Roundcube Webmail 跨站脚本漏洞

Roundcube Webmail is an open source browser-based IMAP client that supports address book management, message searching, spell checking and more. A cross-site scripting vulnerability exists in Roundcube Mail, which originates from the smtp configuration in /installer/test.php. No details of the...

PrinterLogic Printer Installer Client Installed (macOS)

Binary data printerlogicprinterinstallerclientmacinstalled.nbin...

CVE-2021-0536

In dropFile of WiFiInstaller, there is a way to delete files accessible to CertInstaller due to a confused deputy. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions:...

CVE-2021-0537

In onCreate of WiFiInstaller.java, there is a possible way to install a malicious Hotspot 2.0 configuration due to a tapjacking/overlay attack. This could lead to local escalation of privilege with User execution privileges needed. User interaction is needed for exploitation.Product:...

F5 Networks BIG-IP Edge Client Component Installer Installed (Windows)

Binary data f5big-ipedgeclientcomponentinstallerwininstalled.nbin...

Enphase Energy Envoy Command Injection Vulnerability

Enphase Energy Envoy is a gateway device used to connect smart home devices from Enphase Energy, Inc. A command injection vulnerability exists in Enphase Energy Envoy, which originates from the update-start feature in the installer update-start, and can be exploited remotely to execute arbitrary...

CVE-2021-0143

Improper permissions in the installer for the IntelR Brand Verification Tool before version 11.0.0.1225 may allow an authenticated user to potentially enable escalation of privilege via local access...

CVE-2021-0143

Improper permissions in the installer for the IntelR Brand Verification Tool before version 11.0.0.1225 may allow an authenticated user to potentially enable escalation of privilege via local access...

Input validation

Improper permissions in the installer for the IntelR Brand Verification Tool before version 11.0.0.1225 may allow an authenticated user to potentially enable escalation of privilege via local access...

CVE-2021-0143

Improper permissions in the installer for the IntelR Brand Verification Tool before version 11.0.0.1225 may allow an authenticated user to potentially enable escalation of privilege via local access...

Fortinet FortiClient 后置链接漏洞

Fortinet FortiClient is a mobile endpoint security solution from Fortinet. The solution provides IPsec and SSL encryption, WAN optimization, endpoint compliance, and two-factor authentication when connected to a FortiGate firewall appliance. A security vulnerability exists in Fortinet FortiClient...

Fortinet FortiClient Incorrect Permission Assignment Privilege Escalation Vulnerability

This vulnerability allows local attackers to escalate privileges on affected installations of Fortinet FortiClient on Apple macOS. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific flaw exists within...

PrinterLogic Printer Installer Client Installed (Windows)

Binary data printerlogicprinterinstallerclientwininstalled.nbin...

Intel Brand Verification Tool 安全漏洞

Intel Brand Verification Tool BVT is a tool used by Intel to test vPro and then generate a report. After passing the test, customers can qualify for the vPro Logo by submitting a report. A security vulnerability previously existed in IntelR Brand Verification Tool version 11.0.0.1225, which stemm...

WordPress Duplicator / Duplicator Pro Plugin Installer File Exposed (HTTP)

One or more installer files of the WordPress plugins Duplicator / Duplicator Pro are exposed on the target system. SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders...

CVE-2020-25752

An issue was discovered on Enphase Envoy R3.x and D4.x devices. There are hardcoded web-panel login passwords for the installer and Enphase accounts. The passwords for these accounts are hardcoded values derived from the MD5 hash of the username and serial number mixed with some static strings. T...

CVE-2021-22914

Citrix Cloud Connector before 6.31.0.62192 suffers from insecure storage of sensitive information due to sensitive information being stored in the Citrix Cloud Connector installation log files. Such information could be used by an malicious actor to access a Citrix Cloud environment. This issue...

CVE-2021-22914

Citrix Cloud Connector before 6.31.0.62192 suffers from insecure storage of sensitive information due to sensitive information being stored in the Citrix Cloud Connector installation log files. Such information could be used by an malicious actor to access a Citrix Cloud environment. This issue...

Design/Logic Flaw

The Sentinel LDK Run-Time Environment installer Versions 7.6 and prior adds a firewall rule named “Sentinel License Manager” that allows incoming connections from private networks using TCP Port 1947. While uninstalling, the uninstaller fails to close Port 1947...

Smoking Out a DARKSIDE Affiliate’s Supply Chain Software Compromise

Mandiant observed DARKSIDE affiliate UNC2465 accessing at least one victim through a Trojanized software installer downloaded from a legitimate website. While this victim organization detected the intrusion, engaged Mandiant for incident response, and avoided ransomware, others may be at risk. As...