Newshield NDF7000 Series suffers from weak password vulnerability

Ltd. "Newshield" was founded in 2009 in Shanghai, is a "network security" as the main axis, to "make the network more secure" for the hereinafter referred to as "Newshield Technology" was founded in 2009 in Shanghai, is a professional security company with the main axis of "network security" and...

CVE-2021-39289

CVE-2021-39289 affects NetModule Router Software (NRSW) and various NetModule NB devices where passwords are stored in cleartext or with reversible encryption. Affected devices include NB800, NB1600, NB1601, NB1800, NB1810, NB2700, NB2710, NB2800, NB2810, NB3700, NB3701, NB3710, NB3711, NB3720, a...

CVE-2021-39365

In GNOME grilo though 0.3.13, grl-net-wc.c does not enable TLS certificate verification on the SoupSessionAsync objects it creates, leaving users vulnerable to network MITM attacks. NOTE: this is similar to CVE-2016-20011...

CVE-2021-39365

CVE-2021-39365 affects GNOME Grilo with TLS certificate verification disabled on SoupSessionAsync/SoupSessionSync (grl-net-wc.c). Connected advisories show mitigations via upgraded Grilo packages in several distros (e.g., Debian bullseye 0.3.13-1+deb11u1; Mageia updates; AlmaLinux ALAS2 advisorie...

CVE-2021-39360

CVE-2021-39360 affects GNOME libzapojit up to 0.0.3. The vulnerable component is zpj-skydrive.c, which does not enable TLS certificate verification on SoupSessionSync objects, exposing users to network MITM attacks. This mirrors CVE-2016-20011 behavior. The issue is documented in Nessus entries a...

reporter command injection vulnerability

Shenzhen Huayu Digital Security Technology Co., Ltd reporter component can be integrated into the company's network security equipment to identify all the data flowing through the device, can meet the most detailed granularity of network traffic to achieve visibility, control, auditable, etc...

Weak Password Vulnerability in Reporter System of Shanghai Newton Technology Co.

Ltd. is a professional security company with "network security" as its main axis and "making the network safer" as its mission to provide customers with total network security solutions. Ltd. Reporter system has a weak password vulnerability, which can be used by attackers to log into the system...

Command Execution Vulnerability in Reporter System of Shanghai Newshield Technology Co.

Ltd. is a professional security company with "network security" as the main axis and "make the network more secure" as the mission to provide customers with network security solutions. Ltd. Reporter system there is a command execution vulnerability, attackers can use the vulnerability to execute...

How to proactively defend against Mozi IoT botnet

Mozi is a peer-to-peer P2P botnet that uses a BitTorrent-like network to infect IoT devices such as network gateways and digital video records DVRs. It works by exploiting weak telnet passwords1 and nearly a dozen unpatched IoT vulnerabilities2 and it’s been used to conduct distributed...

Unpatched Remote Hacking Flaw Disclosed in Fortinet's FortiWeb WAF

Details have emerged about a new unpatched security vulnerability in Fortinet's web application firewall WAF appliances that could be abused by a remote, authenticated attacker to execute malicious commands on the system. "An OS command injection vulnerability in FortiWeb's management interface...

Multiple Flaws Affecting Realtek Wi-Fi SDKs Impact Nearly a Million IoT Devices

Taiwanese chip designer Realtek is warning of four security vulnerabilities in three software development kits SDKs accompanying its WiFi modules, which are used in almost 200 IoT devices made by at least 65 vendors. The flaws, which affect Realtek SDK v2.x, Realtek "Jungle" SDK...

RHEL 8 : exiv2 (RHSA-2021:3152) (deprecated)

REJECT DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2021-29457. Reason: This candidate is a duplicate of CVE-2021-29457. Notes: All CVE users should reference CVE-2021-29457 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental...

Command Execution Vulnerability in the Enterprise-Side Internet Integrated Management Platform of Beijing Yahong Century Technology Development Co.

Ltd. is a high-tech company specializing in Internet spatial data governance, network and information security and data value-added solutions and services. A command execution vulnerability exists in the enterprise-side Internet integrated management platform of Beijing Yahong Century Science and...

eCh0raix Ransomware Variant Targets QNAP, Synology NAS Devices

Operators of the nearly-year-old eCh0raix ransomware strain that’s been used to target QNAP and Synology network-attached storage NAS devices in past, separate campaigns have, gotten more efficient. According to researchers, both have put out a new variant that can target either vendors’ devices ...

A 5G Shortcut Leaves Phones Exposed to Stingray Surveillance

You may not have the full story about what network you're on—and how well you're protected...

Information Leakage Vulnerability in SSL VPN of Beijing NetGalaxy Information Technology Co.

Beijing Nethub Information Technology Co., Ltd. was renamed from Lenovo Nethub Technology Beijing Co., Ltd. and its business covers network border security protection, application and data security protection, network-wide security risk management, professional security solutions and professional...

EulerOS 2.0 SP9 : openldap (EulerOS-SA-2021-2251)

According to the versions of the openldap packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - A flaw was found in OpenLDAP. This flaw allows an attacker who can send a malicious packet to be processed by OpenLDAP's slapd server, to...

EulerOS 2.0 SP9 : zstd (EulerOS-SA-2021-2286)

According to the versions of the zstd package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - Beginning in v1.4.1 and prior to v1.4.9, due to an incomplete fix for CVE-2021-24031, the Zstandard command-line utility created output files with...

EulerOS 2.0 SP9 : dhcp (EulerOS-SA-2021-2241)

According to the version of the dhcp package installed, the EulerOS installation on the remote host is affected by the following vulnerability : - In ISC DHCP 4.1-ESV-R1 - 4.1-ESV-R16, ISC DHCP 4.4.0 - 4.4.2 Other branches of ISC DHCP i.e., releases in the 4.0.x series or lower and releases in th...

EulerOS 2.0 SP9 : unbound (EulerOS-SA-2021-2259)

According to the versions of the unbound packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - Unbound before 1.9.5 allows configuration injection in createunboundadservers.sh upon a successful man-in-the-middle attack against a cleartext...