Prevention and Firewall ENSL TP/FW installation process, a local user can perform a privilege escalation attack to obtain administrator privileges for the purpose of executing arbitrar...

CVE-2021-23892

The CVE-2021-23892 issue affects McAfee Endpoint Security for Linux Threat Prevention and Firewall (ENSL TP/FW). A TOCTOU race condition during the installation process allows a local user to escalate privileges by exploiting insecure use of predictable temporary file locations to gain administra...

多款华为产品加密问题漏洞

Huawei USG9500 is a data center firewall product, Huawei IPS Module is an Intrusion Prevention System IPS module, and NGFW Module is a Next Generation Firewall NGFW module. A security vulnerability exists in several Huawei products due to the use of weak security encryption algorithms when...

Siemens SIMATIC S7-1500

1. EXECUTIVE SUMMARY CVSS v3 7.8 ATTENTION: Low attack complexity Vendor: Siemens Equipment: SIMATIC S7-1500 CPU 1518F-4 Vulnerabilities: Improper Initialization, Improper Restriction of Operations within the Bounds of a Memory Buffer 2. RISK EVALUATION Successful exploitation of these Intel...

Mitsubishi Electric GOT and Tension Controller (Update A)

1. EXECUTIVE SUMMARY CVSS v3 5.9 ATTENTION: Exploitable remotely Vendor: Mitsubishi Electric Equipment: GOT and Tension Controller Vulnerability: Buffer Access with Incorrect Length Value 2. UPDATE INFORMATION This updated advisory is a follow-up to the original advisory titled ICSA-21-131-02...

Huawei NGFW 缓冲区错误漏洞

The Huawei NGFW Module is a Next Generation Firewall NGFW module from Huawei China. A buffer error vulnerability exists in Huawei NGFW. An authenticated, remote attacker could trigger a memory corruption and cause a denial of service condition on the target system...

Command Execution Vulnerability in Youyou Firewall of Shenzhen Hechen Communication Technology Co.

Yoyo is a registered trademark of Shenzhen Hechen Communication Technology Co., Ltd, founded in 1998, the main products are Mailgard Yoyo series mail servers, mail archiving, spam filtering gateway, mail gateway, global mail gateway, mail load balancing gateway, firewalls, VPNs, etc. Yoyo is the...

Command Execution Vulnerability in Netcom's Next-Generation Firewalls

Netcom Next Generation Firewall NGFW is a firewall that can comprehensively deal with application layer threats. A command execution vulnerability exists in the NGFW. An attacker can exploit this vulnerability to gain server privileges...

Pystinger - Bypass Firewall For Traffic Forwarding Using Webshell

Pystinger implements SOCK4 proxy and port mapping through webshell. It can be directly used by metasploit-framework, viper, cobalt strike for session online. Pystinger is developed in python, and currently supports three proxy scripts: php, jspx and aspx. Usage Suppose the domain name of the serv...

Stormshield Network Security 信任管理问题漏洞

Stormshield Network Security is a next-generation UTM Unified Threat Management firewall from Stormshield France. Stormshield Network Security suffers from a security vulnerability that can be exploited by an attacker to trigger a fatal error in order to trigger a denial of service...

Stormshield Network Security 安全漏洞

Stormshield Network Security is a next-generation UTM Unified Threat Management firewall from Stormshield France. Stormshield Network Security suffers from a security vulnerability that can be exploited by an attacker to trigger a fatal error in order to trigger a denial of service...

Stormshield Network Security 安全漏洞

Stormshield Network Security is a next-generation UTM Unified Threat Management firewall from Stormshield France. Stormshield Network has a security vulnerability that can be exploited by an attacker to trigger a fatal error to cause a denial of service...