This Week in Security News - April 9, 2021

Microsoft Teams and Zoom Hacked In $1 Million Competition and Preventing Ransomware While Working from Home...

June 1, 2021, update for Office 2013 (KB5001937)

June 1, 2021, update for Office 2013 KB5001937 This article describes update 5001937 for Microsoft Office 2013 that was released on June 1, 2021. This update also applies to Office Home and Student 2013 RT.Be aware that the update in the Microsoft Download Center applies to the Microsoft Installe...

ZBL EPON ONU Broadband Router 1.0 - Remote Privilege Escalation Vulnerability

Exploit Title: ZBL EPON ONU Broadband Router 1.0 - Remote Privilege Escalation Exploit Author: LiquidWorm Vendor Homepage: http://www.zblchina.com http://www.wd-thailand.com Vendor: Zhejiang BC&TV Technology Co., Ltd. ZBL | W&D Corporation WAD TECHNOLOGY THAILAND Product web page:...

Company Crime Tracking Software 1.0 Cross Site Scripting

Exploit Title: Company Crime Tracknig Software | 'fname,surname,email' Stored Cross Site Scripting Exploit Author: Richard Jones Date: 01-04-2021 Vendor Homepage: https://www.sourcecodester.com/ Software Link: https://www.sourcecodester.com/php/12644/company-crime-tracking-system.html Version: 1....

Child Tweets Gibberish from U.S. Nuke Account

A nonsense tweet sent out from the official account of U.S. Strategic Command is no reason for alarm, according to the department. The social media manager’s kid found an open laptop, pounded on a few random keys and sent the tweet, which read, “;l;;gmlxzssaw” last Sunday. The tweets were met wit...

Chengdu Flying Fish Star Technology Co., Ltd Flying Fish Star Home Intelligent Routing has a Logic Flaw Vulnerability

Chengdu Flying Fish Star Technology Co., Ltd. specializes in serving enterprise, commercial and home users, providing intelligent and easy-to-use network communication management equipment and value-added services with innovative technology. The company's existing IoT IoT Cloud, Smart Power Box,...

Project Expense Monitoring System 1.0 Authentication Bypass Vulnerability

Exploit Title: Project expense Monitoring System | Create Admin Account Unauthorised Exploit Author: Richard Jones Vendor Homepage: https://www.sourcecodester.com/php/14001/project-expense-monitoring-system-project-php-source-code-2020.html Software Link:...

Weak Password Vulnerability in BHW L7 Home Gateway

BHW L7 Home Gateway is a home gateway from Beijing BHW Technology Co. A weak password vulnerability exists in BHW L7 Home Gateway. An attacker can use this vulnerability to log into the system background and obtain sensitive information...

多款Netgear产品命令注入漏洞

Netgear RBK753 and others are products of Netgear USA.RBK753 is a home WiFi system.RBR750 is a home WiFi system.NETGEAR is a router. A command injection vulnerability exists in multiple Netgear products that allows an unauthenticated attacker to inject commands. The following products and version...

多款Netgear产品信息泄露漏洞

Netgear RBK753 and others are products of Netgear USA.RBK753 is a home WiFi system.RBR750 is a home WiFi system.NETGEAR is a router. An information disclosure vulnerability exists in a number of Netgear products, which stems from being affected by the disclosure of sensitive information. The...

多款Netgear产品缓冲区错误漏洞

Netgear RBK753 and others are products of Netgear USA.RBK753 is a home WiFi system.RBR750 is a home WiFi system.NETGEAR is a router. A buffer error vulnerability exists in multiple Netgear products that allows an authenticated user to cause a stack-based buffer overflow. The following products an...

CVE-2021-28374

The Debian courier-authlib package before 0.71.1-2 for Courier Authentication Library creates a /run/courier/authdaemon directory with weak permissions, allowing an attacker to read user information. This may include a cleartext password in some configurations. In general, it includes the user's...

Design/Logic Flaw

The Debian courier-authlib package before 0.71.1-2 for Courier Authentication Library creates a /run/courier/authdaemon directory with weak permissions, allowing an attacker to read user information. This may include a cleartext password in some configurations. In general, it includes the user's...

Dell SupportAssist for Home PCs and Dell SupportAssist for Business PCs code issue vulnerability

Dell SupportAssist for Business PCs is a client application for enterprise PCs. Dell SupportAssist for Home PCs is a client application for home PCs that provides automated, proactive and predictive techniques for troubleshooting and more. Dell SupportAssist for Home PCs and Dell SupportAssist fo...

DELL Dell SupportAssist Client 代码问题漏洞

Dell SupportAssist for Business PCs is a client application for enterprise PCs. Dell SupportAssist for Home PCs is a client application for home PCs that provides automated, proactive and predictive techniques for troubleshooting and more. Dell SupportAssist for Home PCs and Dell SupportAssist fo...

Monitoring System (Dashboard) 1.0 Shell Upload

Exploit Title: Monitoring System Dashboard | Authenticated Arbitrary File Upload to Remote Code Execution Exploit Author: Richard Jones Date: 2021-01-26 Vendor Homepage: https://www.sourcecodester.com/php/11741/monitoring-system-dashboard.html Software Link:...

XSS Vulnerability in Tianmu MVC-HOME Boards

Tianmu MVC-HOME Board is a professional PHP+MYSQL product. A XSS vulnerability exists in Tianmu MVC-HOME Board, which can be exploited by attackers to obtain an administrator cookie...

Home-Office Photos: A Ripe Cyberattack Vector

That photo that appears when someone disables his or her Zoom video, or those photos of a remote worker’s home office shared on Instagram may seem innocuous and playful. However, they could become ammunition for threat actors to launch targeted scams and put personal and critical data at risk, a...

AdGuard 安全漏洞

Eugene AdGuard Home is an open source application from Eugene. It provides network-wide software for blocking ads and tracking. A security vulnerability exists in AdGuard before 0.105.2, which can be exploited by attackers to be able to brute-force their passwords offline, as the hash of the...

SQL Injection Vulnerability in 1039, Inc.'s Home and School

Beijing One Zero Three Nine Technology Development Co., Ltd 1039 Company for short is a technology enterprise specializing in standardized software development and large-scale applied platform for the training industry, and is a partner in the information construction of the training industry. A...