PT-2021-11: Possibility to access file 00000001.SYP with file password mechanism enabled in the FX5U(C) CPU and FX5UJ CPU modules

The vulnerability of the FX5UC CPU and FX5UJ CPU modules of Mitsubishi Electric FA products is associated with the storage of sensitive information in open form. Exploiting the vulnerability may allow an attacker, provided that the file password mechanism is enabled, to gain access to file...

Oracle Database Protection Mechanism Bypass

Advisory ID: SYSS-2021-061 Product: Database Manufacturer: Oracle Affected Versions: 12.1.0.2, 12.2.0.1, 19c Tested Versions: 18c Vulnerability Type: Protection Mechanism Failure CWE-693 Risk Level: High Solution Status: Fixed Manufacturer Notification: 2021-03-17 Solution Date: 2021-08-07 Public...

A closer look at Qakbot’s latest building blocks (and how to knock them down)

Multiple Qakbot campaigns that are active at any given time prove that the decade-old malware continues to be many attackers’ tool of choice, a customizable chameleon that adapts to suit the needs of the multiple threat actor groups that utilize it. Since emerging in 2007 as a banking Trojan,...

A closer look at Qakbot’s latest building blocks (and how to knock them down)

Multiple Qakbot campaigns that are active at any given time prove that the decade-old malware continues to be many attackers’ tool of choice, a customizable chameleon that adapts to suit the needs of the multiple threat actor groups that utilize it. Since emerging in 2007 as a banking Trojan,...

Authentication flaw

An authentication bypass account takeover vulnerability exists in Premiumdatingscript 4.2.7.7 due to a weak password reset mechanism in requests\user.php...

CVE-2021-41696

An authentication bypass account takeover vulnerability exists in Premiumdatingscript 4.2.7.7 due to a weak password reset mechanism in requests\user.php...

CVE-2021-41696

The CVE-2021-41696 entry concerns Premiumdatingscript 4.2.7.7, where an authentication bypass/account takeover arises from a weak password reset mechanism in requests\user.php. This vulnerability enables bypassing authentication without user interaction,典ically allowing unauthorized access and po...

CVE-2021-41025

Multiple vulnerabilities in the authentication mechanism of confd in FortiWeb versions 6.4.1, 6.4.0, 6.3.0 through 6.3.15, 6.2.0 through 6.2.6, 6.1.0 through 6.1.2, 6.0.0 thorugh 6.0.7, including an instance of concurrent execution using shared resource with improper synchronization and one of...

CVE-2021-41025

CVE-2021-41025 affects Fortinet FortiWeb’s confd authentication mechanism. Affected FortiWeb versions include 6.0.0–6.0.7, 6.1.0–6.1.2, 6.2.0–6.2.6, 6.3.0–6.3.15, 6.4.0–6.4.1. The issue comprises concurrent execution using a shared resource with improper synchronization and an authentication bypa...

Distributed Data Systems WebHmi Authorization Issues Vulnerability

Distributed Data Systems WebHmi is a Scada system with a built-in web server from Distributed Data Systems, Ukraine. It is used for monitoring and controlling any automation system on the local network as well as over the Internet from computers and mobile devices. Distributed Data Systems WebHmi...

The vulnerability of the Chakra scenario mechanism in Windows operating systems allows a perpetrator to execute arbitrary code.

The vulnerability of the Chakra scenario mechanism in Windows operating systems is related to the execution of write operations beyond buffer boundaries into memory. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...

More Stealthier Version of BrazKing Android Malware Spotted in the Wild

Banking apps from Brazil are being targeted by a more elusive and stealthier version of an Android remote access trojan RAT that's capable of carrying out financial fraud attacks by stealing two-factor authentication 2FA codes and initiating rogue transactions from infected devices to transfer...

Open-xchange OX App Suite Information Disclosure Vulnerability (CNVD-2021-90765)

Open-xchange OX App Suite is a web-based cloud desktop environment from Open-Xchange Open-xchange, a US-based company that allows users to more intuitively manage email, tasks, files, etc. An information disclosure vulnerability exists in Open-xchange OX App Suite. An information disclosure...

CVE-2021-38378

OX App Suite 7.10.5 allows Information Exposure because a caching mechanism can caused a Modified By response to show a person's name...

CVE-2021-38378

OX App Suite 7.10.5 allows Information Exposure because a caching mechanism can caused a Modified By response to show a person's name...

Information disclosure

OX App Suite 7.10.5 allows Information Exposure because a caching mechanism can caused a Modified By response to show a person's name...

ZOHO ManageEngine Remote Access Plus Password Reset Vulnerability

ZOHO ManageEngine Remote Access Plus, a remote access solution from ZOHO, Inc. is vulnerable to a password reset vulnerability in ZOHO ManageEngine Remote Access Plus Server prior to version 10.1.2132, which stems from an unauthorized password reset mechanism. An attacker could use this...

NVIDIA GPU 安全漏洞

Nvidia Gpu is a graphics processing unit from the American company Nvidia. It is used in machine learning, video editing, and gaming applications. A security vulnerability exists in NVIDIA GPUs and Tegra hardware that stems from a user with elevated privileges using a debugging mechanism with...

CVE-2021-35534 Insufficient Security Control Vulnerability

Insufficient security control vulnerability in internal database access mechanism of Hitachi Energy Relion 670/650/SAM600-IO, Relion 650, GMS600, PWC600 allows attacker who successfully exploited this vulnerability, of which the product does not sufficiently restrict access to an internal databas...

Session fixation

Protection mechanism failure in the firmware for the IntelR Ethernet Network Controller E810 before version 1.5.5.6 may allow a privileged user to enable a denial of service via local access...