Logic Flaw Vulnerability in ENLINK CASB Backend Management System

Ltd. specializes in network security product development and sales, is the industry's leading "zero trust" solution provider. A logic flaw exists in the backend management system of ENLINK CASB, which can be exploited by an attacker to cause an arbitrary user password to log into the management...

Arbitrary Command Execution Vulnerability in NPE Network Egress Engine System of Ruijie Networks Co.

Ltd. is a company mainly engaged in information system integration services; Internet virtual private network services; Internet management services and other items. An arbitrary command execution vulnerability exists in the NPE network egress engine system of Ruijie Networks Co. An attacker can...

UBUNTU-CVE-2020-13302

A vulnerability was discovered in GitLab versions before 13.1.10, 13.2.8 and 13.3.4. Under certain conditions GitLab was not properly revoking user sessions and allowed a malicious user to access a user account with an old password...

PT-2020-13443 · Gitlab · Gitlab

Name of the Vulnerable Software and Affected Versions: GitLab versions prior to 13.1.10 GitLab versions prior to 13.2.8 GitLab versions prior to 13.3.4 Description: A vulnerability was discovered that allows a malicious user to access a user account with an old password under certain conditions,...

Siemens SIMATIC HMI Product Authentication Vulnerability (CNVD-2020-51238)

Siemens SIMATIC HMI panels are HMI software used to operate and monitor machines and equipment. A security vulnerability exists in Siemens SIMATIC HMI products. A remote attacker could use a brute force attack to discover user passwords and gain access to Sm@rt Server...

McAfee True Key Memory Sensitive Information Plaintext Storage Vulnerability

McAfee True Key is an authentication application from the American company McAfee. The program supports features such as facial information recognition and fingerprint recognition.Microsoft Windows is a set of operating systems for use on personal devices from Microsoft Corporation, USA. A securi...

IBM Security Guardium Data Encryption (GDE) Hardcoded Credentials Vulnerability

IBM Security Guardium Data Encryption GDE provides a modular set of encryption solutions that help security teams effectively implement data-at-rest security across the organization. A hard-coded credentials vulnerability exists in IBM Security Guardium Data Encryption GDE 3.0.0.2, which can be...

PrestaShop Correos Express Information Disclosure Vulnerability

PrestaShop is a set of open source e-commerce solutions from PrestaShop, USA. The program provides a variety of payment methods , SMS alerts and product image scaling and other features . Correos Express is one of the logistics management plug-ins . A security vulnerability exists in Correos...

CVE-2020-9349

The CACAGOO Cloud Storage Intelligent Camera TV-288ZD-2MP with firmware 3.4.2.0919 allows access to the RTSP service without a password...

CVE-2020-6794

If a user saved passwords before Thunderbird 60 and then later set a master password, an unencrypted copy of these passwords is still accessible. This is because the older stored password file was not deleted when the data was copied to a new format starting in Thunderbird 60. The new master...

Unspecified Vulnerability in Tecno Camon iClick 2

The Transn Tecno Camon iClick 2 is a smartphone from the Chinese company Transn. An unspecified vulnerability exists in Tecno Camon iClick 2. The vulnerability can be exploited to execute code or commands with system privileges to record the screen, restore factory settings, obtain user's Wi-Fi...

Control Web Panel 0.9.8.864 phpMyAdmin Password Disclosure

Exploit Title : CWP Control Web Panel phpMyAdmin password access Date : 20 Aug 2019 Exploit Author : Pongtorn Angsuchotmetee, Nissana Sirijirakal, Narin Boonwasanarak Vendor Homepage : https://control-webpanel.com/ Software Link : Not available, user panel only available for lastest version Versi...

CVE-2019-18337

A vulnerability has been identified in Control Center Server CCS All versions V1.5.0. The Control Center Server CCS contains an authentication bypass vulnerability in its XML-based communication protocol as provided by default on ports 5444/tcp and 5440/tcp. A remote attacker with network access ...

Smart Battery License Issue Vulnerability

Smart Battery A4 is a portable power supply device. An authorization issue vulnerability exists in the Smart Battery A4 using firmware version r1.7.9 and earlier. An attacker can exploit this vulnerability to obtain/reset the administrator password without authentication...

CVE-2019-11187

Incorrect Access Control in the LDAP class of GONICUS GOsa through 2019-04-11 allows an attacker to log into any account with a username containing the case-insensitive substring "success" when an arbitrary password is provided...

Siemens LOGO! 8 BM (Update A)

1. EXECUTIVE SUMMARY CVSS v3 9.4 ATTENTION: Exploitable remotely/low skill level to exploit Vendor: Siemens Equipment: LOGO! 8 BM Vulnerabilities: Missing Authentication for Critical Function, Improper Handling of Extra Values, Plaintext Storage of a Password 2. UPDATE INFORMATION This updated...

ZTE Home Gateway ZXHN H168N 2.2 Access Control Bypass Vulnerability

ZTE Home Gateway ZXHN H168N suffers from multiple access bypass and information disclosure vulnerabilities. POC: CVE-2018-7357 and CVE-2018-7358 Disclaimer: This POC is for Educational Purposes , I would Not be responsible for any misuse of the information mentioned in this blog post +...

SemCms php version V3.2 SQL injection vulnerability in frontend

SemCms is an open source foreign trade enterprise website management system , mainly for foreign trade enterprises , compatible with IE, Firefox and other mainstream browsers . SemCms php version V3.2 front-end SQL injection vulnerability , attackers can use the vulnerability to obtain the...

Davolink DVW-3200N Router Weak Password Vulnerability

The DVW 3200 is a router product from Davolink. A weak password vulnerability exists in the Davolink DVW-3200N router, which allows remote attackers to obtain the device's password...

CVE-2018-10618

Davolink DVW-3200N all version prior to Version 1.00.06. The device generates a weak password hash that is easily cracked, allowing a remote attacker to obtain the password for the device...